minikube: Importing Corporate Root CA is not working as advertised
According to merge https://github.com/kubernetes/minikube/pull/5015 and https://minikube.sigs.k8s.io/docs/tutorials/untrusted_root_certificate/ I should be able to drop my corporate root certificate into my $home\.minikube\certs directory and it would get copied to the minikube vm during startup. I have done this and I see evidence of this in the vm (output below), however it only creates symlinks in the /etc/ssl/certs folder and there are no files there. Attempting to use curl from within the VM returns a problem with the TLS trust.
I have confirmed that if I manually create the file in the /etc/ssl/certs folder it resolves the issue.
Expected Result:
Copying my root certificate into $home.minikube\certs folder (as PEM format) and then starting the vm should copy the file to the vm’s /etc/ssl/certs folder which will resolve TLS connection issues protected by our corporate root certificate. After this ssh’ing into the vm ( minikube ssh ) and then calling the service ( curl https://service.domain:0000 ) should succeed.
Actual Results:
A symlink is created in the /etc/ssl/certs folder, but not the actual certificate file.
After this ssh’ing into the vm ( minikube ssh ) and then calling the service ( curl https://service.domain:0000 ) returns an error:
In the output below, lbrtca01-ca.pem is my corporate root certificate.
PS D:\Projects\LEAF\Kubernetes\Config> dir $home\.minikube\certs
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 1/29/2020 2:25 PM 1679 ca-key.pem
-a---- 1/29/2020 2:25 PM 1046 ca.pem
-a---- 1/29/2020 2:25 PM 1086 cert.pem
-a---- 1/29/2020 2:25 PM 1675 key.pem
-a---- 2/10/2020 11:03 AM 2062 lbrtca01-ca.pem
-a---- 2/10/2020 11:04 AM 1984 legacy01-svcert01-ca.pem
PS D:\Projects\LEAF\Kubernetes\Config> minikube ssh
_ _
_ _ ( ) ( )
___ ___ (_) ___ (_)| |/') _ _ | |_ __
/' _ ` _ `\| |/' _ `\| || , < ( ) ( )| '_`\ /'__`\
| ( ) ( ) || || ( ) || || |\`\ | (_) || |_) )( ___/
(_) (_) (_)(_)(_) (_)(_)(_) (_)`\___/'(_,__/'`\____)
$
$ ls -l /etc/ssl/certs | grep -i 'lbrt'
lrwxrwxrwx 1 root root 30 Feb 10 17:44 9373d18b.0 -> /etc/ssl/certs/LBRTCA01-CA.pem
$ sudo cat /etc/ssl/certs/LBRTCA01-CA.pem
cat: /etc/ssl/certs/LBRTCA01-CA.pem: No such file or directory
$
$ openssl s_client -connect dnaleafas.legacy01.legacybank.com:10001
CONNECTED(00000003)
depth=1 DC = com, DC = LegacyBank, DC = Legacy01, CN = Legacy01-SVCERT01-CA
verify error:num=20:unable to get local issuer certificate
verify return:0
---
Certificate chain
0 s:/CN=DNALEAFAS.Legacy01.LegacyBank.com
i:/DC=com/DC=LegacyBank/DC=Legacy01/CN=Legacy01-SVCERT01-CA
1 s:/DC=com/DC=LegacyBank/DC=Legacy01/CN=Legacy01-SVCERT01-CA
i:/DC=com/DC=LegacyBank/DC=Legacy01/CN=LBRTCA01-CA
---
I am running minikube version v.1.7.1 with the Hyper-V VM driver on Windows 10 Enterprise Version 1809 x64.
Thank You
About this issue
- Original URL
- State: closed
- Created 4 years ago
- Comments: 17 (13 by maintainers)
Sent out a fix PR. The underlying issue was a combination of an inverted boolean check and inverting the arguments to
ln. Somehow, after 25 years of using UNIX, I can never getln -sarguments correct.I’ve added a comprehensive integration test for certificate synchronization so that this feature does not unexpectedly break in the future.
Thank you @CrossBound for the comprehensive bug report.