Stop overriding system defaults in SSL_CERT_DIR

pkg/reconciler/openshift/common/cabundle.go

@@ -114,7 +114,7 @@ func ApplyCABundles(u *unstructured.Unstructured) error {
 			}
 		}
 
-		// we wiil mount the certs at this location so we don't override the existing certs
+		// We will mount the certs at this location so we don't override the existing certs
 		sslCertDir := "/tekton-custom-certs"
 		for _, env := range c.Env {
 			if env.Name == "SSL_CERT_DIR" {

pkg/reconciler/proxy/proxy.go

@@ -402,20 +402,43 @@ func updateVolume(pod corev1.Pod, volumeName, configmapName, key string) corev1.
 			}
 		}
 
-		// we wiil mount the certs at this location so we don't override the existing certs
+		// We will mount the certs at this location so we don't override the existing certs
 		sslCertDir := "/tekton-custom-certs"
 		certEnvAvaiable := false
+
 		for _, env := range c.Env {
+			// If SSL_CERT_DIR env var already exists, then we don't mess with
+			// it and simply carry it forward as it is
 			if env.Name == "SSL_CERT_DIR" {
 				sslCertDir = env.Value
 				certEnvAvaiable = true
 			}
 		}
 
 		if !certEnvAvaiable {
+			// Here, we need to set the default value for SSL_CERT_DIR.
+			// Keep in mind that if SSL_CERT_DIR is set, then it overrides the
+			// system default, i.e. the system default directories will "NOT"
+			// be scanned for certificates. This is risky and we don't want to
+			// do this because users mount certificates at these locations or
+			// build images with certificates "in" them and expect certificates
+			// to get picked up, and rightfully so since this is the documented
+			// way of achieving this.
+			// So, let's keep the system wide default locations in place and
+			// "append" our custom location to those.
+			//
+			// Copied from https://golang.org/src/crypto/x509/root_linux.go
+			var certDirectories = []string{
+				sslCertDir,                     // /tekton-custom-certs
+				"/etc/ssl/certs",               // SLES10/SLES11, https://golang.org/issue/12139
+				"/etc/pki/tls/certs",           // Fedora/RHEL
+				"/system/etc/security/cacerts", // Android
+			}
+
 			c.Env = append(c.Env, corev1.EnvVar{
-				Name:  "SSL_CERT_DIR",
-				Value: sslCertDir,
+				Name: "SSL_CERT_DIR",
+				// SSL_CERT_DIR accepts a colon separated list of directories
+				Value: strings.Join(certDirectories, ":"),
 			})
 		}
 

pkg/reconciler/proxy/proxy_test.go

@@ -39,7 +39,7 @@ func TestUpdateVolume(t *testing.T) {
 	assert.DeepEqual(t, len(podUpdated.Spec.Volumes), 1)
 	assert.DeepEqual(t, len(podUpdated.Spec.Containers[0].Env), 1)
 	assert.DeepEqual(t, podUpdated.Spec.Containers[0].Env[0].Name, "SSL_CERT_DIR")
-	assert.DeepEqual(t, podUpdated.Spec.Containers[0].Env[0].Value, "/tekton-custom-certs")
+	assert.DeepEqual(t, podUpdated.Spec.Containers[0].Env[0].Value, "/tekton-custom-certs:/etc/ssl/certs:/etc/pki/tls/certs:/system/etc/security/cacerts")
 	assert.DeepEqual(t, podUpdated.Spec.Volumes[0].Name, "testv")
 	assert.DeepEqual(t, podUpdated.Spec.Volumes[0].ConfigMap.Name, "testcm")
 	assert.DeepEqual(t, len(podUpdated.Spec.Containers[0].VolumeMounts), 1)