Che 7, TLS and self signed certs

There are multiple problems:

1. Failed to start a Che 7 workspace if Che deployment is configured to use self signed cert

2019-02-07 18:23:32,549[aceSharedPool-1]  [WARN ] [.i.k.KubernetesInternalRuntime 249]  - 
Failed to start Kubernetes runtime of workspace workspaceq1ys0pxhpfgzgmu8. 
Cause: Plugins installation process failed. Error: Unrecoverable event occurred: 
'FailedMount', 'MountVolume.SetUp failed for volume "che-self-signed-cert" : secret 
"che-self-signed-cert" not found', 'workspaceq1ys0pxhpfgzgmu8.che-plugin-broker'

A secret with cert body isn’t created but che-plugin-broker pod is configured to use it

1. Once #1 is fixed I expect that che-plugin-broker isn’t aware of such a cert and will fail to communicate with master using tls route/ingress.

2. Once #1 and #2 is solved, Theia server side will be the next suspect since Theia communicates with Che master to grab workspace config and other info. So, Theia should also use the cert or trust all insecure endpoints.

@slemeur @l0rd is this smth that should be taken care of for after beta Che 7 releases?

[l0rd]

@gorkem it wasn’t actually. I have added that to the GA list. Still wondering what we need to do to fix this. Will try to make a list here:

• wsmaster/keycloak side should be already addressed
• fix the issue faced by @johnmcollier: volume created but the secret with the self-signed cert is not https://github.com/eclipse/che/issues/13433
• make sure that che-theia trusts the self-signed cert https://github.com/eclipse/che/issues/12634
• make sure that che-plugin-broker trusts the self-signed cert

@skabashnyuk @benoitf @sleshchenko please review this list and comment if I am missing something

@johnmcollier can you provide more details to reproduce your problem? To setup the self-signed cert have you followed Che 6 documentation? With what stack are you testing?

[l0rd]

@eivantsov I see it like a requirement for Che 7 GA, not beta. @benoitf self signed certs were considered critical for Che 6 because we considered that let’s encrypt doesn’t work for every use case.