Error with Kafka Connect Build | x509: certificate signed by unknown authority

[dttl-oburgess]

Hi,

I am attempting to use the connect build feature (yaml below). I am pushing to a docker hub repository with a docker credentials secret which appears to be working correctly. However I am running into the following error:

INFO[0000] Retrieving image manifest quay.io/strimzi/kafka:0.33.1-kafka-3.3.2
INFO[0000] Retrieving image quay.io/strimzi/kafka:0.33.1-kafka-3.3.2 from registry quay.io
error building image: Get "https://quay.io/v2/": x509: certificate signed by unknown authority

Is anyone able to assist? Thanks in advance!!

build:
    output:
      type: docker
      image: docker.io/xxxx/datalake-poc:latest
      pushSecret: oburgess-registry-secret
    plugins:
      - name: debezium-postgres-connector
        artifacts:
          - type: tgz
            url: https://repo1.maven.org/maven2/io/debezium/debezium-connector-postgres/2.1.1.Final/debezium-connector-postgres-2.1.1.Final-plugin.tar.gz
            sha512sum: 962a12151bdf9a5a30627eebac739955a4fd95a08d373b86bdcea2b4d0c27dd6e1edd5cb548045e115e33a9e69b1b2a352bee24df035a0447cb820077af00c03

[scholzj]

It worked fine for me over the weekend. You should probably provide more details about your setup. Unless ti expired or you have some man in the middle proxy, I'm not sure what would cause this.

[dttl-oburgess]

It appears adding additionalKanikoOptions: [--insecure,--skip-tls-verify] to the file stopped this error. For my understanding, what configurations would need to take place to avoid adding these additional options?

[scholzj]

TBH, I do not know why you need them. I tried it in my environment and it works fine. My env is different since I do not use Docker Desktop and WSL. But I do not think it should make any difference since this is only abotu the process running inide the container. The Quay.io certificate is signed by a trusted public CA. So there should be no reason why it would not work. The only thing which comes to my mind is that you have some Man in the middle proxy screwing up the certificates or something like that.

What do you get when you run this from your host and form some container inside your Kubernetes cluster?

curl -v https://quay.io/v2/
*   Trying 3.224.202.81:443...
* Connected to quay.io (3.224.202.81) port 443 (#0)
* ALPN: offers h2
* ALPN: offers http/1.1
*  CAfile: /etc/ssl/cert.pem
*  CApath: none
* (304) (OUT), TLS handshake, Client hello (1):
* (304) (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES128-GCM-SHA256
* ALPN: server accepted h2
* Server certificate:
*  subject: CN=*.quay.io
*  start date: Jan 26 00:00:00 2023 GMT
*  expire date: Feb 24 23:59:59 2024 GMT
*  subjectAltName: host "quay.io" matched cert's "quay.io"
*  issuer: C=US; O=Amazon; CN=Amazon RSA 2048 M01
*  SSL certificate verify ok.
* Using HTTP2, server supports multiplexing
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
* h2h3 [:method: GET]
* h2h3 [:path: /v2/]
* h2h3 [:scheme: https]
* h2h3 [:authority: quay.io]
* h2h3 [user-agent: curl/7.85.0]
* h2h3 [accept: */*]
* Using Stream ID: 1 (easy handle 0x121011400)
> GET /v2/ HTTP/2
> Host: quay.io
> user-agent: curl/7.85.0
> accept: */*
>
* Connection state changed (MAX_CONCURRENT_STREAMS == 128)!
< HTTP/2 401
< date: Thu, 23 Feb 2023 11:02:58 GMT
< content-type: text/html; charset=utf-8
< content-length: 4
< server: nginx/1.20.1
< www-authenticate: Bearer realm="https://quay.io/v2/auth",service="quay.io"
< docker-distribution-api-version: registry/2.0
<
* Connection #0 to host quay.io left intact
true%

What certificate do you see there?

[dttl-oburgess]

As for set-up I am running this on kubernetes desktop via docker/wsl