podman not aware of local certificate bundle

[nmerket]

Is this a BUG REPORT or FEATURE REQUEST? (leave only one on its own line)

/kind bug

Description

Related to #2726

I am trying to use podman on a network at my organization where all ssl traffic is signed by a company certificate. I have the certificates installed locally and in the following environment variables:

• SSL_CERT_FILE
• SSL_CERT_DIR
• AWS_CA_BUNDLE
• REQUESTS_CA_BUNDLE

All the bundles point to a pem file that has a working cert in it.

Steps to reproduce the issue:

1. Clean install of podman 4.3.0

2. podman pull redis:alpine or any image really

Describe the results you received:

Resolving "redis" using unqualified-search registries (/etc/containers/registries.conf.d/999-podman-machine.conf)
Trying to pull docker.io/library/redis:alpine...
Error: copying system image from manifest list: parsing image configuration: Get "https://production.cloudflare.docker.com/registry-v2/docker/registry/v2/blobs/sha256/39/39267c75a2300e96dc84d36e4d38affa75e70aabe8a4464db69cd8f9ba53ba13/data?verify=1667580604-V89M%2FWg7JlqU11%2Bd8o00TTxOnLE%3D": x509: certificate signed by unknown authority

Describe the results you expected:

Image to pull successfully.

Additional information you deem important (e.g. issue happens only occasionally):

Output of podman version:

Client:       Podman Engine
Version:      4.3.0
API Version:  4.3.0
Go Version:   go1.18.7
Built:        Tue Oct 18 11:55:57 2022
OS/Arch:      darwin/arm64

Server:       Podman Engine
Version:      4.3.0
API Version:  4.3.0
Go Version:   go1.18.7
Built:        Fri Oct 21 02:12:52 2022
OS/Arch:      linux/arm64

Output of podman info:

host:
  arch: arm64
  buildahVersion: 1.28.0
  cgroupControllers:
  - cpu
  - io
  - memory
  - pids
  cgroupManager: systemd
  cgroupVersion: v2
  conmon:
    package: conmon-2.1.4-3.fc36.aarch64
    path: /usr/bin/conmon
    version: 'conmon version 2.1.4, commit: '
  cpuUtilization:
    idlePercent: 99.79
    systemPercent: 0.13
    userPercent: 0.08
  cpus: 8
  distribution:
    distribution: fedora
    variant: coreos
    version: "36"
  eventLogger: journald
  hostname: localhost.localdomain
  idMappings:
    gidmap:
    - container_id: 0
      host_id: 1000
      size: 1
    - container_id: 1
      host_id: 100000
      size: 1000000
    uidmap:
    - container_id: 0
      host_id: 1049320534
      size: 1
    - container_id: 1
      host_id: 100000
      size: 1000000
  kernel: 6.0.5-200.fc36.aarch64
  linkmode: dynamic
  logDriver: journald
  memFree: 11450146816
  memTotal: 12507676672
  networkBackend: netavark
  ociRuntime:
    name: crun
    package: crun-1.6-2.fc36.aarch64
    path: /usr/bin/crun
    version: |-
      crun version 1.6
      commit: 18cf2efbb8feb2b2f20e316520e0fd0b6c41ef4d
      spec: 1.0.0
      +SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +CRIU +YAJL
  os: linux
  remoteSocket:
    exists: true
    path: /run/user/1049320534/podman/podman.sock
  security:
    apparmorEnabled: false
    capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
    rootless: true
    seccompEnabled: true
    seccompProfilePath: /usr/share/containers/seccomp.json
    selinuxEnabled: true
  serviceIsRemote: true
  slirp4netns:
    executable: /usr/bin/slirp4netns
    package: slirp4netns-1.2.0-0.2.beta.0.fc36.aarch64
    version: |-
      slirp4netns version 1.2.0-beta.0
      commit: 477db14a24ff1a3de3a705e51ca2c4c1fe3dda64
      libslirp: 4.6.1
      SLIRP_CONFIG_VERSION_MAX: 3
      libseccomp: 2.5.3
  swapFree: 0
  swapTotal: 0
  uptime: 0h 57m 48.00s
plugins:
  authorization: null
  log:
  - k8s-file
  - none
  - passthrough
  - journald
  network:
  - bridge
  - macvlan
  volume:
  - local
registries:
  search:
  - docker.io
store:
  configFile: /var/home/core/.config/containers/storage.conf
  containerStore:
    number: 0
    paused: 0
    running: 0
    stopped: 0
  graphDriverName: overlay
  graphOptions: {}
  graphRoot: /var/home/core/.local/share/containers/storage
  graphRootAllocated: 321574121472
  graphRootUsed: 7726194688
  graphStatus:
    Backing Filesystem: xfs
    Native Overlay Diff: "true"
    Supports d_type: "true"
    Using metacopy: "false"
  imageCopyTmpDir: /var/tmp
  imageStore:
    number: 12
  runRoot: /run/user/1049320534/containers
  volumePath: /var/home/core/.local/share/containers/storage/volumes
version:
  APIVersion: 4.3.0
  Built: 1666339972
  BuiltTime: Fri Oct 21 02:12:52 2022
  GitCommit: ""
  GoVersion: go1.18.7
  Os: linux
  OsArch: linux/arm64
  Version: 4.3.0

Package info (e.g. output of rpm -q podman or apt list podman or brew info podman):

==> podman: stable 4.3.0 (bottled), HEAD
Tool for managing OCI containers and pods
https://podman.io/
/opt/homebrew/Cellar/podman/4.3.0 (185 files, 47.6MB) *
  Poured from bottle on 2022-11-03 at 17:17:58
From: https://github.com/Homebrew/homebrew-core/blob/HEAD/Formula/podman.rb
License: Apache-2.0 and GPL-3.0-or-later
==> Dependencies
Build: go-md2man, [email protected]
Required: qemu
==> Options
--HEAD
	Install HEAD version
==> Caveats
zsh completions have been installed to:
  /opt/homebrew/share/zsh/site-functions

To restart podman after an upgrade:
  brew services restart podman
Or, if you don't want/need a background service you can just run:
  /opt/homebrew/opt/podman/bin/podman system service --time=0
==> Analytics
install: 27,240 (30 days), 75,620 (90 days), 223,367 (365 days)
install-on-request: 26,078 (30 days), 73,049 (90 days), 220,331 (365 days)
build-error: 18 (30 days)

Have you tested with the latest version of Podman and have you checked the Podman Troubleshooting Guide? (https://github.com/containers/podman/blob/main/troubleshooting.md)

Yes

Additional environment details (AWS, VirtualBox, physical, etc.):

Mac OS 12.6.1
M1 Max

[mheon]

@baude @ashley-cui PTAL

[github-actions]

A friendly reminder that this issue had no activity for 30 days.

[rhatdan]

@ashley-cui Any comment? I thought this was taken care of during machine init?

[ashley-cui]

This PR fixed getting SSL_CERT_FILE and SSL_CERT_DIR into the VM, but the values in AWS_CA_BUNDLE and REQUESTS_CA_BUNDLE seem niche enough that we haven't propagated them by default.

#16457

[rhatdan]

So can I close this issue?

[github-actions]

A friendly reminder that this issue had no activity for 30 days.