ExternalName for S3 endpoint in Kubernetes with AWS SDK

4/6/2020

I'm trying to use the AWS S3 SDK for Java to connect to a bucket from a Kubernetes pod running an Spring Boot application. In order to get external access I had to create a service as follows:

kind: Service
apiVersion: v1
metadata:
  name: s3
  namespace: production
spec:
  type: ExternalName
  externalName: nyc3.digitaloceanspaces.com

And then I modified my configuration in application.properties specifying the endpoint:

cloud.aws.endpoint=s3
cloud.aws.credentials.accessKey=ASD
cloud.aws.credentials.secretKey=123
cloud.aws.credentials.instanceProfile=true
cloud.aws.credentials.useDefaultAwsCredentialsChain=true

Because the SDK builds the host name for the bucket as bucket.s3... I modified my client to use "path style" access with this configuration:

@Bean(name = "amazonS3")
public AmazonS3Client amazonS3Client(AWSCredentialsProvider credentialsProvider,
        RegionProvider regionProvider) {

    EndpointConfiguration endpointConfiguration = new EndpointConfiguration(
            endpoint, regionProvider.getRegion().getName());

    return (AmazonS3Client) AmazonS3ClientBuilder.standard()
                                .withCredentials(credentialsProvider)
                                .withEndpointConfiguration(endpointConfiguration)
                                .withPathStyleAccessEnabled(true)
                                .build();
}

But when I try to perform any bucket operation I get the following error regarding the name mismatch with the SSL certificate:

javax.net.ssl.SSLPeerUnverifiedException: Certificate for <s3> doesn't match any of the subject alternative names: [*.nyc3.digitaloceanspaces.com, nyc3.digitaloceanspaces.com]

How can I avoid this certificate error?

-- JoaquĆ­n L. Robles
amazon-s3
amazon-web-services
kubernetes
spring-boot
spring-cloud

0 Answers