feat: corporate CA trust for pipeline git-clone from internal hosts#142
Open
minmzzhang wants to merge 4 commits into
Open
feat: corporate CA trust for pipeline git-clone from internal hosts#142minmzzhang wants to merge 4 commits into
minmzzhang wants to merge 4 commits into
Conversation
minmzzhang
force-pushed
the
pipeline-corp-ca-trust
branch
from
ae0f678 to
2f1c9b8
Compare
mlorenzofr
approved these changes
Jun 9, 2026
mlorenzofr
left a comment
mlorenzofr
left a comment
Collaborator
There was a problem hiding this comment.
Tested and working correctly. Just a couple of minor changes
LGTM
Add support for the git-clone task to trust corporate/internal CA certificates when cloning from private Git servers (e.g. GitLab behind a corporate CA). Supply-chain chart: - Add conditional ssl-ca-directory workspace to pipeline and pipelinerun templates (gated by git.sslCABundle.enabled) - Add git.sslCABundle values (enabled, configMapName) defaulting to the ztvp-trusted-ca ConfigMap - Set CRT_FILENAME param so git-clone finds the CA bundle file ztvp-certificates chart: - Auto-detect internal Git hosts via customCA.remoteHosts: the extraction Job connects to the host on port 443, extracts the full CA chain from the TLS handshake, and merges it into the bundle - Distribute ztvp-trusted-ca to the pipeline namespace via the targetNamespaces list Generator (gen-feature-variants.py): - Auto-enable git.sslCABundle and customCA.remoteHosts when --git-repo points to a non-public host (not github.com/gitlab.com/bitbucket.org) - Add git.sslCABundle.enabled to the protected-repos feature fragment and to the commented-out overrides in the base values-hub.yaml values-hub.yaml: - Replace hand-edited file with gen-feature-variants output for consistent indentation and complete feature composition Documentation: - Add "Corporate CA trust for internal Git hosts" section to docs/supply-chain.md covering enablement, auto-extraction, and manual CA provisioning alternatives Signed-off-by: Min Zhang <minzhang@redhat.com>
Signed-off-by: Manuel Lorenzo <mlorenzofr@redhat.com>
- Skip SSL CA bundle workspace/params when authType is SSH (not needed for SSH connections to git) - Add hostname validation in _parse_git_repo_url() to fail early on malformed URLs Signed-off-by: Min Zhang <minzhang@redhat.com>
minmzzhang
force-pushed
the
pipeline-corp-ca-trust
branch
from
2565a0e to
7ad9fc4
Compare
The External Secrets Operator no longer serves v1beta1; only v1 is available on the cluster, causing supply-chain sync failures. Signed-off-by: Min Zhang <minzhang@redhat.com>
Collaborator
Author
|
Rebased to latest main and ready for review. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add support for the git-clone task to trust corporate/internal CA certificates when cloning from private Git servers (e.g. GitLab behind a corporate CA).
Supply-chain chart:
ztvp-certificates chart:
Generator (gen-feature-variants.py):
values-hub.yaml:
Documentation: