Another question - We use a custom .pem SSL cert ...
# ask-metaflow
n
Another question - We use a custom .pem SSL cert with Metaflow to allow metaflow to talk to AWS through our company VPN. This works until using the @conda decorator. I'm running
REQUESTS_CA_BUNDLE=/Users/erinboehmer/path/to/cert.pem CONDA_CHANNELS=conda-forge python sample_flow.py --environment=conda run --with batch
getting the following:
Copy code
Metaflow 2.8.1 executing SampleFlow for user:erinboehmer
Project: my_project, Branch: user.erinboehmer
Validating your flow...
    The graph looks good!
Running pylint...

    Pylint is happy!
Bootstrapping conda environment...(this could take a few minutes)
    Conda ran into an error while setting up environment.:
    Step: start, Error: CondaSSLError: Encountered an SSL error. Most likely a certificate verification issue.

    Exception: HTTPSConnectionPool(host='<http://conda.anaconda.org|conda.anaconda.org>', port=443): Max retries exceeded with url: /conda-forge/linux-64/repodata.json (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1006)')))
Any thoughts on how to get the SSL to conda?
👀 1
b
sorry for the delay getting back to this. Can you help me with some further details on your setup to understand what is working and what is not? • when you say things work until using the @conda decorator, do you mean accessing conda-forge packages with the request_ca_bundle set works outside metaflow? or something else? • are you using regular conda, mamba, micromamba or something else outside of metaflow? I noticed that there is at least one open issue regarding this still: https://github.com/mamba-org/mamba/issues/1106 ◦ under the hood metaflow is using micromamba for the environments. There was a suggestion in the above issue to try supplying
MAMBA_SSL_NO_REVOKE=1
, which was one workaround for some
Metaflow has its own binary for the micromamba which is stored at
Copy code
~/.metaflowconfig/micromamba/bin/micromamba
This should be the easiest way to debug the certificate issues by trying to dry-run an environment with the binary, something like
Copy code
REQUESTS_CA_BUNDLE=/Users/erinboehmer/path/to/cert.pem CONDA_CHANNELS=conda-forge ~/.metaflowconfig/micromamba/bin/micromamba create --dry-run --prefix ./temp_conda_env pytest
skipping the
--quiet
here which is used for metaflow environment creation, in order to get more detailed error output