Certificate error after upgrading datahub using helm, resolved by deploying issuer locally

troubleshoot
1

Original Slack Thread

Hello,
I am using a datahub deployed on a standard k8s.
I have a certificate error since I installed the new version using helm (version datahub_0.2.182).
I have a certificate error when using the GMS / Rest. This is weird because I am using a trusted certificate and the setup is industrialized. Nothing changed on my side
I can see that the certificate is properly deployed when accessing to https://my_web_site/config
Ingress was deployed externally, so I tried to deploy it using the values.yaml, but it does not make a difference.
Here is the error I get when using rest api :
WARNING:urllib3.connectionpool:Retrying (Retry(total=0, connect=None, read=None, redirect=None, status=None)) after connection broken by ‘SSLError(SSLCertVerificationError(1, ‘[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1091)’))’: /config
and the error I get when using datahub client :
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1056)
[2023-08-22 12:34:49,067] ERROR {asyncio:1608} - SSL error in data received
protocol: <asyncio.sslproto.SSLProtocol object at 0x7f702aa04128>
transport: <_SelectorSocketTransport closing fd=9 read=idle write=<idle, bufsize=0>>
Traceback (most recent call last):
File “/usr/lib/python3.7/asyncio/sslproto.py”, line 526, in data_received
ssldata, appdata = self._sslpipe.feed_ssldata(data)
File “/usr/lib/python3.7/asyncio/sslproto.py”, line 189, in feed_ssldata
self._sslobj.do_handshake()

Does anyone have an idea on how to solve this ?

2

<@UV5UEC3LN> might be able to speak to this!

3

That looks like an issue on the client side from the error since it’s saying local issuer certificate, do you have the cert loaded locally as well?

4

Hello,
Thank you for the reply. Yes it was indeed due to the issuer not being deployed locally in the namespace.
Deploying the issuer in the namespace resolved the issue
Thanks a lot !