Launcher behind company firewall¶

Use this guide when you run AntFlow Launcher on Kubernetes and launcher pods must call AntFlow Server and object storage through company-managed HTTPS.

This usually means one of these cases:

• traffic goes through a corporate proxy with TLS inspection
• AntFlow or object storage endpoints use a company-issued certificate

AntFlow needs a bucket on an S3-compatible object storage service for data and results. If launcher pods do not trust the company CA chain, requests fail even when DNS and routing are correct.

Typical TLS errors:

• x509: certificate signed by unknown authority
• SSL certificate problem
• certificate verify failed

What to configure¶

Use a mutation policy to inject the company CA bundle into matching pods automatically.

Set the certificate variables so each client stack uses the injected CA bundle:

• SSL_CERT_FILE
• REQUESTS_CA_BUNDLE
• AWS_CA_BUNDLE

Before getting started¶

1. Ensure that the CA certificate is present on each node. In the policy below, the certificate is expected at /etc/ssl/certs/ca-bundle.crt.
2. Install Kyverno.

Kyverno policy¶

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: inject-ca
spec:
  rules:
    - name: inject-ca
      match:
        all:
          - resources:
              kinds:
                - Pod
              namespace:
                - antflow
              selector:
                matchExpressions:
                  - key: job-name
                    operator: Exists
      mutate:
        patchStrategicMerge:
          spec:
            volumes:
              - name: ca-bundle
                hostPath:
                  path: /etc/ssl/certs/ca-bundle.crt
                  type: File
            containers:
              - (name): "*"
                volumeMounts:
                  - name: ca-bundle
                    mountPath: /etc/ssl/certs/ca-bundle.crt
                env:
                  - name: REQUESTS_CA_BUNDLE
                    value: /etc/ssl/certs/ca-bundle.crt
                  - name: SSL_CERT_FILE
                    value: /etc/ssl/certs/ca-bundle.crt
                  - name: AWS_CA_BUNDLE
                    value: /etc/ssl/certs/ca-bundle.crt

This gives you a repeatable cluster-level fix without rebuilding each job image.

Takeaway¶

If the workload must call AntFlow, an S3-compatible object storage service, or another HTTPS service behind a corporate proxy or company certificate, the container needs the company CA and the matching certificate variables.