<p><strong>Summary</strong></p>

<p>I have a flask application deployed to Kubernetes with python 2.7.12, Flask 0.12.2 and using requests library. I'm getting a SSLError while using requests.session to send a POST Request inside the container. When using requests sessions to connect to a https url , requests throws a SSLError</p>

<p><strong>Some background</strong></p>

<ul>
<li>I have not added any certificates</li>
<li>The project works when I run a docker image locally but after deployment to kubernetes, from inside the container - the post request is not being sent to the url
verify=false does not work either</li>
</ul>

<p><strong>System Info</strong> - What I am using:
Python 2.7.12, Flask==0.12.2, Kubernetes, python-requests-2.18.4</p>

<p><strong>Expected Result</strong></p>

<p>Get HTTP Response code 200 after sending a POST request</p>

<p><strong>Error Logs</strong></p>

<pre><code>r = adapter.send(request, **kwargs)
File "/usr/local/lib/python2.7/site-packages/requests/adapters.py", line 511, in send
raise SSLError(e, request=request)
SSLError: HTTPSConnectionPool(host='dev.domain.nl', port=443): Max retries exceeded with url: /ingestion?LrnDevEui=0059AC0000152A03&amp;LrnFPort=1&amp;LrnInfos=TWA_100006356.873.AS-1-135680630&amp;AS_ID=testserver&amp;Time=2018-06-22T11%3A41%3A08.163%2B02%3A00&amp;Token=1765b08354dfdec (Caused by SSLError(SSLEOFError(8, u'EOF occurred in violation of protocol (_ssl.c:661)'),))
</code></pre>

<p>/usr/local/lib/python2.7/site-packages/urllib3/connectionpool.py:858: InsecureRequestWarning: Unverified HTTPS request is being made. Adding certificate verification is strongly advised. See: <a href="https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings" rel="nofollow noreferrer">https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings</a>
  InsecureRequestWarning)</p>

<p><strong>Reproduction Steps</strong></p>

<pre><code>import requests
from flask import Flask, request, jsonify
from requests import Request, Session

sess = requests.Session()
adapter = requests.adapters.HTTPAdapter(max_retries = 200)
sess.mount('http://', adapter)
sess.mount('https://', adapter)
sess.cert ='/usr/local/lib/python2.7/site-packages/certifi/cacert.pem'


def test_post():
    url = 'https://dev.domain.nl/ingestion/?'
    header = {'Content-Type': 'application/json', 'Accept': 'application/json'}
    response = sess.post(url, headers= header, params= somepara, data= json.dumps(data),verify=True)
    print response.status_code
    return response.status_code

def main():
    threading.Timer(10.0, main).start()
    test_post()

if __name__ == '__main__':
    main()
    app.run(host="0.0.0.0", debug=True, port=5001, threaded=True)
</code></pre>

<p>Docker File</p>

<pre><code>FROM python:2.7-alpine
COPY ./web /web
WORKDIR /web
RUN pip install -r requirements.txt

ENV FLASK_APP app.py

EXPOSE 5001
EXPOSE 443

CMD ["python", "app.py"]
</code></pre>

<p>The problem may be in the Alpine Docker image that lacks CA certificates. On your laptop code works as it uses CA certs from you local workstation. I would think that running Docker image locally will fail too - so the problem is not k8s.</p>

<p>Try to add the following line to the Dockerfile:</p>

<pre><code>RUN apk update &amp;&amp; apk add ca-certificates &amp;&amp; rm -rf /var/cache/apk/*
</code></pre>

<p>It will install CA certs inside the container. </p>
