Merge pull request #713 from helgi/fingerprint_k8s

fix(scheduler): use CA cert to verify API SSL certficiate

Author: helgi

rootfs/deis/settings.py

@@ -254,6 +254,8 @@
 # default scheduler settings
 SCHEDULER_MODULE = 'scheduler'
 SCHEDULER_URL = "https://{}:{}".format(
+    # accessing the k8s api server by IP address rather than hostname avoids
+    # intermittent DNS errors
     os.environ.get('KUBERNETES_SERVICE_HOST', 'kubernetes.default.svc.cluster.local'),
     os.environ.get('KUBERNETES_SERVICE_PORT', '443')
 )

rootfs/scheduler/__init__.py

@@ -337,11 +337,7 @@ def __init__(self):
             'Content-Type': 'application/json',
             'User-Agent': user_agent('Deis Controller', deis_version)
         }
-        # TODO: accessing the k8s api server by IP address rather than hostname avoids
-        # TODO look at https://toolbelt.readthedocs.org/en/latest/adapters.html#fingerprintadapter
-        # intermittent DNS errors, but at the price of disabling cert verification.
-        # session.verify = '/var/run/secrets/kubernetes.io/serviceaccount/ca.crt'
-        session.verify = False
+        session.verify = '/var/run/secrets/kubernetes.io/serviceaccount/ca.crt'
         self.session = session
 
     def deploy(self, namespace, name, image, command, **kwargs):  # noqa