Disable the workspace CA bundle mount

By default, the Operator creates a ca-certs-merged ConfigMap in every user namespace. This ConfigMap contains the full Certificate Authorities (CAs) bundle. With a large number of Transport Layer Security (TLS) certificates in the cluster, these ConfigMaps consume significant etcd storage. Disable the full CA bundle mount to reduce etcd pressure.

Prerequisites

  • An active kubectl session with administrative permissions to the destination Kubernetes cluster. See Overview of kubectl.

Procedure

  1. Configure the CheCluster Custom Resource to disable the workspace CA bundle mount:

    $ kubectl edit checluster/eclipse-che -n eclipse-che
    spec:
  devEnvironments:
    trustedCerts:
      disableWorkspaceCaBundleMount: true

    With this configuration, Che no longer mounts the full CA bundle under /etc/pki/ca-trust/extracted/pem. Only custom certificates are mounted under /public-certs.

Verification

  • Verify that new workspaces no longer mount the full CA bundle:

    $ kubectl get configmap ca-certs-merged -n <user-namespace>

    The ConfigMap should not exist in namespaces for newly created workspaces.

Additional resources