Docker-compose + Kubernetes: backports.ssl_match_hostname.CertificateError

Question

I have a complete docker stack (source) which uses docker-compose.

It works fine by its own, but now I'm trying to deploy it in Kubernetes' Minikube and when after eval $(minikube docker-env) I try to run docker-compose up, it throws the following error:

backports.ssl_match_hostname.CertificateError: hostname '192.168.99.100' doesn't match 'localhost'

What am I missing?

---

This is the complete trace:

Traceback (most recent call last):

File "/usr/bin/docker-compose", line 9, in load_entry_point('docker-compose==1.8.0', 'console_scripts', 'docker-compose')()

File "/usr/lib/python2.7/dist-packages/compose/cli/main.py", line 61, in main command()

File "/usr/lib/python2.7/dist-packages/compose/cli/main.py", line 113, in perform_command handler(command, command_options)

File "/usr/lib/python2.7/dist-packages/compose/cli/main.py", line 835, in up remove_orphans=remove_orphans)

File "/usr/lib/python2.7/dist-packages/compose/project.py", line 372, in up warn_for_swarm_mode(self.client)

File "/usr/lib/python2.7/dist-packages/compose/project.py", line 539, in warn_for_swarm_mode info = client.info()

File "/usr/lib/python2.7/dist-packages/docker/api/daemon.py", line 33, in info return self._result(self._get(self._url("/info")), True)

File "/usr/lib/python2.7/dist-packages/docker/utils/decorators.py", line 47, in inner return f(self, *args, **kwargs)

File "/usr/lib/python2.7/dist-packages/docker/client.py", line 140, in _get return self.get(url, **self._set_request_timeout(kwargs))

File "/usr/lib/python2.7/dist-packages/requests/sessions.py", line 480, in get return self.request('GET', url, **kwargs)

File "/usr/lib/python2.7/dist-packages/requests/sessions.py", line 468, in request resp = self.send(prep, **send_kwargs)

File "/usr/lib/python2.7/dist-packages/requests/sessions.py", line 576, in send r = adapter.send(request, **kwargs)

File "/usr/lib/python2.7/dist-packages/requests/adapters.py", line 376, in send timeout=timeout

File "/usr/lib/python2.7/dist-packages/urllib3/connectionpool.py", line 560, in urlopen body=body, headers=headers)

File "/usr/lib/python2.7/dist-packages/urllib3/connectionpool.py", line 346, in _make_request self._validate_conn(conn)

File "/usr/lib/python2.7/dist-packages/urllib3/connectionpool.py", line 787, in _validate_conn conn.connect()

File "/usr/lib/python2.7/dist-packages/urllib3/connection.py", line 277, in connect match_hostname(cert, asserted_hostname)

File "/usr/lib/python2.7/dist-packages/backports/ssl_match_hostname/init.py", line 99, in match_hostname % (hostname, dnsnames[0]))

backports.ssl_match_hostname.CertificateError: hostname '192.168.99.100' doesn't match 'localhost'

Answer 1

It seems you have missed DNS. First, don't reference the device by IP, instead use a FQDN. If you need, you can set an entry for 192.168.99.100 in /etc/hosts for now. Secondly, type "hostname" on the node and verify it does not return "localhost" (it likely will). Then type "hostnamectl set-hostname newhostname.fullyqualified.com" and then regenerate and re-sign the certificate.

Answer 2

I don't have a proper solution to fix the certs, but a work-around is to make docker-compose not care about the mismatch as follows: CURL_CA_BUNDLE= docker-compose up