chore: [Running GitHub actions for #9378]#9846
Open
justin-tahara wants to merge 5 commits intomainfrom
Open
Conversation
Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Contributor
Greptile SummaryThis PR adds a new opt-in Key changes:
Issue found:
Confidence Score: 4/5
Important Files Changed
Flowchart%%{init: {'theme': 'neutral'}}%%
flowchart TD
A[Container Starts] --> B{api.runUpdateCaCertificates?}
B -- true --> C[update-ca-certificates\nupdates /etc/ssl/certs/ca-certificates.crt]
B -- false --> D[alembic upgrade head]
C --> D
D --> E[uvicorn starts API Server]
subgraph gap[⚠️ Not covered by this PR]
F[Celery Worker Containers\ndocfetching / docprocessing / primary / etc.]
F --> G[Make outbound HTTPS calls\nto indexed data sources]
G --> H[❌ /etc/ssl/certs/ca-certificates.crt\nnever updated — custom CA missing]
end
subgraph pyclient[Python HTTP Client Behaviour]
I[requests / httpx\nuse certifi bundle by default]
I --> J{REQUESTS_CA_BUNDLE\nor SSL_CERT_FILE set?}
J -- yes --> K[Use system CA bundle\nCustom CA works ✅]
J -- no --> L[Use certifi bundle\nCustom CA missing ❌]
end
E --> I
Prompt To Fix All With AIThis is a comment left during a code review.
Path: deployment/helm/charts/onyx/templates/api-deployment.yaml
Line: 70-72
Comment:
**Custom CA update limited to API server only**
`update-ca-certificates` is only wired into the API deployment, but the Celery workers (`celery-worker-docfetching`, `celery-worker-docprocessing`, `celery-worker-primary`, etc.) also run Python and make outbound HTTPS requests to user-configured data sources during indexing. If a user mounts a custom CA and enables `runUpdateCaCertificates: true`, the system CA bundle at `/etc/ssl/certs/ca-certificates.crt` is updated **only** in the API container. The Celery worker containers share the same image but never run `update-ca-certificates`, so their CA bundle is unchanged.
Combined with the documented requirement to set `REQUESTS_CA_BUNDLE`/`SSL_CERT_FILE` (which point to the system bundle), this creates a situation where:
- **API server**: custom CA works ✅
- **Celery workers**: env vars point to system bundle, but system bundle was never updated → HTTPS calls to custom-CA-protected endpoints still fail ❌
The feature needs to be extended to the Celery worker templates (and potentially `mcp-server-deployment.yaml`) to be functionally complete for the primary use case (indexing from internal HTTPS sources).
How can I resolve this? If you propose a fix, please make it concise.Reviews (1): Last reviewed commit: "Update deployment/helm/charts/onyx/value..." | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
Comment on lines
+70
to
+72
| {{- if .Values.api.runUpdateCaCertificates }} | ||
| update-ca-certificates && | ||
| {{- end }} |
Contributor
There was a problem hiding this comment.
update-ca-certificates is only wired into the API deployment, but the Celery workers (celery-worker-docfetching, celery-worker-docprocessing, celery-worker-primary, etc.) also run Python and make outbound HTTPS requests to user-configured data sources during indexing. If a user mounts a custom CA and enables runUpdateCaCertificates: true, the system CA bundle at /etc/ssl/certs/ca-certificates.crt is updated only in the API container. The Celery worker containers share the same image but never run update-ca-certificates, so their CA bundle is unchanged.
Combined with the documented requirement to set REQUESTS_CA_BUNDLE/SSL_CERT_FILE (which point to the system bundle), this creates a situation where:
- API server: custom CA works ✅
- Celery workers: env vars point to system bundle, but system bundle was never updated → HTTPS calls to custom-CA-protected endpoints still fail ❌
The feature needs to be extended to the Celery worker templates (and potentially mcp-server-deployment.yaml) to be functionally complete for the primary use case (indexing from internal HTTPS sources).
Prompt To Fix With AI
This is a comment left during a code review.
Path: deployment/helm/charts/onyx/templates/api-deployment.yaml
Line: 70-72
Comment:
**Custom CA update limited to API server only**
`update-ca-certificates` is only wired into the API deployment, but the Celery workers (`celery-worker-docfetching`, `celery-worker-docprocessing`, `celery-worker-primary`, etc.) also run Python and make outbound HTTPS requests to user-configured data sources during indexing. If a user mounts a custom CA and enables `runUpdateCaCertificates: true`, the system CA bundle at `/etc/ssl/certs/ca-certificates.crt` is updated **only** in the API container. The Celery worker containers share the same image but never run `update-ca-certificates`, so their CA bundle is unchanged.
Combined with the documented requirement to set `REQUESTS_CA_BUNDLE`/`SSL_CERT_FILE` (which point to the system bundle), this creates a situation where:
- **API server**: custom CA works ✅
- **Celery workers**: env vars point to system bundle, but system bundle was never updated → HTTPS calls to custom-CA-protected endpoints still fail ❌
The feature needs to be extended to the Celery worker templates (and potentially `mcp-server-deployment.yaml`) to be functionally complete for the primary use case (indexing from internal HTTPS sources).
How can I resolve this? If you propose a fix, please make it concise.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR runs GitHub Actions CI for #9378.
This PR should be closed (not merged) after CI completes.
Summary by cubic
Adds an opt-in
api.runUpdateCaCertificatesflag to runupdate-ca-certificatesbefore the API starts, enabling custom CA bundles from mounted volumes. Supports Linear #9378; default is false, so no behavior change.New Features
update-ca-certificateswhenapi.runUpdateCaCertificates: true.Migration
/usr/local/share/ca-certificates/*.crtand run the container as root.requests,httpx), setREQUESTS_CA_BUNDLEandSSL_CERT_FILEto/etc/ssl/certs/ca-certificates.crt.Written for commit 41f057e. Summary will update on new commits.