aws-eks: addHelmChart not accepting SSL certificate from public JupyterHub helm chart
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### Describe the bug
We are using [EKS Blueprints](https://github.com/aws-quickstart/cdk-eks-blueprints) to provision an EKS cluster with a JupyterHub addon. JupyterHub addon uses its public helm chart and adds to the EKS cluster using addHelmChart (jupyterhub v2.0 from `https://hub.jupyer.org/helm-chart/`). It has been working until recently, when it started producing an error with unknown authority, and rolls back.
The certificate was recently renewed per `index.yaml`, but the chart deploys successfully when using Helm CLI. We have explored the option of bypassing SSL using `insecure-skip-tls-verify` flag, but it is not an option available under `addHelmChart` nor is security best practice.
### Expected Behavior
Deploys the helm chart successfully.
### Current Behavior
When the CDK deploys with added JupyterHub addon, we get the following error:
```
Message returned: Error: b'Release "blueprints-addon-jupyterhub" does not exist. Installing it now.\nError: looks like "https://hub.jupyter.org/helm-chart/" is not a valid chart repository or cannot be reached: Get "https://hub.jupyter.org/helm-chart/index.yaml": x509: certificate signed by unknown authority\n'
```
### Reproduction Steps
1. `git clone https://github.com/aws-quickstart/cdk-eks-blueprints.git`
2. In the directory, run `npm i`.
3. Then deploy an example stack: `npx cdk deploy blueprint-construct-dev`
### Possible Solution
_No response_
### Additional Information/Context
_No response_
### CDK CLI Version
2.78.0
### Framework Version
_No response_
### Node.js Version
16.16.0
### OS
13.3.1
### Language
Typescript
### Language Version
_No response_
### Other information
_No response_
Contributor guide
Research direction
Reproduce the failure with the listed npm install and npx cdk deploy commands, then trace the addHelmChart entry point used for the JupyterHub chart URL. Compare its certificate handling with the successful Helm CLI behavior and verify completion by deploying the chart without the x509 unknown-authority rollback.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, helm, kubernetes, typescript
- Domain
- cloud, infrastructure
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100