Chapter 8. Enable artifact repositories in a restricted environment

Procedure

1. Create a Secret to store the TLS certificate:

   kind: Secret
   apiVersion: v1
   metadata:
     name: tls-cer
     annotations:
       controller.devfile.io/mount-path: /home/user/certs
       controller.devfile.io/mount-as: file
     labels:
       controller.devfile.io/mount-to-devworkspace: 'true'
       controller.devfile.io/watch-secret: 'true'
   data:
     tls.cer: >-
       <Base64_encoded_content_of_public_cert>

   where:

   <Base64_encoded_content_of_public_cert>

   The Base64-encoded content of your Maven artifact repository’s public TLS certificate, with line wrapping disabled.

2. Apply the Secret to the <username>-devspaces namespace:

   $ oc apply -f tls-cer.yaml -n <username>-devspaces

3. Create a ConfigMap for the settings.xml file:

   kind: ConfigMap
   apiVersion: v1
   metadata:
     name: settings-xml
     annotations:
       controller.devfile.io/mount-as: subpath
       controller.devfile.io/mount-path: /home/user/.m2
     labels:
       controller.devfile.io/mount-to-devworkspace: 'true'
       controller.devfile.io/watch-configmap: 'true'
   data:
     settings.xml: |
       <settings xmlns="http://maven.apache.org/SETTINGS/1.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.0.0 https://maven.apache.org/xsd/settings-1.0.0.xsd">
         <localRepository/>
         <interactiveMode/>
         <offline/>
         <pluginGroups/>
         <servers/>
         <mirrors>
           <mirror>
             <id>redhat-ga-mirror</id>
             <name>Red Hat GA</name>
             <url>https://<maven_artifact_repository_route>/repository/redhat-ga/</url>
             <mirrorOf>redhat-ga</mirrorOf>
           </mirror>
           <mirror>
             <id>maven-central-mirror</id>
             <name>Maven Central</name>
             <url>https://<maven_artifact_repository_route>/repository/maven-central/</url>
             <mirrorOf>maven-central</mirrorOf>
           </mirror>
           <mirror>
             <id>jboss-public-repository-mirror</id>
             <name>JBoss Public Maven Repository</name>
             <url>https://<maven_artifact_repository_route>/repository/jboss-public/</url>
             <mirrorOf>jboss-public-repository</mirrorOf>
           </mirror>
         </mirrors>
         <proxies/>
         <profiles/>
         <activeProfiles/>
       </settings>

   where:

   <maven_artifact_repository_route>

   The hostname and path of your internal Maven artifact repository.

4. Optional: When using JBoss EAP-based devfiles, create a second settings-xml ConfigMap with a different name and the /home/jboss/.m2 mount path. Use the same content as step 3.

5. Create a ConfigMap for the TrustStore initialization script that matches your Java version:

   For Java 8:

   kind: ConfigMap
   apiVersion: v1
   metadata:
     name: init-truststore
     annotations:
       controller.devfile.io/mount-as: subpath
       controller.devfile.io/mount-path: /home/user/
     labels:
       controller.devfile.io/mount-to-devworkspace: 'true'
       controller.devfile.io/watch-configmap: 'true'
   data:
     init-java8-truststore.sh: |
       #!/usr/bin/env bash
   
       keytool -importcert -noprompt -file /home/user/certs/tls.cer -trustcacerts -keystore ~/.java/current/jre/lib/security/cacerts -storepass changeit

   For Java 11:

   kind: ConfigMap
   apiVersion: v1
   metadata:
     name: init-truststore
     annotations:
       controller.devfile.io/mount-as: subpath
       controller.devfile.io/mount-path: /home/user/
     labels:
       controller.devfile.io/mount-to-devworkspace: 'true'
       controller.devfile.io/watch-configmap: 'true'
   data:
     init-java11-truststore.sh: |
       #!/usr/bin/env bash
   
       keytool -importcert -noprompt -file /home/user/certs/tls.cer -cacerts -storepass changeit

6. Apply the Secret, settings.xml ConfigMap, and TrustStore ConfigMap to the <username>-devspaces namespace:

   $ oc apply -f tls-cer.yaml -n <username>-devspaces
   $ oc apply -f settings-xml.yaml -n <username>-devspaces
   $ oc apply -f init-truststore.yaml -n <username>-devspaces

7. Start a Maven workspace.
8. Open a new terminal in the tools container.
9. Run ~/init-truststore.sh.

Verification

1. In the workspace terminal, verify the Maven mirror configuration:

   $ mvn help:effective-settings

   The output includes the mirror URLs from your settings.xml ConfigMap.

2. Build a Maven project to verify artifact resolution from the mirror:

   $ mvn package

Procedure

1. Create a Secret to store the TLS certificate:

   kind: Secret
   apiVersion: v1
   metadata:
     name: tls-cer
     annotations:
       controller.devfile.io/mount-path: /home/user/certs
       controller.devfile.io/mount-as: file
     labels:
       controller.devfile.io/mount-to-devworkspace: 'true'
       controller.devfile.io/watch-secret: 'true'
   data:
     tls.cer: >-
       <Base64_encoded_content_of_public_cert>

   where:

   <Base64_encoded_content_of_public_cert>

   The Base64-encoded content of your Gradle artifact repository’s public TLS certificate, with line wrapping disabled.

2. Create a ConfigMap for the TrustStore initialization script:

   kind: ConfigMap
   apiVersion: v1
   metadata:
     name: init-truststore
     annotations:
       controller.devfile.io/mount-as: subpath
       controller.devfile.io/mount-path: /home/user/
     labels:
       controller.devfile.io/mount-to-devworkspace: 'true'
       controller.devfile.io/watch-configmap: 'true'
   data:
     init-truststore.sh: |
       #!/usr/bin/env bash
   
       keytool -importcert -noprompt -file /home/user/certs/tls.cer -cacerts -storepass changeit

3. Create a ConfigMap for the Gradle init script:

   kind: ConfigMap
   apiVersion: v1
   metadata:
     name: init-gradle
     annotations:
       controller.devfile.io/mount-as: subpath
       controller.devfile.io/mount-path: /home/user/.gradle
     labels:
       controller.devfile.io/mount-to-devworkspace: 'true'
       controller.devfile.io/watch-configmap: 'true'
   data:
     init.gradle: |
       allprojects {
         repositories {
           mavenLocal ()
           maven {
             url "https://<gradle_artifact_repository_route>/repository/maven-public/"
             credentials {
               username "admin"
               password "passwd"
             }
           }
         }
       }

   where:

   <gradle_artifact_repository_route>

   The hostname and path of your internal Gradle artifact repository.

4. Apply the Secret and both ConfigMaps to your project:

   $ oc apply -f tls-cer.yaml -n <your_namespace>
   $ oc apply -f init-truststore.yaml -n <your_namespace>
   $ oc apply -f init-gradle.yaml -n <your_namespace>

5. Start a Gradle workspace.
6. Open a new terminal in the tools container.
7. Run ~/init-truststore.sh.

Verification

1. In the workspace terminal, build a Gradle project to verify artifact resolution from the mirror:

   $ gradle build

Procedure

1. Create a Secret to store the TLS certificate:

   kind: Secret
   apiVersion: v1
   metadata:
     name: tls-cer
     annotations:
       controller.devfile.io/mount-path: /public-certs
       controller.devfile.io/mount-as: file
     labels:
       controller.devfile.io/mount-to-devworkspace: 'true'
       controller.devfile.io/watch-secret: 'true'
   data:
     nexus.cer: >-
       <Base64_encoded_content_of_public_cert>

   where:

   <Base64_encoded_content_of_public_cert>

   The Base64-encoded content of your npm artifact repository’s public TLS certificate, with line wrapping disabled.

2. Apply the Secret to your project:

   $ oc apply -f tls-cer.yaml -n <your_namespace>

3. Create a ConfigMap to set the NPM_CONFIG_REGISTRY environment variable:

   kind: ConfigMap
   apiVersion: v1
   metadata:
     name: disconnected-env
     annotations:
       controller.devfile.io/mount-as: env
     labels:
       controller.devfile.io/mount-to-devworkspace: 'true'
       controller.devfile.io/watch-configmap: 'true'
   data:
     NPM_CONFIG_REGISTRY: >-
       https://<npm_artifact_repository_route>/repository/npm-all/

   where:

   <npm_artifact_repository_route>

   The hostname and path of your internal npm artifact repository.

4. Apply the ConfigMap to your project:

   $ oc apply -f disconnected-env.yaml -n <your_namespace>

5. Start a npm workspace.

6. Configure the workspace to trust the self-signed certificate by using one of the following options:

   1. Set the NODE_EXTRA_CA_CERTS environment variable to the path of the TLS certificate:

      $ export NODE_EXTRA_CA_CERTS=/public-certs/nexus.cer
      $ npm install

   2. Alternatively, disable self-signed certificate validation:

      $ npm config set strict-ssl false

      Warning

      Disabling SSL/TLS bypasses the validation of your self-signed certificates. For a more secure solution, use NODE_EXTRA_CA_CERTS (sub-step a).

Verification

1. Open a terminal in your workspace.

2. Verify the npm registry configuration:

   $ npm config get registry

   The output shows the artifact repository URL from your ConfigMap.

3. Install a package to verify artifact resolution from the mirror:

   $ npm install express

Procedure

1. Create a Secret to store the TLS certificate:

   kind: Secret
   apiVersion: v1
   metadata:
     name: tls-cert
     labels:
       controller.devfile.io/mount-to-devworkspace: 'true'
       controller.devfile.io/watch-secret: 'true'
     annotations:
       controller.devfile.io/mount-path: /home/user/certs
       controller.devfile.io/mount-as: file
   type: Opaque
   data:
     tls.cer: >-
       <Base64_encoded_TLS_certificate>

   where:

   <Base64_encoded_TLS_certificate>

   The Base64-encoded content of your internal PyPI mirror’s TLS certificate.

2. Apply the Secret to your project:

   $ oc apply -f tls-cert.yaml -n <your_namespace>

3. Create a ConfigMap with your pip configuration:

   Warning

   Applying a ConfigMap that sets environment variables might cause a workspace boot loop. If you encounter this behavior, remove the ConfigMap and edit the devfile directly.

   kind: ConfigMap
   apiVersion: v1
   metadata:
     name: pip-config
     labels:
       controller.devfile.io/mount-to-devworkspace: 'true'
       controller.devfile.io/watch-configmap: 'true'
     annotations:
       controller.devfile.io/mount-as: subpath
       controller.devfile.io/mount-path: /home/user/.config/pip
   data:
     pip.conf: |
       [global]
       index-url = <your_internal_pypi_url>
       trusted-host = <your_internal_pypi_host>
       cert = /home/user/certs/tls.cer

   where:

   <your_internal_pypi_url>

   The URL of your internal PyPI mirror.

   <your_internal_pypi_host>

   The hostname of your internal PyPI mirror.

4. Apply the ConfigMap to your project:

   $ oc apply -f pip-config.yaml -n <your_namespace>

5. Start or restart your workspace.

Verification

1. Open a terminal in your workspace.

2. Verify the pip configuration:

   $ pip config list

3. Install a package to verify the configuration:

   $ pip install requests

Procedure

1. Create a Secret to store the TLS certificate:

   kind: Secret
   apiVersion: v1
   metadata:
     name: tls-cert
     labels:
       controller.devfile.io/mount-to-devworkspace: 'true'
       controller.devfile.io/watch-secret: 'true'
     annotations:
       controller.devfile.io/mount-path: /home/user/certs
       controller.devfile.io/mount-as: file
   type: Opaque
   data:
     tls.cer: >-
       <Base64_encoded_TLS_certificate>

   where:

   <Base64_encoded_TLS_certificate>

   The Base64-encoded content of your Go module proxy’s TLS certificate.

2. Apply the Secret to your project:

   $ oc apply -f tls-cert.yaml -n <your_namespace>

3. Create a ConfigMap with Go environment variables:

   Warning

   Applying a ConfigMap that sets environment variables might cause a workspace boot loop. If you encounter this behavior, remove the ConfigMap and edit the devfile directly.

   kind: ConfigMap
   apiVersion: v1
   metadata:
     name: go-config
     labels:
       controller.devfile.io/mount-to-devworkspace: 'true'
       controller.devfile.io/watch-configmap: 'true'
     annotations:
       controller.devfile.io/mount-as: env
   data:
     GOPROXY: <your_go_proxy_url>
     GONOSUMDB: "*"
     GOPRIVATE: "<your_private_modules>"
     SSL_CERT_FILE: /home/user/certs/tls.cer

   where:

   <your_go_proxy_url>

   The URL of your internal Go module proxy.

   <your_private_modules>

   A comma-separated list of Go module path prefixes for private modules that bypass the proxy and checksum database.

4. Apply the ConfigMap to your project:

   $ oc apply -f go-config.yaml -n <your_namespace>

5. Start or restart your workspace.

Verification

1. Open a terminal in your workspace.

2. Verify the Go configuration:

   $ go env GOPROXY

3. Download a Go module to verify the configuration:

   $ go get github.com/gin-gonic/gin

Procedure

1. Create a Secret to store the TLS certificate:

   kind: Secret
   apiVersion: v1
   metadata:
     name: tls-cer
     annotations:
       controller.devfile.io/mount-path: /home/user/certs
       controller.devfile.io/mount-as: file
     labels:
       controller.devfile.io/mount-to-devworkspace: 'true'
       controller.devfile.io/watch-secret: 'true'
   data:
     tls.cer: >-
       <Base64_encoded_content_of_public_cert>

   where:

   <Base64_encoded_content_of_public_cert>

   The Base64-encoded content of your NuGet artifact repository’s public TLS certificate, with line wrapping disabled.

2. Apply the Secret to your project:

   $ oc apply -f tls-cer.yaml -n <your_namespace>

3. Create a ConfigMap to set the SSL_CERT_FILE environment variable to the path of the TLS certificate:

   kind: ConfigMap
   apiVersion: v1
   metadata:
     name: disconnected-env
     annotations:
       controller.devfile.io/mount-as: env
     labels:
       controller.devfile.io/mount-to-devworkspace: 'true'
       controller.devfile.io/watch-configmap: 'true'
   data:
     SSL_CERT_FILE: /home/user/certs/tls.cer

4. Create a ConfigMap for the nuget.config file:

   kind: ConfigMap
   apiVersion: v1
   metadata:
     name: init-nuget
     annotations:
       controller.devfile.io/mount-as: subpath
       controller.devfile.io/mount-path: /projects
     labels:
       controller.devfile.io/mount-to-devworkspace: 'true'
       controller.devfile.io/watch-configmap: 'true'
   data:
     nuget.config: |
       <?xml version="1.0" encoding="UTF-8"?>
       <configuration>
         <packageSources>
           <add key="nexus2" value="https://<nuget_artifact_repository_route>/repository/nuget-group/"/>
         </packageSources>
         <packageSourceCredentials>
           <nexus2>
               <add key="Username" value="admin" />
               <add key="Password" value="passwd" />
           </nexus2>
         </packageSourceCredentials>
       </configuration>

   where:

   <nuget_artifact_repository_route>

   The hostname and path of your internal NuGet artifact repository.

5. Apply both ConfigMaps to your project:

   $ oc apply -f disconnected-env.yaml -n <your_namespace>
   $ oc apply -f init-nuget.yaml -n <your_namespace>

6. Start a NuGet workspace.

Verification

1. Open a terminal in your workspace.

2. Verify the NuGet source configuration:

   $ dotnet nuget list source

   The output includes the artifact repository URL from your nuget.config ConfigMap.

3. Restore packages to verify artifact resolution from the mirror:

   $ dotnet restore