Dataset/PVC: tls: failed to verify certificate: x509: certificate signed by unknown authority

[michael-gvdw]

Hello,
I want to create a Dataset and connect to the s3 compatible bucket using https. Unforunatelly i get the following error "tls: failed to verify certificate: x509: certificate signed by unknown authority" both in the Dataset and PVC. I tried adding the certificate to the csi-provisioner Statefulset but that does not seem to work.

Is there a solution for this?

[srikumar003]

@michael-gvdw A few questions:

1. Could you please provide the logs on where this error is occuring ? The Kubernetes cluster version, ,etc. ?
2. Is the S3 service from a cloud provider, or have you set up/ or are using a bespoke service ?

[celi28]

Hello !
I help myself as I have the same issue. We are using an internal CA for our internal services.

LAST SEEN                TYPE      REASON                 OBJECT                                           MESSAGE
14m (x9 over 19m)        Warning   ProvisioningFailed     PersistentVolumeClaim/paperless-ingress-bucket   failed to provision volume with StorageClass "csi-s3": rpc error: code = DeadlineExceeded desc = context deadline exceeded
14m (x26 over 20m)       Normal    ExternalProvisioning   PersistentVolumeClaim/paperless-ingress-bucket   Waiting for a volume to be created either by the external provisioner 'ch.ctrox.csi.s3-driver' or manually by the system administrator. If volume creation is delayed, please verify that the provisioner is running and correctly registered.
12m (x10 over 20m)       Normal    Provisioning           PersistentVolumeClaim/paperless-ingress-bucket   External provisioner is provisioning volume for claim "paperless/paperless-ingress-bucket"
12m                      Warning   ProvisioningFailed     PersistentVolumeClaim/paperless-ingress-bucket   failed to provision volume with StorageClass "csi-s3": rpc error: code = Unknown desc = failed to check if bucket paperless-ingress-bucket exists: Get "https://s3.[url].me:9001/paperless-ingress-bucket/?location=": x509: certificate signed by unknown authority
3m40s (x26 over 9m51s)   Normal    ExternalProvisioning   PersistentVolumeClaim/paperless-ingress-bucket   Waiting for a volume to be created either by the external provisioner 'ch.ctrox.csi.s3-driver' or manually by the system administrator. If volume creation is delayed, please verify that the provisioner is running and correctly registered.
3m28s (x10 over 9m51s)   Normal    Provisioning           PersistentVolumeClaim/paperless-ingress-bucket   External provisioner is provisioning volume for claim "paperless/paperless-ingress-bucket"
3m28s (x10 over 9m51s)   Warning   ProvisioningFailed     PersistentVolumeClaim/paperless-ingress-bucket   failed to provision volume with StorageClass "csi-s3": rpc error: code = Unknown desc = failed to check if bucket paperless-ingress-bucket exists: Get "https://s3.[url].me:9001/paperless-ingress-bucket/?location=": x509: certificate signed by unknown authority

The S3 service used is an internal minio, with a custom certificate authority.

[celi28]

On way to implement that would be to edit the csi-attacher-s3 helm template value to allow custom volume mountpoint.
That way, it would be possible to mount an external CA bundle file.