<p>I have a node application running in a container that works well when I run it locally on docker. </p>

<p>When I try to run it in my k8 cluster, I get the following error.</p>

<pre><code> kubectl -n some-namespace logs --follow my-container-5d7dfbf876-86kv7
&gt; code@1.0.0 my-container /src
&gt; node src/app.js
Error: unable to get local issuer certificate
    at TLSSocket.onConnectSecure (_tls_wrap.js:1486:34)
    at TLSSocket.emit (events.js:315:20)
    at TLSSocket._finishInit (_tls_wrap.js:921:8)
    at TLSWrap.ssl.onhandshakedone (_tls_wrap.js:695:12) {
  code: 'UNABLE_TO_GET_ISSUER_CERT_LOCALLY'
}
</code></pre>

<p>This is strange as the only I run the container with </p>

<pre><code>        command: ["npm", "run", "consumer"]
</code></pre>

<p>I have also tried adding to my Dockerfile </p>

<pre><code>npm config set strict-ssl false
</code></pre>

<p>as per the recommendation here: <a href="https://stackoverflow.com/questions/36494336/npm-install-error-unable-to-get-local-issuer-certificate">npm install error - unable to get local issuer certificate</a> but it doesn't seem to help.</p>

<p>So it should be trying to authenticate this way.</p>

<p>I would appreciate any pointers on this.</p>

<p>Here is a copy of my .yaml file for completeness. </p>

<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    name: label
  name: label
  namespace: some-namespace
spec:
  replicas: 1
  selector:
    matchLabels:
      name: lable
  template:
    metadata:
      labels:
          name: label
    spec:
      containers:
      - name: label
        image: some-registry:latest
        resources:
          limits:
            memory: 7000Mi
            cpu: '3'
        ports:
          - containerPort: 80 
        command: ["npm", "run", "application"]
        env:
          - name: "DATABASE_URL"
            valueFrom:
              secretKeyRef:
                name: postgres
                key: DBUri
          - name: "DEBUG"
            value: "*,-babel,-mongo:*,mongo:queries,-http-proxy-agent,-https-proxy-agent,-proxy-agent,-superagent,-superagent-proxy,-sinek*,-kafka*"
          - name: "ENV"
            value: "production"
          - name: "NODE_ENV"
            value: "production"
          - name: "SERVICE"
            value: "consumer"
        volumeMounts:
          - name: certs
            mountPath: /etc/secrets
            readOnly: true
      volumes:
        - name: certs
          secret:
            secretName: certs
            items:
            - key: certificate
              path: certificate
            - key: key
              path: key
</code></pre>

0xsegfault
<p>It looks that the pod is not mounting the secrets in the right place. Make sure that .spec.volumeMounts.mountPath is pointing on the right path for the container image.</p>
