KEDA扩容时TLS证书异常：从AKS迁移至GKE后无法连接RabbitMQ

问题原因 #

AKS与GKE节点默认维护的根证书信任池存在差异，AKS环境中已包含RabbitMQ证书的签发CA，而GKE节点未将该CA纳入信任列表，导致KEDA发起HTTPS请求时无法验证RabbitMQ的证书合法性，抛出x509: certificate signed by unknown authority错误。

解决方案 #

1. 给KEDA Operator注入RabbitMQ CA证书（生产环境推荐） #

通过将RabbitMQ的CA证书挂载到KEDA Operator容器的证书信任目录，让KEDA能识别并信任RabbitMQ的证书：

• 第一步：创建存储CA证书的Secret

  kubectl create secret generic rabbitmq-ca --from-file=ca.crt=/本地路径/rabbitmq-ca.crt
  

• 第二步：修改KEDA Operator的Deployment，添加证书挂载配置
  找到KEDA的Operator Deployment（通常名为keda-operator），添加以下volumes和volumeMounts配置：

  spec:
    template:
      spec:
        volumes:
        - name: rabbitmq-ca
          secret:
            secretName: rabbitmq-ca
        containers:
        - name: keda-operator
          volumeMounts:
          - name: rabbitmq-ca
            mountPath: /etc/ssl/certs/rabbitmq-ca.crt
            subPath: ca.crt
            readOnly: true
  

  若KEDA使用的镜像需要更新证书缓存，可在容器启动命令中添加update-ca-certificates（部分基础镜像支持）。

2. 临时跳过证书验证（仅测试环境使用） #

如果是测试环境，可临时关闭证书验证快速排查问题，但生产环境禁止使用：
在你的ScaledObject配置的RabbitMQ触发器中添加skipVerify: "true"参数：

apiVersion: keda.sh/v1alpha1
kind: ScaledObject
metadata:
  name: your-scaledobject
spec:
  scaleTargetRef:
    name: your-deployment
  triggers:
  - type: rabbitmq
    metadata:
      host: "$(KEDA_RABBITMQ_HOST)"
      queueName: "<queue_name>"
      vHost: "<vhost>"
      skipVerify: "true" # 添加这一行
    authenticationRef:
      name: keda-trigger-auth-rabbitmq

3. 全局更新GKE节点的根证书池 #

若需要让集群内所有Pod都信任该CA，可通过DaemonSet在所有GKE节点上更新根证书：

• 创建一个DaemonSet，挂载节点的/etc/ssl/certs目录，将CA证书复制到该目录并执行update-ca-certificates命令。示例配置：

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: update-ca-certificates
spec:
  selector:
    matchLabels:
      name: update-ca
  template:
    metadata:
      labels:
        name: update-ca
    spec:
      containers:
      - name: update-ca
        image: ubuntu:latest
        command: ["sh", "-c", "cp /ca/ca.crt /usr/local/share/ca-certificates/ && update-ca-certificates"]
        volumeMounts:
        - name: ca-cert
          mountPath: /ca
        - name: host-certs
          mountPath: /usr/local/share/ca-certificates
        - name: host-etc-certs
          mountPath: /etc/ssl/certs
      volumes:
      - name: ca-cert
        secret:
          secretName: rabbitmq-ca
      - name: host-certs
        hostPath:
          path: /usr/local/share/ca-certificates
      - name: host-etc-certs
        hostPath:
          path: /etc/ssl/certs
      restartPolicy: OnFailure

内容的提问来源于stack exchange，提问作者ron.thakkar