Support git clone for repos with self-signed SSL certs

Is your enhancement related to a problem? Please describe.

Say I’m a customer behind a firewall (air gap).

I have company wide certs for connecting my local laptop to company internal git repos.

But when I fire up Che 7, launch a workspace from a devfile…

projects:
  - name: java-maven-helloworld
    source:
      type: git
      location: "https://git.mycorp.com/projects-r-us/java-maven-helloworld.git"

… and try to clone from the repo, I can’t connect:

The only workaround is to open a console in the Che 7 workspace, and do this:

git config --global http.sslverify “false”
git clone https://git.mycorp.com/projects-r-us/java-maven-helloworld.git

So… how can I get those certs into my che 7 workspace OOTB via the devfile, so I can clone from those repos as part of workspace creation, rather than via a manual step?

Describe the solution you’d like

We can do it in same way how it works for Keycloak at the moment, here helm template and Java code in Che repository. Also need to configure git trust store.

Workflow will be:

• admin put somewhere correct SSL certificate for internal Git server (with name like CHE_GIT_SSL_CERT);
• during start workspace we will:
  • mount this certificate on each container as k8s secret, in specified path;
  • modify git config git config --global http.sslCAInfo /home/some-path/git-certs/cert.pem;

[l0rd]

Another option: since in user preferences we already persist git.username and git.email it may make sense to persist git.http.sslverify as well. I mean user config should probably not live in a devfile.

[vinokurig]

Sub issue is resolved: https://github.com/eclipse/che-operator/pull/142