Sudo sh -c 'echo deb bionic main > /etc/apt//passenger.list' Sudo apt-get install -y apt-transport-https ca-certificates Sudo apt-key adv -keyserver hkp://:80 -recv-keys 561F9B9CAC40B2F7 # Install our PGP key and add HTTPS support for APT If not, you should do that first before continuing. nfigure(None, defaults=' self.keyfile, self.certfile, cafile=self.client_ca.# configured with any relevant ssl config.I’m still new-ish to the code, but I think the only place this happens is in launcher.py. It would be great if binderhub performed the same configuration work for its calls out to the hub. What configuration of the ssl context looks like in the code can be seen below. …and their usages can be found in mixins.py and auth.py. On the latter…In the jupyterhub codebase, from what I’ve seen, there are two places that leverage environment variables to configure the ssl context. Thinking more about this, what I’m looking for is the ability to configure a cafile arg for two separate interfaces: calls made to gitlab, and calls made to the hub api. resp = yield client.fetch(api_url, user_agent="BinderHub").In order to get past this, I mounted a secret, went into the code, and explicitly configured the individual api request to use ca_certs=’’: jupyterhub/binderhub/blob/894a35cf5ac1e2bc3f5f5b4234f8d2064e986529/binderhub/repoproviders.py#L563 If it’s wasn’t, then I ran into ssl cert issues. However, in the process, I ran into an issue where in order to resolve the ref for the repo being requested, binderhub (or specifically the request being via AsyncHttpClient) needed to be aware of the CA. Our self-hosted gitlab, binderhub, and the in-deployment jupyterhub will all make use of this CA.
My company prefers to host almost everything internally, and we have our own certificate authority that issues certs for all of our internal sites. I’m in the process of setting up an on-prem deployment.
0 kommentar(er)
