Please allow different name than ca.crt when Deploying Che with support for Git repositories with self-signed certificates.

[rhopp]

Describe the bug

When trying to configure Che to work properly with on-prem gitlab instance (with support of factories etc.) and the gitlab instance has self signed certificate, user gets to the point, where he needs to add the self signed certificate into two configmaps. This alone is not ideal, but to make it worse, the certificate filename (and thus the configmap key) needs to be named ca.crt in one case, but can't be named ca.crt in second case, which is confusing.

Relevant parts of documentation describing this:

• https://www.eclipse.org/che/docs/che-7/administration-guide/configuring-authorization/#configuring-gitlab-oauth2_che - Procedure about configuring gitlab OAuth2 in order to be able to work with factories from private gitlab repositories. There are two links on the bottom mentioning how to configure if the gitlab repo has self-signed cert.
• https://www.eclipse.org/che/docs/che-7/installation-guide/importing-untrusted-tls-certificates/ - This procedure is about adding the self-signed cert to che, so keycloak&che can communicate with the gitlab instance. In this procedure, the cert filename can't be named ca.crt.
• https://www.eclipse.org/che/docs/che-7/installation-guide/deploying-che-with-support-for-git-repositories-with-self-signed-certificates/ - This procedure describes how to add self-signed cert for the workspaces to be able to pull from the git repo. Here, the filename must to be named ca.crt

Che version

I suspect this is affecting all the versions since implementing this feature. I reproduced this using CRW 2.9 based on Che 7.30

Steps to reproduce

Follow https://www.eclipse.org/che/docs/che-7/administration-guide/configuring-authorization/#configuring-gitlab-oauth2_che including the two links in Additional resources

Expected behavior

I would prefer if there was just a single place, single source of truth, where users would define all the certificates would reside.

If this is not possible for some reason I think we should not enforce these conflicting naming patterns.

Runtime

• kubernetes (include output of kubectl version)
• Openshift (include output of oc version)
  • OCP 4.7 & OCP 3.11
• minikube (include output of minikube version and kubectl version)
• minishift (include output of minishift version and oc version)
• docker-desktop + K8S (include output of docker version and kubectl version)
• other: (please specify)

Installation method

• chectl
  • crwctl 2.9
• OperatorHub
• I don't know

Environment

• my computer
  • Windows
  • Linux
  • macOS
• Cloud
  • Amazon
  • Azure
  • GCE
  • other (please specify)
    • Openstack
• Dev Sandbox (workspaces.openshift.com)
• other: please specify

[tolusha]

I think the easiest way to fix the issue is to update the doc https://www.eclipse.org/che/docs/che-7/installation-guide/deploying-che-with-support-for-git-repositories-with-self-signed-certificates/

--from-file=ca.crt=<path_to_certificate_file>

and remove requirements

the certificate file must be named ca.crt.

[tolusha]

The doc was updated.