Closed tomkraljevic closed 1 month ago
Methodogy I used to experimentally jam in certificates by hand, to see which file the current code/pod was really picking up the certs from.
1. create the configmap:
root@ip-10-0-1-175:/home/ubuntu/tomk-1.5.1-07-15# head tomk-cacert-config
apiVersion: v1
kind: ConfigMap
metadata:
namespace: h2ogpt
name: tomk
data:
cert.pem: |
# Local box
-----BEGIN CERTIFICATE-----
MIIDDjCCAfagAwIBAgIRANerbMOq4u7UvTHYe6Phnw0wDQYJKoZIhvcNAQELBQAw
....
2. hack the h2ogpt deployment to add a volume and volumeMount:
volumeMounts:
- mountPath: /etc/ssl/cert.pem
name: tomk
subPath: cert.pem
volumes:
- configMap:
name: tomk
name: tomk
To clarify, h2oGPT just uses OpenAI API pypi package for connecting to vllm etc. Nothing related to these issues would be involving any other part of h2oGPT.
a suggestion:
httpx has env vars. maybe an init container could cat /etc/ssl/cert.pem with the provided caCertificates, write them to a new location, and set the SSL_CERT_FILE env var so they get picked up.
this would prevent the need for any code changes in the image.
Not sure relevant, but just googled for moment:
https://community.openai.com/t/ssl-certificate-verify-failed/32442/68?page=4
import os
os.environ['REQUESTS_CA_BUNDLE'] = <path_to_pem_certificate>
so i can confirm this env var SSL_CERT_FILE
does make a difference.
both PRs above are merged. Please re-open if more changes are required. Thanks
so for consistency, it would be better if it used the caCertificates-style of passing in the private CA stuff. (from the "what i want to happen" section at the top of the ticket.)
so for consistency, it would be better if it used the caCertificates-style of passing in the private CA stuff. (from the "what i want to happen" section at the top of the ticket.)
done here: https://github.com/h2oai/h2ogpt/pull/1758, PTAL, thanks.
What happens currently
When the models that h2ogpt are pointing to are https and signed with a private CA the connection attempt errors out with an untrusted SSL certificate error.
What I want to happen
Some implementation details
/etc/ssl/cert.pem