Using the CLI with Self-Signed TLS Certificates

Introduction

If no certificates are supplied by the Administrator during the configuration and installation procedure, the Fuzzball Operator will create self-signed certificates for hosting Fuzzball Orchestrate.

Problem

You may run into issues using the Fuzzball CLI if the cluster (context) you are accessing is using a self-signed certificate.

Symptoms

If you receive an error like the following when attempting to use the Fuzzball CLI it suggests that your environment is not properly configured to recognize the self-signed TLS certificates in use.

tls: failed to verify certificate: x509: certificate signed by unknown authority

Resolution

An administrator can use the following commands to export the relevant certificates from the Fuzzball K8s installation:

# mkdir certs

# kubectl get secret -n cert-manager root-ca-cert -o "jsonpath={.data['ca\.crt']}" | base64 --decode >certs/ca.crt

# kubectl get secret -n cert-manager root-ca-cert -o "jsonpath={.data['tls\.crt']}" | base64 --decode >certs/tls.crt

These certificates can be distributed to the systems where the Fuzzball CLI is installed and then used by adding an environment variable like so:

$ export SSL_CERT_DIR=/path/to/certs

Alternately, CLI users can set an environment variable, FUZZBALL_INSECURE=true or use the --insecure flag when invoking the Fuzzball command.

Notes

The solutions selected here are appropriate for development clusters, testing, and debugging, but it is ultimately more secure for administrators to use certificates issued by 3rd parties. The Fuzzball documentation contains a section describing how to do this.