On-prem binderhub deployment w/ internal CA

[betatim]

And right after posting my reply I found

Enabling JH to use an additional CA cert when calling private K8S API

I am deploying JupyterHub (v 0.9.1) to an on-premise K8s instance. The K8s instance has a private CA bundle. I have created our own JH image that simply copies in the private CA bundle and runs “update-ca-certificates” via Dockerfile. When I kubectl exec -it into the deployed JupyterHub pod, using the custom image, I can successfully curl the K8s API. However, when JupyterHub attempts to access the K8s API, it throws an error from Tornado web.py, as so: SSLError("bad handshake: Error...SSL rou…

which suggests that tornado does not use the OS level trusted roots?! This is annoying I’d still try and dig into why/how to persuade tornado to use the OS level CA bundle and only resort to having to customise the code after exhausting that option.