Happy New Year) Is there a config var to disable ...
# dev-metaflow
c
Happy New Year) Is there a config var to disable ssl verification for Metaflow service similar to METAFLOW_S3_VERIFY_CERTIFICATE? Getting this with letsencrypt staging certs (even after chaining root and intermediate certs to REQUESTS_CA_BUNDLE, adding all certs to python's certifi/cacert.pem) and running update-ca-certificate locally. [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get issuer certificate (_ssl.c:1129)'))) Thank you very much.
b
presumably this is for client -> metadata service communication? There doesn't seem to be a way to disable certificate verification with Metaflow specific env vars. It's simply using
requests
under the hood as you probably already noticed, but unfortunately seems like there is no simple config for requests either to completely disable verification. One further thing to try maybe is to add the path to your certificate file in the environment variable
SSL_CERT_FILE
in addition to the
REQUESTS_CA_BUNDLE
adding support for disabling the verification should be quite straightforward though if that is required. Have the LetsEncrypt certificates been working before?
c
Letsencrypt prod certs work. I recreate secrets for Minio and Metaflow ingress every time from .crt and .key files. However minio backend uses self-generated certs if set to https. The usual check: python from metaflow import Metaflow list(Metaflow().flows) returns [] when using: METAFLOW_S3_ENDPOINT_URL: "https://minio.testsite.io", but The kubernetes run only works if I replace it with: http://nodeIP:NodePort and use http backend for minio, which is something I'd rather avoid. I deploy metaflow and minio helm charts to digital ocean's managed k8s.