Remove unused caCertSecret #16793

aledbf · 2023-03-10T01:18:35Z

Description

Remove an unused feature that also creates an invalid configuration in registry-facade.

It also introduces trust-manager to centralize and simplify the management of ca-certificate.crt in the components

If in the future we need to add support for a custom CA certificate, we only need to add a reference to a secret in the bundle

How to test

cert-manager certificates should generates all the secrets
the file /etc/ss/ca-certificates should be mounted from a configmap
integration tests should pass
open workspaces should work

Related issues

fixes #16767

Any Dedicated cell older than 2 months will experience trouble renewing TLS certificates w/o this change

Release Notes

NONE

Build Options:

/werft with-werft
Run the build with werft instead of GHA
leeway-no-cache
leeway-target=components:all
/werft no-test
Run Leeway with --dont-test

Publish Options

/werft publish-to-npm
/werft publish-to-jb-marketplace

Installer Options

with-ee-license
with-dedicated-emulation
with-ws-manager-mk2
workspace-feature-flags
Add desired feature flags to the end of the line above, space separated

Preview Environment Options:

/werft with-local-preview
If enabled this will build install/preview
/werft with-preview
/werft with-large-vm
/werft with-gce-vm
If enabled this will create the environment on GCE infra
/werft with-integration-tests=workspace
Valid options are all, workspace, webapp, ide, jetbrains, vscode, ssh

werft-gitpod-dev-com · 2023-03-10T14:35:57Z

started the job as gitpod-build-aledbf-bye-custom-ca-cert.8 because the annotations in the pull request description changed
(with .werft/ from main)

werft-gitpod-dev-com · 2023-03-11T00:25:54Z

started the job as gitpod-build-aledbf-bye-custom-ca-cert.26 because the annotations in the pull request description changed
(with .werft/ from main)

werft-gitpod-dev-com · 2023-03-11T02:03:32Z

started the job as gitpod-build-aledbf-bye-custom-ca-cert.30 because the annotations in the pull request description changed
(with .werft/ from main)

werft-gitpod-dev-com · 2023-03-11T02:10:18Z

started the job as gitpod-build-aledbf-bye-custom-ca-cert.31 because the annotations in the pull request description changed
(with .werft/ from main)

werft-gitpod-dev-com · 2023-03-11T02:10:19Z

started the job as gitpod-build-aledbf-bye-custom-ca-cert.32 because the annotations in the pull request description changed
(with .werft/ from main)

werft-gitpod-dev-com · 2023-03-11T02:44:56Z

started the job as gitpod-build-aledbf-bye-custom-ca-cert.34 because the annotations in the pull request description changed
(with .werft/ from main)

aledbf · 2023-03-11T02:56:27Z

/werft with-integration-tests=workspace with-large-vm=true with-gce-vm=true

👎 unknown command: with-integration-tests=workspace
Use /werft help to list the available commands

aledbf · 2023-03-11T02:56:41Z

/werft run with-integration-tests=workspace with-large-vm=true with-gce-vm=true

👍 started the job as gitpod-build-aledbf-bye-custom-ca-cert.35
(with .werft/ from main)

werft-gitpod-dev-com · 2023-03-11T02:57:57Z

started the job as gitpod-build-aledbf-bye-custom-ca-cert.36 because the annotations in the pull request description changed
(with .werft/ from main)

werft-gitpod-dev-com · 2023-03-11T14:17:04Z

started the job as gitpod-build-aledbf-bye-custom-ca-cert.37 because the annotations in the pull request description changed
(with .werft/ from main)

aledbf · 2023-03-11T15:37:08Z

/werft run with-integration-tests=workspace with-large-vm=true with-gce-vm=true

👍 started the job as gitpod-build-aledbf-bye-custom-ca-cert.39
(with .werft/ from main)

werft-gitpod-dev-com · 2023-03-15T14:40:49Z

started the job as gitpod-build-aledbf-bye-custom-ca-cert.54 because the annotations in the pull request description changed
(with .werft/ from main)

easyCZ

The combination of installer and application level changes make this PR more difficult to review. An approach to make that easier is to first update/remove from the installer, and then make the application level changes. This also ensures that we can do an install in between (with just installer config changes) without actually removing the app code. That in turn can make our life easier should we need to revert this.

easyCZ · 2023-03-17T08:21:39Z

dev/preview/workflow/preview/deploy-gitpod.sh

@@ -180,6 +180,23 @@ function installFluentBit {
      upgrade --install fluent-bit fluent/fluent-bit --version 0.21.6 -n "${PREVIEW_NAMESPACE}" -f "$ROOT/.werft/vm/charts/fluentbit/values.yaml"
 }

+function installTrustManager {


How is this change related to this PR?

To be able to get a workspace preview running after running the installer

Sorry, I don't follow. What in this PR makes it so that we now have to install the trust manager which we didn't need before?

The new Bundle definitions solve the issues we have right an invalid cert-manager CA, certificate rotation, and complexity to update /etc/ssl/ca-certificates.crt

aledbf · 2023-03-17T13:06:14Z

The combination of installer and application level changes make this PR more difficult to review. An approach to make that easier is to first update/remove from the installer, and then make the application level changes. This also ensures that we can do an install in between (with just installer config changes) without actually removing the app code. That in turn can make our life easier should we need to revert this.

I can't do that here. If I only remove the feature without fixing the CA state, we break registry-facade (in particular)
For context please check https://gitpod.slack.com/archives/C04EY56P1HN/p1678552918962709

Signed-off-by: Manuel de Brito Fontes <[email protected]>

WVerlaek

lgtm, tested in a preview env starting a workspace and an image build

This reverts commit 5b30eb5.

roboquat added do-not-merge/work-in-progress do-not-merge/release-note-label-needed size/XXL release-note-none and removed do-not-merge/release-note-label-needed labels Mar 10, 2023

aledbf force-pushed the aledbf/bye-custom-ca-cert branch 5 times, most recently from 600e75e to 3ea0c27 Compare March 10, 2023 23:46

aledbf force-pushed the aledbf/bye-custom-ca-cert branch from 3ea0c27 to bca0027 Compare March 11, 2023 00:41

aledbf marked this pull request as ready for review March 11, 2023 15:58

aledbf requested review from a team March 11, 2023 15:58

roboquat removed the do-not-merge/work-in-progress label Mar 11, 2023

github-actions bot added team: webapp Issue belongs to the WebApp team team: workspace Issue belongs to the Workspace team labels Mar 11, 2023

kylos101 assigned aledbf Mar 15, 2023

easyCZ reviewed Mar 17, 2023

View reviewed changes

easyCZ approved these changes Mar 20, 2023

View reviewed changes

aledbf added 15 commits March 20, 2023 20:55

Add trust.cert-manager.io for to bundle CA certificates

7ffd20f

Signed-off-by: Manuel de Brito Fontes <[email protected]>

Configure CA volume and volumemount in components

0a1248e

Update ws-manager golden files

ca1261c

Deploy trust manager in preview

91978dc

Remove duplicated volume

f6b26f8

Update installer golden files

8e6625c

Generate a bundle only for registry-facade

3f9ccfe

Update golden files

cf03b32

Fix initcontainer volume mounts

1ff8010

Update golden files

e2d9c65

Fix registry-facade certificate

fa91fd1

Update golden files

24fd041

Disable skip_verify

2c0b2dc

Enable force conflict with apply server side

7a58c39

Signed-off-by: Manuel de Brito Fontes <[email protected]>

Avoid random werft namespace errors

35b75c3

Signed-off-by: Manuel de Brito Fontes <[email protected]>

aledbf force-pushed the aledbf/bye-custom-ca-cert branch from 4c02380 to 35b75c3 Compare March 20, 2023 23:55

WVerlaek approved these changes Mar 21, 2023

View reviewed changes

roboquat merged commit 5b30eb5 into main Mar 21, 2023

roboquat deleted the aledbf/bye-custom-ca-cert branch March 21, 2023 10:44

roboquat added the deployed: IDE IDE change is running in production label Mar 21, 2023

easyCZ added a commit that referenced this pull request Mar 21, 2023

Revert "Remove unused caCertSecret (#16793)"

942e27d

This reverts commit 5b30eb5.

easyCZ mentioned this pull request Mar 21, 2023

Revert "Remove unused caCertSecret" #16944

Closed

WVerlaek mentioned this pull request Mar 21, 2023

[installer] Fix ClusterIssuerKind for mk2 #16950

Merged

14 tasks

roboquat added deployed: webapp Meta team change is running in production deployed: workspace Workspace team change is running in production labels Mar 22, 2023

Remove unused caCertSecret #16793

Remove unused caCertSecret #16793

Uh oh!

Conversation

aledbf commented Mar 10, 2023 • edited by kylos101 Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

How to test

Related issues

Release Notes

Build Options:

Preview Environment Options:

Uh oh!

werft-gitpod-dev-com bot commented Mar 10, 2023

Uh oh!

werft-gitpod-dev-com bot commented Mar 11, 2023

Uh oh!

werft-gitpod-dev-com bot commented Mar 11, 2023

Uh oh!

werft-gitpod-dev-com bot commented Mar 11, 2023

Uh oh!

werft-gitpod-dev-com bot commented Mar 11, 2023

Uh oh!

werft-gitpod-dev-com bot commented Mar 11, 2023

Uh oh!

aledbf commented Mar 11, 2023 • edited by werft-gitpod-dev-com bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

aledbf commented Mar 11, 2023 • edited by werft-gitpod-dev-com bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

werft-gitpod-dev-com bot commented Mar 11, 2023

Uh oh!

werft-gitpod-dev-com bot commented Mar 11, 2023

Uh oh!

aledbf commented Mar 11, 2023 • edited by werft-gitpod-dev-com bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

werft-gitpod-dev-com bot commented Mar 15, 2023

Uh oh!

easyCZ left a comment

Choose a reason for hiding this comment

Uh oh!

easyCZ Mar 17, 2023

Choose a reason for hiding this comment

Uh oh!

aledbf Mar 17, 2023

Choose a reason for hiding this comment

Uh oh!

easyCZ Mar 17, 2023

Choose a reason for hiding this comment

Uh oh!

aledbf Mar 17, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

aledbf commented Mar 17, 2023

Uh oh!

WVerlaek left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

aledbf commented Mar 10, 2023 •

edited by kylos101

Loading

aledbf commented Mar 11, 2023 •

edited by werft-gitpod-dev-com bot

Loading

aledbf commented Mar 11, 2023 •

edited by werft-gitpod-dev-com bot

Loading

aledbf commented Mar 11, 2023 •

edited by werft-gitpod-dev-com bot

Loading

aledbf Mar 17, 2023 •

edited

Loading