Skip to content

Commit 942e27d

Browse files
easyCZeasyCZ
authored
Revert "Remove unused caCertSecret (#16793)"
This reverts commit 5b30eb5.
1 parent cb46c91 commit 942e27d

File tree

72 files changed

+3316
-4973
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

72 files changed

+3316
-4973
lines changed

‎components/image-builder-mk3/cmd/setup.go

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
// Copyright (c) 2020 Gitpod GmbH. All rights reserved.
2+
// Licensed under the GNU Affero General Public License (AGPL).
3+
// See License.AGPL.txt in the project root for license information.
4+
5+
package cmd
6+
7+
import (
8+
"os"
9+
"os/exec"
10+
11+
"github.com/spf13/cobra"
12+
13+
"github.com/gitpod-io/gitpod/common-go/log"
14+
)
15+
16+
var setupCmd = &cobra.Command{
17+
Use: "setup",
18+
Short: "Updates the CA certificates",
19+
Run: func(cmd *cobra.Command, args []string) {
20+
log.Info("Updating CA certificates...")
21+
shCmd := exec.Command("update-ca-certificates", "-f")
22+
shCmd.Stdin = os.Stdin
23+
shCmd.Stderr = os.Stderr
24+
shCmd.Stdout = os.Stdout
25+
26+
err := shCmd.Run()
27+
if err != nil {
28+
log.Fatalf("cannot update CA certificates: %v", err)
29+
}
30+
},
31+
}
32+
33+
func init() {
34+
rootCmd.AddCommand(setupCmd)
35+
}

‎components/registry-facade/cmd/setup.go

Lines changed: 24 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ package cmd
77
import (
88
"fmt"
99
"os"
10+
"os/exec"
1011
"path/filepath"
1112
"regexp"
1213

@@ -42,15 +43,13 @@ var setupCmd = &cobra.Command{
4243
}
4344

4445
// https://github.com/containerd/containerd/blob/main/docs/cri/config.md#registry-configuration
45-
// https://github.com/containerd/containerd/blob/main/docs/hosts.md
4646
hostsToml := fmt.Sprintf(`
4747
server = "https://%v:%v"
4848
4949
[host."https://%v:%v"]
5050
capabilities = ["pull", "resolve"]
5151
ca = "%v"
52-
# skip verifications of the registry's certificate chain and host name when set to true
53-
#skip_verify = true
52+
skip_verify = true
5453
`, hostname, port, hostname, port, filepath.Join(regDirectory, "ca.crt"))
5554

5655
err = os.WriteFile(filepath.Join(fakeRegPath, "hosts.toml"), []byte(hostsToml), 0644)
@@ -69,6 +68,27 @@ server = "https://%v:%v"
6968
}
7069
}
7170
}
71+
72+
{
73+
log.Info("Updating CA certificates in the node...")
74+
shCmd := exec.Command("update-ca-certificates", "-f")
75+
shCmd.Stdin = os.Stdin
76+
shCmd.Stderr = os.Stderr
77+
shCmd.Stdout = os.Stdout
78+
79+
err := shCmd.Run()
80+
if err != nil {
81+
log.Fatalf("cannot update CA certificates: %v", err)
82+
}
83+
84+
sourceCA := "/etc/ssl/certs/ca-certificates.crt"
85+
targetCA := filepath.Join(hostfs, "/etc/ssl/certs/ca-certificates.crt")
86+
87+
err = copyFile(sourceCA, targetCA)
88+
if err != nil {
89+
log.Fatal(err)
90+
}
91+
}
7292
},
7393
}
7494

@@ -81,6 +101,7 @@ func init() {
81101

82102
_ = setupCmd.MarkFlagRequired("hostname")
83103
_ = setupCmd.MarkFlagRequired("hostfs")
104+
_ = setupCmd.MarkFlagRequired("ca-directory")
84105
}
85106

86107
func hostExists(hostname, hostsPath string) bool {

‎components/ws-manager-api/go/config/config.go

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,9 @@ type Configuration struct {
8888
Timeouts WorkspaceTimeoutConfiguration `json:"timeouts"`
8989
// InitProbe configures the ready-probe of workspaces which signal when the initialization is finished
9090
InitProbe InitProbeConfiguration `json:"initProbe"`
91+
// WorkspaceCACertSecret optionally names a secret which is mounted in `/etc/ssl/certs/gp-custom.crt`
92+
// in all workspace pods.
93+
WorkspaceCACertSecret string `json:"caCertSecret,omitempty"`
9194
// WorkspaceURLTemplate is a Go template which resolves to the external URL of the
9295
// workspace. Available fields are:
9396
// - `ID` which is the workspace ID,

‎components/ws-manager-mk2/controllers/create.go

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -267,6 +267,16 @@ func createDefiniteWorkspacePod(sctx *startWorkspaceContext) (*corev1.Pod, error
267267
prefix = "prebuild"
268268
case workspacev1.WorkspaceTypeImageBuild:
269269
prefix = "imagebuild"
270+
// mount self-signed gitpod CA certificate to ensure
271+
// we can push images to the in-cluster registry
272+
workspaceContainer.VolumeMounts = append(workspaceContainer.VolumeMounts,
273+
corev1.VolumeMount{
274+
Name: "gitpod-ca-certificate",
275+
MountPath: "/usr/local/share/ca-certificates/gitpod-ca.crt",
276+
SubPath: "ca.crt",
277+
ReadOnly: true,
278+
},
279+
)
270280
default:
271281
prefix = "ws"
272282
}
@@ -311,6 +321,51 @@ func createDefiniteWorkspacePod(sctx *startWorkspaceContext) (*corev1.Pod, error
311321
},
312322
},
313323
}
324+
if sctx.Workspace.Spec.Type == workspacev1.WorkspaceTypeImageBuild {
325+
volumes = append(volumes, corev1.Volume{
326+
Name: "gitpod-ca-certificate",
327+
VolumeSource: corev1.VolumeSource{
328+
Secret: &corev1.SecretVolumeSource{
329+
SecretName: "builtin-registry-facade-cert",
330+
Items: []corev1.KeyToPath{
331+
{Key: "ca.crt", Path: "ca.crt"},
332+
},
333+
},
334+
},
335+
})
336+
}
337+
338+
// This is how we support custom CA certs in Gitpod workspaces.
339+
// Keep workspace templates clean.
340+
if sctx.Config.WorkspaceCACertSecret != "" {
341+
const volumeName = "custom-ca-certs"
342+
volumes = append(volumes, corev1.Volume{
343+
Name: volumeName,
344+
VolumeSource: corev1.VolumeSource{
345+
Secret: &corev1.SecretVolumeSource{
346+
SecretName: sctx.Config.WorkspaceCACertSecret,
347+
Items: []corev1.KeyToPath{
348+
{
349+
Key: "ca.crt",
350+
Path: "ca.crt",
351+
},
352+
},
353+
},
354+
},
355+
})
356+
357+
const mountPath = "/etc/ssl/certs/gitpod-ca.crt"
358+
workspaceContainer.VolumeMounts = append(workspaceContainer.VolumeMounts, corev1.VolumeMount{
359+
Name: volumeName,
360+
ReadOnly: true,
361+
MountPath: mountPath,
362+
SubPath: "ca.crt",
363+
})
364+
workspaceContainer.Env = append(workspaceContainer.Env, corev1.EnvVar{
365+
Name: "NODE_EXTRA_CA_CERTS",
366+
Value: mountPath,
367+
})
368+
}
314369

315370
workloadType := "regular"
316371
if sctx.Headless {

‎components/ws-manager/pkg/manager/create.go

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -443,6 +443,51 @@ func (m *Manager) createDefiniteWorkspacePod(startContext *startWorkspaceContext
443443
},
444444
}
445445

446+
// This is how we support custom CA certs in Gitpod workspaces.
447+
// Keep workspace templates clean.
448+
if m.Config.WorkspaceCACertSecret != "" {
449+
const volumeName = "custom-ca-certs"
450+
volumes = append(volumes, corev1.Volume{
451+
Name: volumeName,
452+
VolumeSource: corev1.VolumeSource{
453+
Secret: &corev1.SecretVolumeSource{
454+
SecretName: m.Config.WorkspaceCACertSecret,
455+
Items: []corev1.KeyToPath{
456+
{
457+
Key: "ca.crt",
458+
Path: "ca.crt",
459+
},
460+
},
461+
},
462+
},
463+
})
464+
465+
const mountPath = "/etc/ssl/certs/gitpod-ca.crt"
466+
workspaceContainer.VolumeMounts = append(workspaceContainer.VolumeMounts, corev1.VolumeMount{
467+
Name: volumeName,
468+
ReadOnly: true,
469+
MountPath: mountPath,
470+
SubPath: "ca.crt",
471+
})
472+
workspaceContainer.Env = append(workspaceContainer.Env, corev1.EnvVar{
473+
Name: "NODE_EXTRA_CA_CERTS",
474+
Value: mountPath,
475+
})
476+
}
477+
478+
if req.Type == api.WorkspaceType_IMAGEBUILD {
479+
// mount self-signed gitpod CA certificate to ensure
480+
// we can push images to the in-cluster registry
481+
workspaceContainer.VolumeMounts = append(workspaceContainer.VolumeMounts,
482+
corev1.VolumeMount{
483+
Name: "gitpod-ca-certificate",
484+
MountPath: "/usr/local/share/ca-certificates/gitpod-ca.crt",
485+
SubPath: "ca.crt",
486+
ReadOnly: true,
487+
},
488+
)
489+
}
490+
446491
workloadType := "regular"
447492
if startContext.Headless {
448493
workloadType = "headless"
@@ -604,6 +649,20 @@ func (m *Manager) createDefiniteWorkspacePod(startContext *startWorkspaceContext
604649
}
605650
}
606651

652+
if req.Type == api.WorkspaceType_IMAGEBUILD {
653+
pod.Spec.Volumes = append(pod.Spec.Volumes, corev1.Volume{
654+
Name: "gitpod-ca-certificate",
655+
VolumeSource: corev1.VolumeSource{
656+
Secret: &corev1.SecretVolumeSource{
657+
SecretName: "builtin-registry-facade-cert",
658+
Items: []corev1.KeyToPath{
659+
{Key: "ca.crt", Path: "ca.crt"},
660+
},
661+
},
662+
},
663+
})
664+
}
665+
607666
return &pod, nil
608667
}
609668

‎components/ws-manager/pkg/manager/create_test.go

Lines changed: 12 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -53,10 +53,11 @@ func TestCreateDefiniteWorkspacePod(t *testing.T) {
5353
type fixture struct {
5454
WorkspaceClass
5555

56-
Spec *json.RawMessage `json:"spec,omitempty"` // *api.StartWorkspaceSpec
57-
Request *json.RawMessage `json:"request,omitempty"` // *api.StartWorkspaceRequest
58-
Context *startWorkspaceContext `json:"context,omitempty"`
59-
Classes map[string]WorkspaceClass `json:"classes,omitempty"`
56+
Spec *json.RawMessage `json:"spec,omitempty"` // *api.StartWorkspaceSpec
57+
Request *json.RawMessage `json:"request,omitempty"` // *api.StartWorkspaceRequest
58+
Context *startWorkspaceContext `json:"context,omitempty"`
59+
CACertSecret string `json:"caCertSecret,omitempty"`
60+
Classes map[string]WorkspaceClass `json:"classes,omitempty"`
6061

6162
EnforceAffinity bool `json:"enforceAffinity,omitempty"`
6263
DebugWorkspacePod bool `json:"debugWorkspacePod,omitempty"`
@@ -73,6 +74,7 @@ func TestCreateDefiniteWorkspacePod(t *testing.T) {
7374
fixture := input.(*fixture)
7475

7576
mgmtCfg := forTestingOnlyManagerConfig()
77+
mgmtCfg.WorkspaceCACertSecret = fixture.CACertSecret
7678
mgmtCfg.DebugWorkspacePod = fixture.DebugWorkspacePod
7779

7880
if fixture.Classes == nil {
@@ -196,10 +198,11 @@ func TestCreatePVCForWorkspacePod(t *testing.T) {
196198
type fixture struct {
197199
WorkspaceClass
198200

199-
Spec *json.RawMessage `json:"spec,omitempty"` // *api.StartWorkspaceSpec
200-
Request *json.RawMessage `json:"request,omitempty"` // *api.StartWorkspaceRequest
201-
Context *startWorkspaceContext `json:"context,omitempty"`
202-
Classes map[string]WorkspaceClass `json:"classes,omitempty"`
201+
Spec *json.RawMessage `json:"spec,omitempty"` // *api.StartWorkspaceSpec
202+
Request *json.RawMessage `json:"request,omitempty"` // *api.StartWorkspaceRequest
203+
Context *startWorkspaceContext `json:"context,omitempty"`
204+
CACertSecret string `json:"caCertSecret,omitempty"`
205+
Classes map[string]WorkspaceClass `json:"classes,omitempty"`
203206

204207
EnforceAffinity bool `json:"enforceAffinity,omitempty"`
205208
}
@@ -215,6 +218,7 @@ func TestCreatePVCForWorkspacePod(t *testing.T) {
215218
fixture := input.(*fixture)
216219

217220
mgmtCfg := forTestingOnlyManagerConfig()
221+
mgmtCfg.WorkspaceCACertSecret = fixture.CACertSecret
218222

219223
if fixture.Classes == nil {
220224
fixture.Classes = make(map[string]WorkspaceClass)

‎components/ws-manager/pkg/manager/testdata/cdwp_affinity.golden

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -267,4 +267,4 @@
267267
},
268268
"status": {}
269269
}
270-
}
270+
}

0 commit comments

Comments
 (0)