Uploaded image for project: 'OpenShift Pipelines'
  1. OpenShift Pipelines
  2. SRVKP-9385

Operator - Python SSL verification breakage when `SSL_CERT_DIR` is injected

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Critical Critical
    • None
    • None
    • Operator
    • False
    • Hide

      None

      Show
      None
    • False
    • Ranked Issues

      Description of problem:

      The automatic injection of `SSL_CERT_DIR` with certain directories is causing Python's SSL verification to fail. If `SSL_CERT_DIR` is not set, Python's SSL verification works by default. It also works if `SSL_CERT_DIR` points to a directory that does conform to the hash-and-link format (e.g., `/etc/pki/ca-trust/extracted/pem/directory-hash`). The current injection is causing an explicit breakage for Python

      Either the paths used for the `SSL_CERT_DIR` variable need to be compatible with Python, or we need to ensure the `SSL_CERT_DIR` is not injected when `reateCABundleConfigMaps` is disabled

      Prerequisites (if any, like setup, operators/versions):

      Run an openshift cluster with pipelines and the main operator branch

      Steps to Reproduce

      • Create a long-running TaskRun step which has python in the container
      • Run the following scripts
      $ SSL_CERT_DIR=/tekton-custom-certs:/etc/ssl/certs:/etc/pki/tls/certs python3 -c 'import httpx; httpx.get("https://google.com")'
      httpx.ConnectError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1010)
      $ SSL_CERT_DIR=/etc/pki/tls/certs python3 -c 'import httpx; httpx.get("https://google.com")'
      httpx.ConnectError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1010)
      $ SSL_CERT_DIR=/etc/pki/ca-trust/extracted/pem/directory-hash python3 -c 'import httpx; httpx.get("https://google.com")'
      # works
      $ SSL_CERT_DIR= python3 -c 'import httpx; httpx.get("https://google.com")'
      # works
      

      Actual results:

      Expected results:

      Reproducibility (Always/Intermittent/Only Once):

      Acceptance criteria:

       

      Definition of Done:

      Build Details:

      Additional info (Such as Logs, Screenshots, etc):

       

       *

              rh-ee-pbheeman Pavan Mandayam Bheeman
              rh-ee-athorp Andrew Thorp
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

                Created:
                Updated: