feat: Add CA certificate bundle support for builds#3751
Conversation
Add support for specifying a CA certificate bundle file to use during function builds. This is useful when building behind corporate proxies with SSL inspection. Changes: - Add CACertBundle field to BuildSpec in func.yaml - Add --ca-bundle CLI flag to build command - Support FUNC_CA_BUNDLE environment variable - Inject CA bundle into pack builder with appropriate env vars - Inject CA bundle into s2i builder with appropriate env vars - Set SSL_CERT_FILE, REQUESTS_CA_BUNDLE, NODE_EXTRA_CA_CERTS, etc. - Mount CA bundle file into build containers Fixes knative#3721
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: Itx-Psycho0 The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
knative-prow
Bot
added
the
size/M
|
Hi @Itx-Psycho0. Thanks for your PR. I'm waiting for a knative member to verify that this patch is reasonable to test. If it is, they should reply with Tip We noticed you've done this a few times! Consider joining the org to skip this step and gain Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
knative-prow
Bot
added
the
needs-ok-to-test
|
This deserves a comprehensive integration testing. |
|
One of the adepts for testing could be our "private git repo" tests. Right now we are compiling special build image with our own CA. That should not be necessary now. We could use ordinary image with the new option. |
|
But that's not the only test. You should add multitude tests to verify various components respect the CA. |
|
Also check out https://github.com/paketo-buildpacks/ca-certificates |
|
What happens if CA is out of three? |
|
What happens if path is relative vs. absolute |
- Fix volume mount bug in pack builder where CA bundle was overwritten - Use Paketo CA certificates buildpack binding for pack builder - Handle relative vs absolute paths properly - Resolve relative paths relative to function root - Support paths outside function directory - Mount CA bundle to fixed location in S2I builder - Validate CA bundle file exists before build Changes based on feedback from matejvasek: - Pack builder now uses standard Paketo ca-certificates binding - Creates temp directory with proper binding structure - Both builders handle relative/absolute paths correctly - Paths are resolved and validated before build starts
Auto-generated by ./hack/update-codegen.sh
Don't modify f.Build.Mounts directly. Instead, create a local copy of the mounts slice and add the CA bundle mount to the copy. This prevents potential race conditions when the function struct is shared across goroutines in tests. This should fix the CI test failures.
knative-prow
Bot
added
size/L
Generated by 'make schema-generate' to include the new caCertBundle field in BuildSpec. This is required for CI verification checks.
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #3751 +/- ##
==========================================
- Coverage 57.06% 56.90% -0.16%
==========================================
Files 181 181
Lines 21144 21211 +67
==========================================
+ Hits 12065 12070 +5
- Misses 7855 7915 +60
- Partials 1224 1226 +2
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
2 participants
This PR adds support for CA certificate bundles during function builds. Users behind corporate proxies with SSL inspection need this to build functions successfully.
The implementation adds three ways to specify a CA bundle:
When a CA bundle is provided, it gets mounted into the build container and the appropriate environment variables are set for different language runtimes (Python, Node.js, Go, Java, Rust, etc). This works with both pack and s2i builders.
The implementation validates that the CA bundle file exists before starting the build and mounts it read-only into the container. I set environment variables like SSL_CERT_FILE, REQUESTS_CA_BUNDLE, NODE_EXTRA_CA_CERTS and others so the various build tools and package managers can find the certificates.
Fixes #3721