HTTP Template - x509: certificate signed by unknown authority

[mateoporcar]

Summary

What happened?

We are trying to make a request to an internal url with a custom ca certificate, but we get x509: certificate signed by unknown authority.

What you expected to happen?

The ability to skip tls verification or the ability to provide our internal ca certificate.

What executor are you using?

Emissary

Diagnostics

Paste the smallest workflow that reproduces the bug. We must be able to run the workflow.

apiVersion: argoproj.io/v1alpha1
kind: Workflow
metadata:
  generateName: http-template-
spec:
  entrypoint: main
  templates:
    - name: main
      steps:
        - - name: get-internal-homepage
            template: http
            arguments:
              parameters: [{name: url, value: "https://internal-url.com"}]
    - name: http
      inputs:
        parameters:
          - name: url
      http:
        timeoutSeconds: 20 # Default 30
        url: "{{inputs.parameters.url}}"
        method: "GET" # Default GET
        headers:
          - name: "x-header-name"
            value: "test-value"
        successCondition: "response.body contains \"internal-home-page\"" # available since v3.3
        body: "test body" # Change request body

Argo Workflow Version: v3.3.0-rc3 and v3.2.8 (release)

# The workflow's pods that are problematic:
kubectl logs http-template-4vsp5-1340600742-agent

time="2022-02-07T19:07:21.319Z" level=info msg="Starting Workflow Executor" version=untagged
time="2022-02-07T19:07:21.321Z" level=info msg="Starting Agent" requeueTime=10s taskWorkers=16 workflow=http-template-4vsp5
time="2022-02-07T19:07:21.337Z" level=info msg="Watch workflowtasksets 200"
time="2022-02-07T19:07:21.354Z" level=info msg="TaskSet Event" event_type=ADDED workflow=http-template-4vsp5
time="2022-02-07T19:07:21.354Z" level=info msg="Processing task" nodeID=http-template-4vsp5-939548807
time="2022-02-07T19:07:21.415Z" level=info msg="Sending result" message="Get \"https://internal-url.com\": x509: certificate signed by unknown authority" nodeID=http-template-4vsp5-939548807 phase=Failed requeue=0s

---

Message from the maintainers:

Impacted by this bug? Give it a 👍. We prioritise the issues with the most 👍.

[alexec]

I don't think this is a bug. I think this is the correct behaviour. Instead we need the following enhancements:

• Support insecureSkipVerify for HTTP template.
• Support import of CA certs into agent for HTTP template.

[ogandoe]

It would be great!!! having those options

[sarabala1979]

#7390

[sarabala1979]

Cert can be imported/mounted as k8s secrets into agent pods. HttpTemplate can have tlsConfig with list for secretsRefercences. Agent pods will mount all certs during the creation.

    - name: http
      inputs:
        parameters:
          - name: url
      http:
       tlsConfigs:
          insecureSkipVerify: false
           certs:
            - 
               secretKeyRef:
    	          name: corp-tls-sert
                   key: cert
            - 
               secretKeyRef:
    	          name: corp1-tls-sert
                   key:  cert.perm
       # url: https://dummy.restapiexample.com/api/v1/employees
       url: "{{inputs.parameters.url}}"

[sarabala1979]

    - name: http
      inputs:
        parameters:
          - name: url
      http:
        insecureSkipVerify: false
        # url: https://dummy.restapiexample.com/api/v1/employees
        url: "{{inputs.parameters.url}}"

[rossigee]

I'm hitting this now (v3.5.10). The documentation page for 'HTTP template' makes no mention of insecureSkipVerify or tlConfig. In fact, it doesn't cover TLS at all.

Am I missing something?