Support custom certificates for any exporter that uses requests
See original GitHub issueThe simplest approach is to allow mounting the CA trust file in the container, and then have the environment variable REQUESTS_CA_BUNDLE
point to that path.
However, we must take care because prepared requests do not take the environment into account. This is true even if you set the verify path on the session object.
It’s also not clear if specifying this overrides or augments the CA bundles provided by certifi
. That’s risky to mix in a project that might reach out to public instances as well as private ones.
One solution that can handle both use cases: detect if a custom CA bundle is specified, and if so, append it to the CA bundle from certifi
at container startup.
Issue Analytics
- State:
- Created a year ago
- Comments:10
Top Results From Across the Web
CSR Creation | Create Certificate Signing Request | DigiCert
Generate a CSR for Exchange 2007 · Generate a CSR Using the DigiCert Certificate Utility. Instructions: Exchange 2016 · Exchange 2013 · Exchange...
Read more >Add and manage TLS/SSL certificates - Azure App Service
Select the custom domain for the free certificate, and then select Create. You can create only one certificate for each supported custom domain....
Read more >Generating certificates for use with the VMware SSL ...
Generating Certificate Requests · From a command line, navigate to the location where you unzipped the tool. · Run this command: · From...
Read more >Adding Custom Certificate to an Application Specific Trust ...
PIP. Use one of the following methods to configure the custom CA certificate for Python: Add custom certificate using Bash commands · Requests....
Read more >Self-signed certificates or custom Certification Authorities
Supported options for self-signed certificates targeting the GitLab server · If your GitLab server certificate is signed by your CA, use your CA...
Read more >
Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free
Top Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
So the issue is that self-signed SSL certificate for the REST APIs needs to be used by the python exporter which is running inside the pod to access external service, such as self-hosted JIRA instance or other self-hosted service. This is exactly #463, except it’s a bit wider as not only for the JIRA exporter, but more generic for any type of the exporter to consume.
I will play with it, but my initial thought on that is we should allow to create per exporter ConfigMap with self-signed/custom CA-certificate. This will be mounted in the exporter pod and used by the python code to connect to the external service.
I am not convinced (yet) that adding custom/self-signed certificate to global cluster ca-bundle.crt is the right approach, as this will be available to all pods in all namespaces rather than only for the exporter which requires this certificate. We may have multiple REST API endpoints with different self-signed certificates.
I just verified this. It will override them, which means, for example:
If you give a custom bundle, getting the first project will break, while the second one works.
Luckily, the library that requests uses,
certifi
, exposes its bundle! We could have a pre-processing step that appends both together, and then sets that file as the CA bundle.