TLS Certificate Verification Failure When Using function-kcl with OCI Registry on AWS ECR in Crossplane #191
Description
What happened?
I expected the function-kcl in Crossplane to authenticate and retrieve a KCL module stored in an OCI registry on AWS ECR. This works locally without issue using kcl login. However, when deploying function-kcl in a Kubernetes cluster with Crossplane, the function fails to authenticate and returns a TLS error related to certificate verification.
In the status section of a Crossplane XRD, I receive the following error:
status:
conditions:
- lastTransitionTime: '2024-11-08T13:58:13Z'
message: >
cannot compose resources: pipeline step "normal" returned a fatal
result: failed to run kcl function pipelines: failed to login
'xxxxxxxxxxxx.dkr.ecr.us-east-1.amazonaws.com', please check registry,
username and password is valid
Get "https://xxxxxxxxxxxx.dkr.ecr.us-east-1.amazonaws.com/v2/": tls:
failed to verify certificate: x509: certificate signed by unknown
authorityI apologize if this issue has been reported already; I searched but could not find a similar report. Additionally, apologies if I missed anything in the setup.
How can we reproduce it?
Below is the configuration used in the XR of Crossplane with kcl-function:
apiVersion: apiextensions.crossplane.io/v1
kind: Composition
metadata:
name: pcf-instanceec2
spec:
writeConnectionSecretsToNamespace: crossplane
compositeTypeRef:
apiVersion: platform.pcfactory.cl/v1alpha1
kind: XInstanceEc2
mode: Pipeline
pipeline:
- step: normal
functionRef:
name: kcl-function
input:
apiVersion: krm.kcl.dev/v1alpha1
kind: KCLInput
metadata:
name: basic
annotations:
krm.kcl.dev/allow-insecure-source: "true"
spec:
target: Resources
source: oci://xxxxxxxxxxxx.dkr.ecr.us-east-1.amazonaws.com/kcl-modules/instanceec2
credentials:
url: xxxxxxxxxxxx.dkr.ecr.us-east-1.amazonaws.com
username: AWS
password: "keygeneratedbyecr"
- step: automatically-detect-ready-composed-resources
functionRef:
name: function-auto-readyAttempts to address the issue included:
- Removing the
allow-insecure-sourceannotation. - Adding the module version to the
source, e.g.,source: oci://xxxxxxxxxxxx.dkr.ecr.us-east-1.amazonaws.com/kcl-modules/instanceec2:0.0.1. - Testing various configurations for credentials.
Additionally, a manual kcl login command was attempted inside the kcl-function pod:
kcl registry login -u AWS -p keygeneratedbyecr xxxxxxxxxxxx.dkr.ecr.us-east-1.amazonaws.com --insecure-skip-tls-verifyThis resulted in a similar certificate error:
failed to login 'xxxxxxxxxxxx.dkr.ecr.us-east-1.amazonaws.com', please check registry, username and password is valid
Get "https://xxxxxxxxxxxx.dkr.ecr.us-east-1.amazonaws.com/v2/": tls: failed to verify certificate: x509: certificate signed by unknown authority
What environment did it happen in?
| Environment Variable | Version/Value |
|---|---|
| Function version | v0.10.8 |
| Crossplane version | v1.17.2 |
| Kubernetes version | v1.26.10 |
| Cloud provider | AWS |