node.js - 无法访问 Kubernetes 集群上的本地证书

Question

我有一个在容器中运行的 Node 应用程序，当我在 docker 上本地运行它时运行良好。

当我尝试在我的 k8 集群中运行它时，我收到以下错误。

 kubectl -n some-namespace logs --follow my-container-5d7dfbf876-86kv7
> code@1.0.0 my-container /src
> node src/app.js
Error: unable to get local issuer certificate
    at TLSSocket.onConnectSecure (_tls_wrap.js:1486:34)
    at TLSSocket.emit (events.js:315:20)
    at TLSSocket._finishInit (_tls_wrap.js:921:8)
    at TLSWrap.ssl.onhandshakedone (_tls_wrap.js:695:12) {
  code: 'UNABLE_TO_GET_ISSUER_CERT_LOCALLY'
}

这很奇怪，因为我唯一运行容器

        command: ["npm", "run", "consumer"]

我也尝试添加到我的 Dockerfile

npm config set strict-ssl false

根据这里的建议:npm install error - unable to get local issuer certificate但这似乎没有帮助。

所以它应该尝试以这种方式进行身份验证。

我将不胜感激有关此的任何指示。

为了完整起见，这是我的 .yaml 文件的副本。

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    name: label
  name: label
  namespace: some-namespace
spec:
  replicas: 1
  selector:
    matchLabels:
      name: lable
  template:
    metadata:
      labels:
          name: label
    spec:
      containers:
      - name: label
        image: some-registry:latest
        resources:
          limits:
            memory: 7000Mi
            cpu: '3'
        ports:
          - containerPort: 80 
        command: ["npm", "run", "application"]
        env:
          - name: "DATABASE_URL"
            valueFrom:
              secretKeyRef:
                name: postgres
                key: DBUri
          - name: "DEBUG"
            value: "*,-babel,-mongo:*,mongo:queries,-http-proxy-agent,-https-proxy-agent,-proxy-agent,-superagent,-superagent-proxy,-sinek*,-kafka*"
          - name: "ENV"
            value: "production"
          - name: "NODE_ENV"
            value: "production"
          - name: "SERVICE"
            value: "consumer"
        volumeMounts:
          - name: certs
            mountPath: /etc/secrets
            readOnly: true
      volumes:
        - name: certs
          secret:
            secretName: certs
            items:
            - key: certificate
              path: certificate
            - key: key
              path: key

Answer 1

看起来 pod 没有将 secret 安装在正确的位置。确保 .spec.volumeMounts.mountPath 指向容器镜像的正确路径。