[feature] CLI: Allow user to pass certificate authority .pem file as command option to avoid self-signed certificate errors

[eric79]

Feature Area

/area CLI

What feature would you like to see?

Allow user to pass certificate authority .pem file as command option to avoid self-signed certificate errors

What is the use case or pain point?

When I try to use the kfp command line (for example, to run a pipeline via kfp run submit) from my enterprise's network, I get the following error:

... connection broken by 'SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate in certificate chain (_ssl.c:1129)'))' ...

Is there a workaround currently?

Without this feature, I will need to write a python script that uses the kfp SDK to run the pipeline (in our case, the kfp-tekton SDK), because the TektonClient allows setting the cert like so:

client = kfp_tekton.TektonClient(
    host=f'{kubeflow_url}/pipeline',
    namespace=namespace,
    existing_token=session_cookie,
     ssl_ca_cert=cert_path
 )

... and then run that python script from the command line.

---

Love this idea? Give it a 👍.

[google-oss-prow]

@eric79: The label(s) area/cli cannot be applied, because the repository doesn't have them.

In response to this:

Feature Area

/area CLI

What feature would you like to see?

Allow user to pass certificate authority .pem file as command option to avoid self-signed certificate errors

What is the use case or pain point?

When I try to use the kfp command line (for example, to run a pipeline via kfp run submit) from my enterprise's network, I get the following error:

... connection broken by 'SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate in certificate chain (_ssl.c:1129)'))' ...

Is there a workaround currently?

Without this feature, I will need to write a python script that uses the kfp SDK to run the pipeline (in our case, the kfp-tekton SDK), because the TektonClient allows setting the cert like so:

client = kfp_tekton.TektonClient(
   host=f'{kubeflow_url}/pipeline',
   namespace=namespace,
   existing_token=session_cookie,
    ssl_ca_cert=cert_path
)

... and then run that python script from the command line.

---

Love this idea? Give it a 👍.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.