Custom CA trusted by Gitpod ingress fails certificate validation inside workspace containers

In self-hosted Gitpod, operators provide wildcard DNS and TLS certificates for the ingress that fronts workspace hosts. When those certificates are signed by a private certificate authority, the trust boundary between the ingress and the workspace container becomes relevant.

It is unclear whether custom CA certificates trusted by the Gitpod ingress are automatically propagated into workspace container trust stores or must be configured per image. Exact error presentation varies by browser, ingress controller, and Gitpod version, and validation failures can originate in the browser, workspace proxy, or service mesh rather than core Gitpod components.

Clarifying the documented trust propagation model is needed. Does Gitpod automatically inject ingress-trusted custom CAs into workspace container trust stores, or must each workspace image include the CA bundle manually? Which component validates certificates for external API calls initiated from inside the workspace?