Propagate custom CA certificate into Keycloak trust store

[mmorhun]

Signed-off-by: Mykola Morhun [email protected]

What this PR does

We have serverTrustStoreConfigMapName parameter in Che CR, which hold name of config map with custom CA certificates. They are added into Che server trust store only, but to fully support trusting to custom CA certificates we need to propagate them into Keycloak and user workspaces.
This PR adds functionality which propagates custom CA certificates into Keycloak trust store.

Reference issue

https://issues.redhat.com/browse/CRW-336

How to test

1. Create a configmap which has CA certificates only.
   This could be done via kubectl apply -f <yaml> where the config map definition could be like:

--- 
apiVersion: v1
kind: ConfigMap
metadata: 
  name: ca-certs
data: 
  demoCA.crt: |
    -----BEGIN CERTIFICATE-----
    MIIE9DCCAtygAwIBAgIULvsF/i5fe7k9lmHB5vVcYVzUu6IwDQYJKoZIhvcNAQEL
    ...
    yIxypcdoasYNfQA8pv4jaOaOo6ED61Wi
    -----END CERTIFICATE-----
  testCA.crt: |
    -----BEGIN CERTIFICATE-----
    MIIE9DCCAtygAwIBAgIUclWFCOb945tF50cWQOOIhrKHgOYwDQYJKoZIhvcNAQEL
   ...
    hl7GDIY6ql9YpHFsyUuNG4mNqq8NLt1X
    -----END CERTIFICATE-----

2. Modify Che custom resource by adding serverTrustStoreConfigMapName under spec.server. Or this could be done by providing --che-operator-cr-patch-yaml option to chectl. Pathc file content:

spec:
  server:
    serverTrustStoreConfigMapName: "ca-certs"

3. Exec into Keycloak container and query trust store for certificates.

[tolusha]

The changes will be included in another PR.

[tolusha]

corresponding doc
https://www.eclipse.org/che/docs/che-7/adding-custom-certificates-to-trust-store/

[mmorhun]

Retested: certificates propagation into Keycloak trust store works as expected.

[davidfestal]

Approved with just a question

[davidfestal]

So you preferred creating the volume in any case and leaving the volume source empty in case no public certificate is provided ?

[tolusha]

right