aws / aws/aws-cdk

aws-eks: addHelmChart not accepting SSL certificate from public JupyterHub helm chart

Open
#25,747 12 comments 1 reaction 0 assignees View on GitHub
@aws-cdk/aws-eks bug effort/medium p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

We are using [EKS Blueprints](https://github.com/aws-quickstart/cdk-eks-blueprints) to provision an EKS cluster with a JupyterHub addon. JupyterHub addon uses its public helm chart and adds to the EKS cluster using addHelmChart (jupyterhub v2.0 from `https://hub.jupyer.org/helm-chart/`). It has been working until recently, when it started producing an error with unknown authority, and rolls back.

The certificate was recently renewed per `index.yaml`, but the chart deploys successfully when using Helm CLI. We have explored the option of bypassing SSL using `insecure-skip-tls-verify` flag, but it is not an option available under `addHelmChart` nor is security best practice.

### Expected Behavior

Deploys the helm chart successfully.

### Current Behavior

When the CDK deploys with added JupyterHub addon, we get the following error:

```
Message returned: Error: b'Release "blueprints-addon-jupyterhub" does not exist. Installing it now.\nError: looks like "https://hub.jupyter.org/helm-chart/" is not a valid chart repository or cannot be reached: Get "https://hub.jupyter.org/helm-chart/index.yaml": x509: certificate signed by unknown authority\n'
```

### Reproduction Steps

1. `git clone https://github.com/aws-quickstart/cdk-eks-blueprints.git`
2. In the directory, run `npm i`.
3. Then deploy an example stack: `npx cdk deploy blueprint-construct-dev`

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### CDK CLI Version

2.78.0

### Framework Version

_No response_

### Node.js Version

16.16.0

### OS

13.3.1

### Language

Typescript

### Language Version

_No response_

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Reproduce the failure with the listed npm install and npx cdk deploy commands, then trace the addHelmChart entry point used for the JupyterHub chart URL. Compare its certificate handling with the successful Helm CLI behavior and verify completion by deploying the chart without the x509 unknown-authority rollback.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, helm, kubernetes, typescript
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.