首页 文章

Kubernetes的Sagemaker证书问题

提问于
浏览 次
0

我创建了一个通过java sdk使用Sagemaker的docker容器 . 此容器部署在具有多个副本的k8s群集上 .

容器正在向Sagemaker发出简单请求，列出我们已经培训和部署的一些模型 . 但是我们现在遇到了一些java证书的问题 . 我是k8s和证书的新手，所以如果你能提供一些帮助来解决这个问题，我将不胜感激 .

以下是尝试列出 endpoints 时日志中的一些跟踪：

org.apache.http.conn.ssl.SSLConnectionSocketFactory.createLayeredSocket(SSLConnectionSocketFactory.java:394)
    at org.apache.http.conn.ssl.SSLConnectionSocketFactory.connectSocket(SSLConnectionSocketFactory.java:353)
    at com.amazonaws.http.conn.ssl.SdkTLSSocketFactory.connectSocket(SdkTLSSocketFactory.java:132)
    at org.apache.http.impl.conn.DefaultHttpClientConnectionOperator.connect(DefaultHttpClientConnectionOperator.java:141)
    at org.apache.http.impl.conn.PoolingHttpClientConnectionManager.connect(PoolingHttpClientConnectionManager.java:353)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:498)
    at com.amazonaws.http.conn.ClientConnectionManagerFactory$Handler.invoke(ClientConnectionManagerFactory.java:76)
    at com.amazonaws.http.conn.$Proxy67.connect(Unknown Source)
    at org.apache.http.impl.execchain.MainClientExec.establishRoute(MainClientExec.java:380)
    at org.apache.http.impl.execchain.MainClientExec.execute(MainClientExec.java:236)
    at org.apache.http.impl.execchain.ProtocolExec.execute(ProtocolExec.java:184)
    at org.apache.http.impl.client.InternalHttpClient.doExecute(InternalHttpClient.java:184)
    at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:82)
    at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:55)
    at com.amazonaws.http.apache.client.impl.SdkHttpClient.execute(SdkHttpClient.java:72)
    at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeOneRequest(AmazonHttpClient.java:1236)
    at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeHelper(AmazonHttpClient.java:1056)
    ... 70 common frames omitted
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:397)
    at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:302)
    at sun.security.validator.Validator.validate(Validator.java:262)
    at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324)
    at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:229)
    at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:124)
    at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1621)
    ... 97 common frames omitted
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141)
    at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:126)
    at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:280)
    at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:392)
    ... 103 common frames omitted
kubernetes amazon-sagemaker sagemaker aws-sdk-java-2.0 aws-sagemaker

3 回答

  • 0

    我想我找到了问题的答案 . 我已经设置了另一个k8s集群并在那里部署了容器 . 它们工作正常，证书问题不会发生 . 在调查更多时，我注意到它们是第一个k8s群集上DNS解析的一些问题 . 事实上，具有证书问题的容器无法ping google.com . 我通过不依赖core-dns并在deployment.yaml文件中设置DNS配置来修复DNS问题 . 我不确定究竟为什么，但这似乎已经解决了证书问题 .

    回复于
  • 0

    当Java不知道TLS endpoints 返回的根证书时，会收到您收到的错误消息 . 如果更改可用的根证书，通常会发生这种情况 .

    每https://docs.oracle.com/javase/7/docs/technotes/guides/security/jsse/JSSERefGuide.html#Customization：

    "If a truststore named <java-home>/lib/security/jssecacerts is found, it is used. 
If not, then a truststore named <java-home>/lib/security/cacerts is searched for and used (if it exists).
Finally, if a truststore is still not found, then the truststore managed by the TrustManager will be a new empty truststore."

    Openssl是调试此类证书问题的好工具 . 您可以使用以下命令检索 endpoints 返回的证书 . 这可以帮助您确定证书链的外观 .

    openssl s_client -showcerts -connect www.example.com:443 </dev/null

    您可以使用keytool查看Java知道的证书列表，keytool是使用JRE提供的实用程序 .

    keytool -list -cacerts

    某些系统管理员将通过将备用信任库文件写入默认位置来覆盖默认证书 . 其他时候，团队可以使用javax.net.ssl.trustStore系统属性覆盖默认值 .

    最后，您可以使用jps实用程序（也使用JRE提供）来查看正在运行的Java进程上设置的系统属性 .

    jps -v
    回复于
  • 0

    这可能最有可能与您的管理员添加到您的网络的某些自定义SSL认证路径有关 . 您可能希望通过在浏览器上打开任何安全网站来检查SSL根证书，然后单击地址栏左侧的安全链接（至少这是它在chrome中的方式） . 您将看到一个显示证书和证书信息的弹出窗口 . 转到其证书路径并查看ROOT证书，如果它是自定义证书，则您需要将其添加到您的cacerts文件中 . 有关详细信息，请阅读此link

    回复于

相关问题