Fix default CA to be based on system certs instead of none#9556
Fix default CA to be based on system certs instead of none#9556jackyalbo wants to merge 1 commit intonoobaa:masterfrom
Conversation
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 1 minutes and 2 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughUpdated HTTPS agent CA certificate configuration to prepend Node's built-in root certificates ( Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Possibly related PRs
Suggested labels
Suggested reviewers
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@src/util/http_utils.js`:
- Line 10: The code currently uses tls.rootCertificates which only contains
Node's bundled Mozilla CAs and will override system/OpenSSL stores when passed
as the 'ca' option; change usage in src/util/http_utils.js to call
tls.getCACertificates('default') to obtain the effective default CA set
(including system certs) and only set the request/agent 'ca' option when custom
CA files are provided—if no custom CA files exist, leave 'ca' undefined so
Node's implicit default trust handling is preserved; update any references to
tls.rootCertificates in functions that build TLS options (e.g., the agent or
request TLS option construction) to use tls.getCACertificates('default') and
conditional assignment.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 1cd951d7-8993-453d-8e5b-896b428c6d51
📒 Files selected for processing (1)
src/util/http_utils.js
Signed-off-by: jackyalbo <jacky.albo@gmail.com>
jackyalbo
force-pushed
the
jacky_default_ca
branch
from
cc0ef49 to
5495f48
Compare
| fs_utils.try_read_file_sync(EXTERNAL_CA_CERTS), | ||
| ].filter(Boolean); | ||
| return custom_certs.length ? [ | ||
| ...tls.getCACertificates('default'), |
There was a problem hiding this comment.
As far as I can tell, it was added in Node.js v22.15.0
Here is the list of nodes we are using (based on the .nvmrc)
5.16 -> 20.11.0
5.17 -> 20.17.0
5.18 -> 22.11.0
5.19 -> 22.11.0
5.20 -> 22.11.0
5.21 -> 24.4.1
For the older versions, we will have to bump nodeJS
2 participants
Describe the Problem
When, for some reason, OCP failed to inject the CA list to our pods, noobaa-core/endpoint would start with an empty list of CAs instead of the system defaults - this fix is supposed to fix this.
Explain the Changes
Issues: Fixed #xxx / Gap #xxx
Testing Instructions:
Summary by CodeRabbit