Trust self-signed Git server certificates

Trust self-signed certificates from Git providers by configuring OpenShift Dev Spaces so that workspaces can clone and push to repositories secured by internal certificate authorities.

Before you begin

You have an active oc session with administrative permissions to the OpenShift cluster. See This page is not included, but the link has been rewritten to point to the nearest parent document.Getting started with the CLI.
You have Git version 2 or later installed.

Procedure

Create a new ConfigMap with details about the Git server:
```
$ oc create configmap che-git-self-signed-cert \
  --from-file=ca.crt=<path_to_certificate> \
  --from-literal=githost=<git_server_url> -n openshift-devspaces
```
where:
--from-file

Path to the self-signed certificate.

--from-literal
Optional parameter to specify the Git server URL for example https://git.example.com:8443. When omitted, the self-signed certificate is used for all repositories over HTTPS.
Note:

Certificate files are typically stored as Base64 ASCII files, such as. .pem, .crt, .ca-bundle. All ConfigMaps that hold certificate files should use the Base64 ASCII certificate rather than the binary data certificate.

A certificate chain of trust is required. If the ca.crt is signed by a certificate authority (CA), the CA certificate must be included in the ca.crt file.

Add the required labels to the ConfigMap:

$ oc label configmap che-git-self-signed-cert \
  app.kubernetes.io/part-of=che.eclipse.org -n openshift-devspaces

Edit the CheCluster Custom Resource on the cluster:

$ oc edit checluster/devspaces -n openshift-devspaces

spec:
  devEnvironments:
    trustedCerts:
      gitTrustedCertsConfigMapName: che-git-self-signed-cert

Results

Create and start a new workspace. Every container used by the workspace mounts a special volume that contains a file with the self-signed certificate. The container's /etc/gitconfig file contains information about the Git server host (its URL) and the path to the certificate in the http section (see Git documentation about Content from git-scm.com is not included.git-config).
For example:
```
[http "https://10.33.177.118:3000"]
sslCAInfo = /etc/config/che-git-tls-creds/certificate
```