git Openshift3 中的“Peer 的证书颁发者已被标记为不受用户信任”
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/44914034/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
"Peer's certificate issuer has been marked as not trusted by the user" in Openshift3
提问by Carlos Alberto
If S2I - "Source-to-image" resource in Openshift3 tries to connect to a TLS Gitlab repository shows the following message: "Peer's certificate issuer has been marked as not trusted by the user".
如果 S2I - Openshift3 中的“Source-to-image”资源尝试连接到 TLS Gitlab 存储库，则会显示以下消息：“Peer 的证书颁发者已被标记为不受用户信任”。
How can I instruct Openshift3 which certificates authorities are able to use there? Is there any config/option to bypass this error?
我如何指示 Openshift3 哪些证书颁发机构可以在那里使用？是否有任何配置/选项可以绕过此错误？
The command entered was:
输入的命令是：
oc new-app tomcat~https://gitlab.xxx/test/test.git --name=test --strategy=docker
回答by PhilipGough
For security reasons, you should add a trusted CA source secret to the BuildConfig. To answer your question, you can disable TLS verification by setting an environment variable GIT_SSL_NO_VERIFYto falsein the BuildConfig. Checks the docs herefor more info.
出于安全原因，您应该向 BuildConfig添加受信任的 CA 源机密。要回答您的问题，您可以通过在 BuildConfig 中设置环境变量GIT_SSL_NO_VERIFY来禁用 TLS 验证false。查看此处的文档以获取更多信息。
To pass this directly to the oc new-appcommand run oc new-app --build-env GIT_SSL_NO_VERIFY=false
将此直接传递给oc new-app命令运行oc new-app --build-env GIT_SSL_NO_VERIFY=false
回答by josh-cain
Alternatively, I'd suggest just importing the root CA such that TLS validation works. Won't attempt to speak to all the reasons why this should be a must, but here's how you'd do it:
或者，我建议只导入根 CA，以便 TLS 验证工作。不会试图说明为什么这应该是必须的所有原因，但您可以这样做：
1) Grab the root certificate file.
1) 获取根证书文件。
If you're running an internal Gitlab instance, whoever set it up should be able to point you to the root CA they're using.
如果您正在运行内部 Gitlab 实例，那么设置它的人应该能够将您指向他们正在使用的根 CA。
2) Create a new secret with the certificate file
2）用证书文件创建一个新的秘密
#oc secrets new [secret name] ca.crt=[local .crt file]
oc secrets new tls-root-ca ca.crt=my-it-ca.crt
3) Attach your newly created secret to the build config
3）将您新创建的秘密附加到构建配置
#oc patch bc/[build config name] --patch '{ "spec": {"source": { "sourceSecret": { "name": "[secret name]" } } } }'
oc patch bc/my-build --patch '{ "spec": {"source": { "sourceSecret": { "name": "tls-root-ca" } } } }'
In case you're not familiar with the patch command, this is just adding a "sourceSecret" block like this:
如果您不熟悉 patch 命令，这只是添加一个“sourceSecret”块，如下所示：
source:
git:
uri: https://your.gitlab.org/your-app
sourceSecret:
name: tls-root-ca
See also the openshift guide on build input secrets
另请参阅有关构建输入机密的openshift 指南
