Sometimes ISO Pipeline has Certificate Validation Issues

redhat-cop / rhel-edge-automation-arch

RHEL for Edge Automation Deployment Architecture

Apache License 2.0

44 stars 33 forks source link

Sometimes ISO Pipeline has Certificate Validation Issues #138

Closed nasx closed 2 years ago

nasx commented 3 years ago

Sometimes the task calling composer-cli compose rhel-edge-installer fails with certificate validation errors:

Get "https://httpd-rfe.apps.cluster.com/hello-world/latest/refs/heads/rhel/8/x86_64/edge": x509: certificate signed by unknown authority

Options:

Try https://github.com/osbuild/osbuild-composer/blob/main/internal/weldr/json.go#L143
Extract ingress CA from OpenShift and add it to image-builder VM trust store

sabre1041 commented 3 years ago

@nasx i'd like to embrace property security do that there is a trust between the image-builder and the httpd pod. One concern is how the truststore of the image-builder will be maintained over time. Will there be a routine job that will sync the certificates (in case it changes over time)?

nasx commented 2 years ago

Addressed in #226