kubernetes-client: Certificates from system keystore are ignored by kubernetes client

There are two possible ways for providing certificates while creating OpenShift / K8S client:

  • KUBERNETES_CERTS_CA_FILE - using the ENV VAR and creating client using default constructor
  • withCaCertFile() - providing path to the certificate file if client is created via ConfigBuilder

However, if certificate is already installed in the system, client will ignore it and would expect certificate to be explicitly set during creation [1]

It looks like the kubernetes client creates an empty keystore and install the provided certificate into it. Basically, this approach ignores system keystore and valid certificates from it are simply not taken into account.

The issue should be reproducible for everyone who uses k8-client to talk to a different cluster, as it seems to assume only this clusters key is valid and ignore all other root chains.

[1] https://github.com/redhat-developer/che-starter/blob/master/src/main/java/io/fabric8/che/starter/openshift/OpenShiftClientWrapper.java#L64

About this issue

  • Original URL
  • State: closed
  • Created 7 years ago
  • Reactions: 3
  • Comments: 21 (15 by maintainers)

Commits related to this issue

Most upvoted comments