Unable to download the jupyterhub helm chart

[nikhil-sharma31]

Bug description

Followed below steps to install the jupyterhub helm chart in the kubernetes cluster helm repo add jupyterhub https://jupyterhub.github.io/helm-chart/ helm repo update helm install jhub jupyterhub/jupyterhub --namespace jupyterhub --version=2.0.0 --values config.yaml

Expected behaviour

It should install the chart in the jupyterhub namespace in the kubernetes cluster and all pods should be up and running

Actual behaviour

Got below error: Error: INSTALLATION FAILED: failed to download "jupyterhub/jupyterhub" at version "2.0.0"

How to reproduce

It looks unable to update the helm repo, getting certificate errors helm repo update ...Unable to get an update from the "jupyterhub" chart repository (https://jupyterhub.github.io/helm-chart/): Get "https://hub.jupyter.org/helm-chart/index.yaml": x509: certificate signed by unknown authority

1. Go to '...'
2. Click on '....'
3. Scroll down to '....'
4. See error

Your personal set up

• OS:
• Version(s):

Full environment

``` # paste output of `pip freeze` or `conda list` here ```

Configuration

```python # jupyterhub_config.py ```

Logs

``` # paste relevant logs here, if any ```

[welcome[bot]]

Thank you for opening your first issue in this project! Engagement like this is essential for open source projects! :hugs:
If you haven't done so already, check out Jupyter's Code of Conduct. Also, please try to follow the issue template as it helps other other community members to contribute more effectively. You can meet the other Jovyans by joining our Discourse forum. There is also an intro thread there where you can stop by and say Hi! :wave:
Welcome to the Jupyter community! :tada:

[minrk]

Can you share more about your OS and helm versions? The GTS CA 2P2 authority ought to be trusted, but might not be on older systems.

[consideRatio]

I think this relates to changing to https://hub.jupyter.org/helm-chart/ from https://jupyterhub.github.io/helm-chart/

Can you try using https://hub.jupyter.org/helm-chart/ as a repository URL?

What version of helm do you use? Check with helm version

[nikhil-sharma31]

[sharmanikhil01@ins-bmpiop401 ~]$ helm version version.BuildInfo{Version:"v3.9.0", GitCommit:"7ceeda6c585217a19a1131663d8cd1f7d641b2a7", GitTreeState:"clean", GoVersion:"go1.17.5"}

Get same error with the suggested repo [sharmanikhil01@ins-bmpiop401 ~]$ helm repo add jupyterhub https://hub.jupyter.org/helm-chart/ Error: looks like "https://hub.jupyter.org/helm-chart/" is not a valid chart repository or cannot be reached: Get "https://hub.jupyter.org/helm-chart/index.yaml": x509: certificate signed by unknown authority

[minrk]

Since it is a valid repository with a valid certificate, I believe this means the trusted CAs on your system (or in helm? I'm not sure) are outdated. What is your OS and version?

[nikhil-sharma31]

My OS version is as below:

[sharmanikhil01@xxxxxxxxx ~]$ cat /etc/os-release NAME="CentOS Linux" VERSION="7 (Core)" ID="centos" ID_LIKE="rhel fedora" VERSION_ID="7" PRETTY_NAME="CentOS Linux 7 (Core)" ANSI_COLOR="0;31" CPE_NAME="cpe:/o:centos:centos:7" HOME_URL="https://www.centos.org/" BUG_REPORT_URL="https://bugs.centos.org/"

CENTOS_MANTISBT_PROJECT="CentOS-7" CENTOS_MANTISBT_PROJECT_VERSION="7" REDHAT_SUPPORT_PRODUCT="centos" REDHAT_SUPPORT_PRODUCT_VERSION="7"

[sharmanikhil01@xxxxxxxxx ~]$

Also please note all helm charts for other repos are working fine except this

[nikhil-sharma31]

I tried using another server also with below OS version and getting same error

root@piop-k8s-201: cat /etc/os-release PRETTY_NAME="Debian GNU/Linux 10 (buster)" NAME="Debian GNU/Linux" VERSION_ID="10" VERSION="10 (buster)" VERSION_CODENAME=buster ID=debian HOME_URL="https://www.debian.org/" SUPPORT_URL="https://www.debian.org/support" BUG_REPORT_URL="https://bugs.debian.org/" root@piop-k8s-201: wget https://jupyterhub.github.io/helm-chart/ --2023-06-02 00:05:47-- https://jupyterhub.github.io/helm-chart/ Resolving xxxxxxxxxxxx Connecting to pkg.proxy.prod.jp.local xxxxxxxxxxx|:10080... connected. Proxy request sent, awaiting response... 301 Moved Permanently Location: https://hub.jupyter.org/helm-chart/ [following] --2023-06-02 00:05:47-- https://hub.jupyter.org/helm-chart/ Connecting to pkg.proxy.prod.jp.local xxxxxxxxxxxxx|:10080... connected. ERROR: The certificate of ‘hub.jupyter.org’ is not trusted. ERROR: The certificate of ‘hub.jupyter.org’ doesn't have a known issuer. root@piop-k8s-201:~#

[nikhil-sharma31]

I also tried downloading the certificate manually and load in the server but still invalid certificate error

[sharmanikhil01@xxxxxxxxxx bin]$ mv jupyter.org.cer jupyterhub.crt [sharmanikhil01@xxxxxxxxxx bin]$ sudo cp jupyterhub.crt /etc/pki/ca-trust/source/anchors/ [sudo] password for sharmanikhil01: [sharmanikhil01@xxxxxxxxxxxxx bin]$ sudo update-ca-trust [sharmanikhil01@xxxxxxxxx bin]$ sudo openssl verify -CAfile /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem jupyterhub.crt jupyterhub.crt: CN = jupyter.org error 20 at 0 depth lookup:unable to get local issuer certificate [sharmanikhil01@xxxxxxxxxxx bin]$

[nikhil-sharma31]

Ok so the issues was resolved by me by updating the ca-certificates on my machine

Thank you for the debugging here,

[consideRatio]

Thank you for the followup about this @nikhil-sharma31!!!