Description of problem:
The automatic injection of `SSL_CERT_DIR` with certain directories is causing Python's SSL verification to fail. If `SSL_CERT_DIR` is not set, Python's SSL verification works by default. It also works if `SSL_CERT_DIR` points to a directory that does conform to the hash-and-link format (e.g., `/etc/pki/ca-trust/extracted/pem/directory-hash`). The current injection is causing an explicit breakage for Python
Either the paths used for the `SSL_CERT_DIR` variable need to be compatible with Python, or we need to ensure the `SSL_CERT_DIR` is not injected when `reateCABundleConfigMaps` is disabled
Prerequisites (if any, like setup, operators/versions):
Run an openshift cluster with pipelines and the main operator branch
Steps to Reproduce
- Create a long-running TaskRun step which has python in the container
- Run the following scripts
$ SSL_CERT_DIR=/tekton-custom-certs:/etc/ssl/certs:/etc/pki/tls/certs python3 -c 'import httpx; httpx.get("https://google.com")' httpx.ConnectError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1010) $ SSL_CERT_DIR=/etc/pki/tls/certs python3 -c 'import httpx; httpx.get("https://google.com")' httpx.ConnectError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1010) $ SSL_CERT_DIR=/etc/pki/ca-trust/extracted/pem/directory-hash python3 -c 'import httpx; httpx.get("https://google.com")' # works $ SSL_CERT_DIR= python3 -c 'import httpx; httpx.get("https://google.com")' # works
Actual results:
Expected results:
Reproducibility (Always/Intermittent/Only Once):
Acceptance criteria:
Definition of Done:
Build Details:
Additional info (Such as Logs, Screenshots, etc):