Epic: Allow for Self Signed Certs in Self-Hosted

[lucasvaltl]

Summary

We want users to be able to use self-signed certs in their self-hosted Gitpod installation

Context

ℹ️ Defining Self-Signed Certs
There are many ways to define self-signed certs, but this is the definition we are using: self-singed certs are any certs that are not signed by a public certificate authority (ca) that is already known to linux, i.e. the CA’s certs are already shipped with the linux build.

Some users want to use components or run in environments that require self-signed certs. We want to allow for this.

--> This is an epic for #8559 . We think this will require further collaboration between teams, which is why we want to bring it to the epic level.

Value

• This unlocks a new type of user / customer for us which previously was unable to use self-hosted Gitpod due to the certificates they used. Further, it facilitates installing Gitpod on your local machine.

Acceptance Criteria

Self-signed certs can be propagated into:

1. server-pod
2. ws-daemon container
3. workspace container
4. on the node to use for containerd
5. Image builder (assuming the registry it talks to is using self signed certs)

We have basic documentation in place and this feature is tested with at least one user.

Measurement

• We run nightly tests that use self-signed certs and these run successfully
• At least one customer has successfully used self-signed certs in their installation

Complexities

On GKE you cannot allow containerd to trust other certificates without restarting containerd. This hinders us from having self-signed certs on GKE right now.

Child Issues

• Support own CA certificate / self-signed certificated for self-hosted installations #8559
• Add CA cert secret to the installer #9077
• Mount CA cert secret in ws-daemon, server and image-builder #9078
• Add CA cert support to ws-manager #9079

[mrsimonemms]

Looks like all the tasks are done so will close.

Reopen if necessary (and add more tasks)

[tysonrm]

Why not build in an ACME service that provides trusted certs?