Prisma Cloud Compute: X509 Certificate error for Registry Scanning on Openshift Container Platform

1056

Created On 05/29/23 22:28 PM - Last Modified 06/06/24 19:57 PM

Authentication Profile

OpenStack

Administration

Permissions/Access Management

Prisma Cloud Compute Registry Scanning

Certificate Management

Service Connections

Prisma Cloud Compute Vulnerability Manag

Self-Hosted 22.12

Prisma Cloud Compute Edition Self-Hosted

Symptom

Errors when attempting registry scanning of images located in AWS Cloud Elastic Container Registry (ECR) repository.
- ```
x509: certificate signed by unknown authority
```
- ```
Error:  Failed to pull image XXX
```

Environment

Prisma Cloud Compute Edition
- Self-hosted on OpenShift Container Platform
AWS Cloud
- Elastic Container Registry (ECR) repository
- AWS service account provides full access to the ECR repository (using the AmazonEC2ContainerRegistryFullAccess permission policy)

Cause

To ensure trust between parties in a secure communication session, Prisma Cloud compute uses digital certificates. Each certificate includes a digital signature to authenticate the identity of the issuer.
- The issuer must be in the list of trusted certificate authorities (CAs) of the authenticating party.
- If certificates cannot be found, the platform is unable to validate the session and is unable to pull images from the repository.
- Example of the error noticed:
```
 Error pinging docker registry default-route-openshift-image-registry.$domain.com: Get https://default-route-openshift-image-registry.apps.$domain.com/v2/: x509: certificate signed by unknown authority
```

Resolution

1. The procedure requires creation of a ConfigMap and add additional CAs as keys in the ConfigMap within openshift-config namespace in order to include PEM-encoded certificate.

$ oc create configmap registry-cas -n openshift-config \
--from-file=myregistry.corp.com..5000=/etc/docker/certs.d/myregistry.corp.com:5000/ca.crt \
--from-file=otherregistry.com=/etc/docker/certs.d/otherregistry.com/ca.crt

2. Next, update the cluster image configuration:

$ oc patch image.config.openshift.io/cluster --patch '{"spec":{"additionalTrustedCA":{"name":"registry-cas"}}}' --type=merge

3. One CA must be associated with each domain respectively. The ConfigMap name must be set in the image.config.openshift.io/cluster cluster scoped configuration resource’s spec.additionalTrustedCA field.

4. One must have access to the public certificates of the registry.

Usually a hostname /ca.crt file located in the /etc/docker/certs.d/ directory.

Additional Information