fix: ensure ca-certs-merged CM is resynced when disableWorkspaceCaBundleMount changed

[tolusha]

What does this PR do?

• Ensure ca-certs-merged CM is resynced when disableWorkspaceCaBundleMount updated
• Set 0444 permissions for mounted tls-ca-bundle.pem file
• Refactoring

Screenshot/screencast of this PR

N/A

What issues does this PR fix or reference?

eclipse-che/che#23533

How to test this PR?

1. Prepare a patch file if needed:

cat > /tmp/cr-patch.yaml <<EOF
apiVersion: org.eclipse.che/v2
kind: CheCluster
spec: {}
EOF

2. Deploy the operator:

on Minikube

./build/scripts/minikube-tests/test-operator-from-sources.sh --cr-patch-yaml /tmp/cr-patch.yaml

3. Update disableWorkspaceCaBundleMount field

spec:
  devEnvironments:
    trustedCerts:
      disableWorkspaceCaBundleMount: true|false

Ensure that ca-certs-merged CM annotations updated as accordingly.

PR Checklist

As the author of this Pull Request I made sure that:

• The Eclipse Contributor Agreement is valid
• Code produced is complete
• Code builds without errors
• Tests are covering the bugfix
• Development resource are up to date
• The repository devfile is up to date and works
• Sections What issues does this PR fix or reference and How to test this PR completed
• Relevant user documentation updated
• Relevant contributing documentation updated
• CI/CD changes implemented, documented and communicated

Reviewers

Reviewers, please comment how you tested the PR when approving it.

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[codecov]

Codecov Report

❌ Patch coverage is 95.34884% with 6 lines in your changes missing coverage. Please review.
✅ Project coverage is 58.32%. Comparing base (f1d91dc) to head (d43da37).
⚠️ Report is 3 commits behind head on main.

Files with missing lines	Patch %	Lines
pkg/common/diffs/diffs.go	77.77%	6 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2041      +/-   ##
==========================================
+ Coverage   58.22%   58.32%   +0.10%     
==========================================
  Files          90       90              
  Lines       12401    12312      -89     
==========================================
- Hits         7220     7181      -39     
+ Misses       4679     4634      -45     
+ Partials      502      497       -5     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[akurinnoy]

LGTM

[rohanKanojia]

Tested it with following steps and it worked as expected ✔️ :

1. Start minikube
2. Create Patch file with no trustedCerts field:

cat > /tmp/cr-patch.yaml <<EOF
apiVersion: org.eclipse.che/v2
kind: CheCluster
spec: {}
EOF

3. Checkout this branch and install che-operator ./build/scripts/minikube-tests/test-operator-from-sources.sh --cr-patch-yaml /tmp/cr-patch.yaml
4. After che-operator is installed, verify annotations of ca-certs-merged ConfigMap in namespace eclipse-che:

kubectl get cm ca-certs-merged -neclipse-che -o yaml

...
kind: ConfigMap
metadata:
  annotations:
    controller.devfile.io/mount-as: subpath
    controller.devfile.io/mount-path: /etc/pki/ca-trust/extracted/pem

5. Edit CheCluster custom resource in eclipse-che namespace to add this field:

kubectl edit checluster -n eclipse-che

# Add the following to devEnvironments
    trustedCerts:
      disableWorkspaceCaBundleMount: true

6. Check ca-certs-managed ConfigMap again to see if annotations are updated:

kubectl get cm ca-certs-merged -neclipse-che -o yaml
...
kind: ConfigMap
metadata:
  annotations:
    controller.devfile.io/mount-access-mode: "0444"
    controller.devfile.io/mount-as: file
    controller.devfile.io/mount-path: /public-certs

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: rohanKanojia, tolusha

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment