1

I have a node application running in a container that works well when I run it locally on docker.

When I try to run it in my k8 cluster, I get the following error.

 kubectl -n some-namespace logs --follow my-container-5d7dfbf876-86kv7
> code@1.0.0 my-container /src
> node src/app.js
Error: unable to get local issuer certificate
    at TLSSocket.onConnectSecure (_tls_wrap.js:1486:34)
    at TLSSocket.emit (events.js:315:20)
    at TLSSocket._finishInit (_tls_wrap.js:921:8)
    at TLSWrap.ssl.onhandshakedone (_tls_wrap.js:695:12) {
  code: 'UNABLE_TO_GET_ISSUER_CERT_LOCALLY'
}

This is strange as the only I run the container with 

        command: ["npm", "run", "consumer"]

I have also tried adding to my Dockerfile 

npm config set strict-ssl false

as per the recommendation here: npm install error - unable to get local issuer certificate but it doesn't seem to help.

So it should be trying to authenticate this way.

I would appreciate any pointers on this.

Here is a copy of my .yaml file for completeness. 

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    name: label
  name: label
  namespace: some-namespace
spec:
  replicas: 1
  selector:
    matchLabels:
      name: lable
  template:
    metadata:
      labels:
          name: label
    spec:
      containers:
      - name: label
        image: some-registry:latest
        resources:
          limits:
            memory: 7000Mi
            cpu: '3'
        ports:
          - containerPort: 80 
        command: ["npm", "run", "application"]
        env:
          - name: "DATABASE_URL"
            valueFrom:
              secretKeyRef:
                name: postgres
                key: DBUri
          - name: "DEBUG"
            value: "*,-babel,-mongo:*,mongo:queries,-http-proxy-agent,-https-proxy-agent,-proxy-agent,-superagent,-superagent-proxy,-sinek*,-kafka*"
          - name: "ENV"
            value: "production"
          - name: "NODE_ENV"
            value: "production"
          - name: "SERVICE"
            value: "consumer"
        volumeMounts:
          - name: certs
            mountPath: /etc/secrets
            readOnly: true
      volumes:
        - name: certs
          secret:
            secretName: certs
            items:
            - key: certificate
              path: certificate
            - key: key
              path: key
0xsegfault
  • 2,899
  • 6
  • 28
  • 58
  • Hmm, it looks like the error is coming from node, not npm. You could try manually specifying your CA certificate [via code](https://stackoverflow.com/questions/22258093/node-js-using-https-request-with-an-internal-ca) or the [`NODE_EXTRA_CA_CERTS` environment variable](https://nodejs.org/api/cli.html#cli_node_extra_ca_certs_file). – cbr May 26 '20 at 21:21

1 Answers1

1

It looks that the pod is not mounting the secrets in the right place. Make sure that .spec.volumeMounts.mountPath is pointing on the right path for the container image.

jmselmi
  • 96
  • 1
  • 1