Skip to content

Commit 31b4c42

Browse files
iQQBotiQQBot
committed
Support custom CA certificates in Helm
1 parent 5dafe5c commit 31b4c42

13 files changed

+118
-0
lines changed

‎chart/templates/_helpers.tpl

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -357,6 +357,39 @@ storage:
357357
{{- end -}}
358358
{{- end -}}
359359

360+
{{/* custom ca bundle volume and volumeMount */}}
361+
{{- define "gitpod.caBundleVolume" -}}
362+
{{- if .Values.fullCABundleSecretName -}}
363+
- name: ca-bundle-certs
364+
secret:
365+
secretName: {{ .Values.fullCABundleSecretName }}
366+
{{- end -}}
367+
{{- end -}}
368+
369+
{{- define "gitpod.caBundleVolumeMount" -}}
370+
{{- if .Values.fullCABundleSecretName -}}
371+
- name: ca-bundle-certs
372+
mountPath: /etc/ssl/certs/ca-certificates.crt
373+
subPath: ca-certificates.crt
374+
{{- end -}}
375+
{{- end -}}
376+
377+
{{- define "gitpod.extraCABundleVolume" -}}
378+
{{- if .Values.extraCABundleSecretName -}}
379+
- name: extra-certs
380+
secret:
381+
secretName: {{ .Values.extraCABundleSecretName }}
382+
{{- end -}}
383+
{{- end -}}
384+
385+
{{- define "gitpod.extraCABundleVolumeMount" -}}
386+
{{- if .Values.extraCABundleSecretName -}}
387+
- name: extra-certs
388+
mountPath: /etc/ssl/certs/extra/ca-certificates.crt
389+
subPath: ca-certificates.crt
390+
{{- end -}}
391+
{{- end -}}
392+
360393
{{- define "gitpod.kube-rbac-proxy" -}}
361394
- name: kube-rbac-proxy
362395
image: quay.io/brancz/kube-rbac-proxy:v0.11.0

‎chart/templates/blobserve-deployment.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,9 @@ spec:
6565
mountPath: /mnt/pull-secret.json
6666
subPath: .dockerconfigjson
6767
{{- end }}
68+
{{- if .Values.fullCABundleSecretName }}
69+
{{ include "gitpod.caBundleVolumeMount" . | indent 8 }}
70+
{{- end }}
6871
{{ include "gitpod.kube-rbac-proxy" $this | indent 6 }}
6972
volumes:
7073
- name: cache
@@ -77,5 +80,8 @@ spec:
7780
secret:
7881
secretName: {{ .Values.components.workspace.pullSecret.secretName }}
7982
{{- end }}
83+
{{- if .Values.fullCABundleSecretName }}
84+
{{ include "gitpod.caBundleVolume" . | indent 6 }}
85+
{{- end }}
8086
{{ toYaml .Values.defaults | indent 6 }}
8187
{{ end }}

‎chart/templates/content-service-deployment.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,13 +61,19 @@ spec:
6161
- name: config
6262
mountPath: "/config"
6363
readOnly: true
64+
{{- if .Values.fullCABundleSecretName }}
65+
{{ include "gitpod.caBundleVolumeMount" . | indent 8 }}
66+
{{- end }}
6467
{{- if $comp.volumeMounts }}
6568
{{ toYaml $comp.volumeMounts | indent 8 }}
6669
{{- end }}
6770
volumes:
6871
- name: config
6972
configMap:
7073
name: {{ template "gitpod.comp.configMap" $this }}
74+
{{- if .Values.fullCABundleSecretName }}
75+
{{ include "gitpod.caBundleVolume" . | indent 6 }}
76+
{{- end }}
7177
{{- if $comp.volumes }}
7278
{{ toYaml $comp.volumes | indent 6 }}
7379
{{- end }}

‎chart/templates/image-builder-deployment.yaml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,9 @@ spec:
6464
secret:
6565
secretName: {{ $sec.secret }}
6666
{{- end }}
67+
{{- if .Values.fullCABundleSecretName }}
68+
{{ include "gitpod.caBundleVolume" . | indent 6 }}
69+
{{- end }}
6770
enableServiceLinks: false
6871
containers:
6972
- name: dind
@@ -80,6 +83,9 @@ spec:
8083
- mountPath: /etc/docker/certs.d/{{- if eq $sec.name "builtin" -}}{{ template "gitpod.builtinRegistry.name" $this.root }}{{ else }}{{ $sec.name }}{{ end }}
8184
name: docker-tls-certs-{{ $idx }}
8285
{{- end }}
86+
{{- if .Values.fullCABundleSecretName }}
87+
{{ include "gitpod.caBundleVolumeMount" . | indent 8 }}
88+
{{- end }}
8389
{{- if $comp.dindResources }}
8490
resources:
8591
{{ toYaml $comp.dindResources | indent 10 }}
@@ -105,6 +111,9 @@ spec:
105111
name: pull-secret
106112
{{- end }}
107113
{{- end }}
114+
{{- if .Values.fullCABundleSecretName }}
115+
{{ include "gitpod.caBundleVolumeMount" . | indent 8 }}
116+
{{- end }}
108117
resources:
109118
requests:
110119
cpu: {{ $.Values.resources.default.cpu }}

‎chart/templates/image-builder-mk3-deployment.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,9 @@ spec:
6060
- name: wsman-tls-certs
6161
secret:
6262
secretName: {{ .Values.components.wsManager.tls.server.secretName }}
63+
{{- if .Values.fullCABundleSecretName }}
64+
{{ include "gitpod.caBundleVolume" . | indent 6 }}
65+
{{- end }}
6366
enableServiceLinks: false
6467
containers:
6568
{{ include "gitpod.kube-rbac-proxy" $this | indent 6 }}
@@ -86,6 +89,9 @@ spec:
8689
name: pull-secret
8790
{{- end }}
8891
{{- end }}
92+
{{- if .Values.fullCABundleSecretName }}
93+
{{ include "gitpod.caBundleVolumeMount" . | indent 8 }}
94+
{{- end }}
8995
resources:
9096
requests:
9197
cpu: {{ $.Values.resources.default.cpu }}

‎chart/templates/proxy-deployment.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -105,6 +105,9 @@ spec:
105105
{{- end }}
106106
- name: config-certificates
107107
mountPath: "/etc/caddy/certificates"
108+
{{- if .Values.fullCABundleSecretName }}
109+
{{ include "gitpod.caBundleVolumeMount" . | indent 8 }}
110+
{{- end }}
108111
{{ include "gitpod.container.defaultEnv" (dict "root" . "gp" $.Values "comp" $comp) | indent 8 }}
109112
- name: PROXY_DOMAIN
110113
value: "{{ $.Values.hostname }}"
@@ -123,5 +126,8 @@ spec:
123126
- name: config-certificates
124127
secret:
125128
secretName: {{ $.Values.certificatesSecret.secretName }}
129+
{{- if .Values.fullCABundleSecretName }}
130+
{{ include "gitpod.caBundleVolume" . | indent 6 }}
131+
{{- end }}
126132
{{ toYaml .Values.defaults | indent 6 }}
127133
{{ end }}

‎chart/templates/registry-facade-daemonset.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,9 @@ spec:
7171
- name: https-certificates
7272
mountPath: "/mnt/certificates"
7373
{{- end }}
74+
{{- if .Values.fullCABundleSecretName }}
75+
{{ include "gitpod.caBundleVolumeMount" . | indent 8 }}
76+
{{- end }}
7477
{{ include "gitpod.kube-rbac-proxy" $this | indent 6 }}
7578
volumes:
7679
- name: cache
@@ -91,5 +94,8 @@ spec:
9194
secret:
9295
secretName: {{ .Values.certificatesSecret.secretName }}
9396
{{- end }}
97+
{{- if .Values.fullCABundleSecretName }}
98+
{{ include "gitpod.caBundleVolume" . | indent 6 }}
99+
{{- end }}
94100
{{ toYaml .Values.defaults | indent 6 }}
95101
{{ end }}

‎chart/templates/server-deployment.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -105,6 +105,9 @@ spec:
105105
mountPath: "{{ dir $comp.githubApp.certPath }}"
106106
readOnly: true
107107
{{- end }}
108+
{{- if .Values.fullCABundleSecretName }}
109+
{{ include "gitpod.caBundleVolumeMount" . | indent 8 }}
110+
{{- end }}
108111
{{- if $comp.serverContainer.volumeMounts }}
109112
{{ toYaml $comp.serverContainer.volumeMounts | indent 8 }}
110113
{{- end }}
@@ -145,5 +148,8 @@ spec:
145148
{{- if $comp.volumes }}
146149
{{ toYaml $comp.volumes | indent 6 }}
147150
{{- end }}
151+
{{- if .Values.fullCABundleSecretName }}
152+
{{ include "gitpod.caBundleVolume" . | indent 6 }}
153+
{{- end }}
148154
{{ toYaml .Values.defaults | indent 6 }}
149155
{{ end }}

‎chart/templates/ws-daemon-daemonset.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -100,6 +100,9 @@ spec:
100100
{{- end }}
101101
{{- if $comp.volumes }}
102102
{{ toYaml $comp.volumes | indent 6 }}
103+
{{- end }}
104+
{{- if .Values.fullCABundleSecretName }}
105+
{{ include "gitpod.caBundleVolume" . | indent 6 }}
103106
{{- end }}
104107
enableServiceLinks: false
105108
{{- if (or $comp.userNamespaces.shiftfsModuleLoader.enabled $comp.userNamespaces.seccompProfileInstaller.enabled) }}
@@ -267,6 +270,9 @@ spec:
267270
name: tls-certs
268271
{{- if $comp.volumeMounts }}
269272
{{ toYaml $comp.volumeMounts | indent 8 }}
273+
{{- end }}
274+
{{- if .Values.fullCABundleSecretName }}
275+
{{ include "gitpod.caBundleVolumeMount" . | indent 8 }}
270276
{{- end }}
271277
args: ["run", "--config", "/config/config.json"]
272278
image: {{ template "gitpod.comp.imageFull" $this }}

‎chart/templates/ws-manager-deployment.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,9 @@ spec:
5656
- name: workspace-template
5757
configMap:
5858
name: workspace-template
59+
{{- if .Values.extraCABundleSecretName }}
60+
{{ include "gitpod.extraCABundleVolume" . | indent 6 }}
61+
{{- end }}
5962
{{- if $comp.volumes }}
6063
{{ toYaml $comp.volumes | indent 6 }}
6164
{{- end }}
@@ -81,6 +84,9 @@ spec:
8184
- mountPath: /certs
8285
name: tls-certs
8386
readOnly: true
87+
{{- if .Values.extraCABundleSecretName }}
88+
{{ include "gitpod.extraCABundleVolumeMount" . | indent 8 }}
89+
{{- end }}
8490
{{- if $comp.volumeMounts }}
8591
{{ toYaml $comp.volumeMounts | indent 8 }}
8692
{{- end }}

‎chart/values.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -761,3 +761,5 @@ cert-manager:
761761
certificate:
762762
selfSigned: true
763763
secretName: gitpod-ca-certificate
764+
765+
# fullCABundleSecretName: full-ca-bundle

‎components/supervisor/pkg/supervisor/supervisor.go

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ import (
99
"crypto/rand"
1010
"crypto/rsa"
1111
"crypto/sha256"
12+
"encoding/base64"
1213
"encoding/json"
1314
"errors"
1415
"fmt"
@@ -148,6 +149,7 @@ func Run(options ...RunOption) {
148149
return
149150
}
150151

152+
mergeExtraCABundle()
151153
err = AddGitpodUserIfNotExists()
152154
if err != nil {
153155
log.WithError(err).Fatal("cannot ensure Gitpod user exists")
@@ -352,6 +354,21 @@ func Run(options ...RunOption) {
352354
wg.Wait()
353355
}
354356

357+
func mergeExtraCABundle() {
358+
if c := os.Getenv("GITPOD_EXTRA_CA_BUNDLE"); c != "" {
359+
crt, err := base64.RawStdEncoding.DecodeString(c)
360+
if err != nil {
361+
return
362+
}
363+
file, err := os.OpenFile("/etc/ssl/certs/ca-certificates.crt", os.O_WRONLY|os.O_APPEND, 0622)
364+
if err != nil {
365+
return
366+
}
367+
_, _ = file.Write(crt)
368+
_ = file.Close()
369+
}
370+
}
371+
355372
func createGitpodService(cfg *Config, tknsrv api.TokenServiceServer) *gitpod.APIoverJSONRPC {
356373
endpoint, host, err := cfg.GitpodAPIEndpoint()
357374
if err != nil {

‎components/ws-manager/pkg/manager/create.go

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ import (
1010
"encoding/base64"
1111
"fmt"
1212
"io"
13+
"os"
1314
"path/filepath"
1415
"reflect"
1516
"strconv"
@@ -568,6 +569,14 @@ func (m *Manager) createWorkspaceEnvironment(startContext *startWorkspaceContext
568569
result = append(result, corev1.EnvVar{Name: "THEIA_WEBVIEW_EXTERNAL_ENDPOINT", Value: "webview-{{hostname}}"})
569570
result = append(result, corev1.EnvVar{Name: "THEIA_MINI_BROWSER_HOST_PATTERN", Value: "browser-{{hostname}}"})
570571

572+
if _, err := os.Stat("/etc/ssl/certs/extra/ca-certificates.crt"); err == nil {
573+
crt, err := os.ReadFile("/etc/ssl/certs/extra/ca-certificates.crt")
574+
if err == nil {
575+
base64Crt := base64.RawStdEncoding.EncodeToString(crt)
576+
result = append(result, corev1.EnvVar{Name: "GITPOD_EXTRA_CA_BUNDLE", Value: base64Crt})
577+
}
578+
}
579+
571580
// We don't require that Git be configured for workspaces
572581
if spec.Git != nil {
573582
result = append(result, corev1.EnvVar{Name: "GITPOD_GIT_USER_NAME", Value: spec.Git.Username})

0 commit comments

Comments
 (0)