Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Setting disableWorkspaceCaBundleMount: true doesn't stop mounting certificates into /etc/pki/ca-trust/extracted/pem/ dirs #23380

Open
tolusha opened this issue Mar 7, 2025 · 0 comments
Open

Setting disableWorkspaceCaBundleMount: true doesn't stop mounting certificates into /etc/pki/ca-trust/extracted/pem/ dirs #23380

tolusha opened this issue Mar 7, 2025 · 0 comments
Labels
kind/bug Outline of a bug - must adhere to the bug report template. severity/P1 Has a major impact to usage or development of the system. team/A This team is responsible for the Che Operator and all its operands as well as chectl and Hosted Che

Comments

@tolusha
Copy link
Contributor

tolusha commented Mar 7, 2025

Describe the bug

Currently certificates are mounted into /public-certs and /etc/pki/ca-trust/extracted/pem dirs in userscontainers. SettingdisableWorkspaceCaBundleMount: true` should stop mounting certs into the second dir but it doesn't

https://eclipse.dev/che/docs/stable/administration-guide/importing-untrusted-tls-certificates/

Che version

next (development version)

Steps to reproduce

  1. Deploy Che
  2. Start a workspace
  3. Check file creationg date in /etc/pki/ca-trust/extracted/pem dirs, observe that tls-ca-bundle.pem has a new creation date
  4. disableWorkspaceCaBundleMount: true and start a workspace again, observe that tls-ca-bundle.pem still has a new creation date

Expected behavior

Certs shouldn't be mounted into /etc/pki/ca-trust/extracted/pem dir

Runtime

minikube

Screenshots

No response

Installation method

chectl/next

Environment

Linux

Eclipse Che Logs



Additional context


No response

      		
    

      
  





        



            

              
            

        

      


      
    








      

    



      

  
            

    

      
    

    


      

          @tolusha
tolusha




          added
  the 

  kind/bug

  Outline of a bug - must adhere to the bug report template.
 label


      Mar 7, 2025

    

  



    

    

      
    

    


      

          @che-bot
che-bot




          added
  the 

  status/need-triage

  An issue that needs to be prioritized by the curator responsible for the triage. See https://github.
 label


      Mar 7, 2025

    

  



    

    

      
    

    


      

          @akurinnoy
akurinnoy




            added
      

  severity/P1

  Has a major impact to usage or development of the system.

      

  team/A

  This team is responsible for the Che Operator and all its operands as well as chectl and Hosted Che

    and removed
      

  status/need-triage

  An issue that needs to be prioritized by the curator responsible for the triage. See https://github.

  labels


      Mar 7, 2025

    

  



    











  
  

    

      

  





  




  
  

              

  
    Sign up for free
    to join this conversation on GitHub.
    Already have an account?
    Sign in to comment


  



  






  
                  




    

  


      
  

    Assignees
  



        

    No one assigned







      


  


  

    Labels
  



    

      

    kind/bug

  Outline of a bug - must adhere to the bug report template.
  

    severity/P1

  Has a major impact to usage or development of the system.
  

    team/A

  This team is responsible for the Che Operator and all its operands as well as chectl and Hosted Che








      

  

    

        

    Projects
  


        




        
  

    

      
          
        Eclipse Che Team A Backlog
        
    

    

      

            
    Status: No status

              
      

    

    

  







  



      


  

    
  

    Milestone
  


      No milestone





    
      
          


  

    

      
        

          
    

    Development
  




            
    
No branches or pull requests







      
    

  




      

    

  
      

  

    

      3 participants
    

    

        
          @tolusha 
        
          @akurinnoy 
        
          @che-bot