Skip to content

Commit d984a87

Browse files
authored
chore: Simplify Importing untrusted TLS certificates to Che doc (#2869)
* chore: Simplify Importing untrusted TLS certificates to Che doc Signed-off-by: Anatolii Bazko <[email protected]> * Add https://gdpr.eu to ingoreULRS Signed-off-by: Anatolii Bazko <[email protected]> --------- Signed-off-by: Anatolii Bazko <[email protected]>
1 parent 3081882 commit d984a87

File tree

2 files changed

+10
-6
lines changed

2 files changed

+10
-6
lines changed

.htmltest.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,4 +30,5 @@ IgnoreURLs:
3030
- https://git.example.com:8443
3131
- https://stackoverflow.com/questions/tagged/eclipse-che
3232
- https://example.com/
33+
- https://gdpr.eu/
3334

modules/administration-guide/pages/importing-untrusted-tls-certificates.adoc

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -16,14 +16,17 @@ Therefore, you must import into {prod-short} all untrusted CA chains in use by a
1616
* A source code repositories provider (Git)
1717

1818
{prod-short} uses labeled ConfigMaps in {prod-short} {orch-namespace} as sources for TLS certificates.
19-
The ConfigMaps can have an arbitrary amount of keys with a random amount of certificates each. Operator merges all ConfigMaps into a single one titled `ca-certs-merged`, and mounts it as a volume in the {prod-short} server, dashboard and workspace pods.
20-
By default, the Operator mounts the `ca-certs-merged` ConfigMap in a user's workspace at two locations: `/public-certs` and `/etc/pki/ca-trust/extracted/pem`. The `/etc/pki/ca-trust/extracted/pem` directory is where the system stores extracted CA certificates for trusted certificate authorities on Red Hat (e.g., CentOS, Fedora). CLI tools automatically use certificates from the system-trusted locations, when the user's workspace is up and running.
19+
The ConfigMaps can have an arbitrary amount of keys with a random amount of certificates each.
20+
All certificates are mounted into:
2121

22-
[NOTE]
22+
* `/public-certs` location of {prod-short} server and dashboard pods
23+
* `/public-certs` and `/etc/pki/ca-trust/extracted/pem` locations of workspaces pods
24+
25+
The `/etc/pki/ca-trust/extracted/pem` directory is where the system stores extracted CA certificates for trusted certificate authorities on Red Hat (e.g., CentOS, Fedora). CLI tools automatically use certificates from the system-trusted locations, when the user's workspace is up and running.
26+
27+
[IMPORTANT]
2328
====
24-
When an OpenShift cluster contains cluster-wide trusted CA certificates added through the link:https://docs.openshift.com/container-platform/latest/networking/configuring-a-custom-pki.html#nw-proxy-configure-object_configuring-a-custom-pki[cluster-wide-proxy configuration],
25-
{prod-short} Operator detects them and automatically injects them into a ConfigMap with the `config.openshift.io/inject-trusted-cabundle="true"` label.
26-
Based on this annotation, OpenShift automatically injects the cluster-wide trusted CA certificates inside the `ca-bundle.crt` key of the ConfigMap.
29+
On OpenShift cluster, {prod-short} operator automatically adds Red Hat Enterprise Linux CoreOS (RHCOS) trust bundle into mounted certificates.
2730
====
2831

2932
.Prerequisites

0 commit comments

Comments
 (0)