swoehrl-mw
commented
11 months ago Hi @bmaguireibm Following the stacktrace in your error log it looks like the operator cannot decode the PEM data of the CA certificate. Can you please verify if the provided cert is actually valid (for example by checking with openssl)?
You can also use the following small go program to read the cert the same way the operator does:
package main
import (
"crypto/x509"
"encoding/pem"
"fmt"
"os"
)
func main() {
data, err := os.ReadFile("ca.crt")
if err != nil {
fmt.Printf("Could not open file: %s\n", err)
return
}
block, _ := pem.Decode(data)
if block == nil {
fmt.Printf("Could not decode as PEM data\n")
return
}
caCert, err := x509.ParseCertificate(block.Bytes)
if err != nil {
fmt.Printf("Could not parse certificate: %s\n", err)
return
}
fmt.Printf("Certificate has subject '%s'\n", caCert.Subject)
}Just run it with go run main.go (assuming you placed the code in main.go and the cert from the secret in ca.crt).
Regardless of this, even in the case of invalid data the operator should not crash but should provide a proper error message and continue, so this is a bug either way.
mchiappini
gfdsa
Hi, thanks for the great operator. I believe I've hit a bug when trying to provide my own certificates for the external http api. Below are the details of the error, any help is greatly appreciated.
Kubernetes version: v1.26.6 opensearch-operator version: 2.4.0 platform: AKS
Expected behaviour: I was trying to provide a TSL certificate for the HTTP API. The secret is generated by vault secret operator, but ultimately this produces a Kubernetes tls secret in PEM format with tls.key, tls.crt. I also provide a separate secret for ca.crt. Both secrets are generated in the same namespace and appear to be valid PEM formatted certs with the correct keys. I expect the cluster to be created using this cert for it's http api at 9200.
Actual behaviour: The operator-controller-manager goes into crash loop back off with the following error in the logs.
My cluster config is as follows: