-
Bug
-
Resolution: Unresolved
-
Major
-
None
-
4.17
-
None
-
Quality / Stability / Reliability
-
False
-
-
None
-
Moderate
-
Yes
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
Description of problem:
The container graph-builder reports unable to get issuer certificate for URL configured under UpdateService.spec.releases CR. Some found messages:
ERROR graph_builder::graph] http transport error: error sending request for url (https://<url>/v2/): error trying to connect: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:ssl/statem/statem_clnt.c:1915: (unable to get issuer certificate) ERROR graph_builder::graph] error sending request for url (https://<url>/v2/): error trying to connect: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed:ssl/statem/statem_clnt.c:1915: (unable to get issuer certificate)
The appropriate configmap is already configured under Image.config.spec.additionalTrustedCA CR with the required key 'updateservice-registry'. The test has been done in a debug pod and the pod is able to reach the URL normally by openssl s_client and curl command without any certificate issues.
The problem appears to be any issue in the application side to establish or consume the certificate correctly in the application side. The configmap is mounted as the following example config:
$ oc get pod -n openshift-update-service <pod-name> -o yaml | grep -B1 "trusted-ca"
- mountPath: /etc/pki/ca-trust/extracted/pem
name: trusted-ca <----
--
path: tls-ca-bundle.pem
name: <configmap-name>
name: trusted-ca <----
$ oc debug pod/<pod-name> -c graph-builder -n openshift-update-service sh-4.4$ ls /etc/pki/ca-trust/extracted/pem/ tls-ca-bundle.pem sh-4.4$ cat /etc/pki/ca-trust/extracted/pem/* -----BEGIN CERTIFICATE----- <-----
Version-Release number of selected component (if applicable):
Operator under version 5.0.3 and OCP cluster 4.17.23
How reproducible:
Steps to Reproduce:
1.
2.
3.
Actual results:
Expected results:
Additional info:
- is related to
-
-
- POST
-