Better error for invalid certificate.

mirrord/cli/src/connection.rs

@@ -164,9 +164,12 @@ where
         .await
         .map_err(|error| CliError::auth_exec_error_or(error, CliError::CreateAgentFailed))?;
 
-    if let Err(error) = k8s_api.detect_openshift(progress).await {
-        tracing::debug!(?error, "Failed to detect OpenShift");
-    };
+    k8s_api
+        .detect_openshift(progress)
+        .await
+        .map_err(|fail| CliError::auth_exec_error_or(fail, CliError::CreateAgentFailed))
+        .inspect_err(|fail| tracing::debug!(?fail, "Failed to detect OpenShift!"))
+        .ok();
 
     let agent_connect_info = tokio::time::timeout(
         Duration::from_secs(config.agent.startup_timeout),

mirrord/cli/src/error.rs

@@ -187,6 +187,15 @@ pub(crate) enum CliError {
     ))]
     AgentConnectionFailed(KubeApiError),
 
+    /// Friendlier version of the invalid certificate error that comes from a
+    /// [`kube::Error::Service`].
+    #[error("Kube API operation failed due to missing or invalid certificate: {0}")]
+    #[diagnostic(help(
+        r"1. Consider enabling `accept_invalid_certificates` in your `mirrord.json`, or;
+          2. Running `mirrord exec` with the `-c` flag."
+    ))]
+    InvalidCertificate(KubeApiError),
+
     #[error("Failed to communicate with the agent: {0}")]
     #[diagnostic(help("Please check agent status and logs.{GENERAL_HELP}"))]
     InitialAgentCommFailed(String),
@@ -400,7 +409,12 @@ impl CliError {
 
         match error {
             KubeApiError::KubeError(Error::Auth(AuthError::AuthExec(error))) => {
-                Self::KubeAuthExecFailed(error)
+                Self::KubeAuthExecFailed(error.to_owned())
+            }
+            KubeApiError::KubeError(Error::Service(ref fail))
+                if fail.to_string().contains("InvalidCertificate") =>
+            {
+                Self::InvalidCertificate(error)
             }
             error => fallback(error),
         }

mirrord/kube/src/error.rs

@@ -7,7 +7,9 @@ pub type Result<T, E = KubeApiError> = std::result::Result<T, E>;
 
 #[derive(Debug, Error)]
 pub enum KubeApiError {
-    #[error("Kube failed: {0}")]
+    /// We manually implement `From<kube::Error>` to give a better error in case of
+    /// kube failing due to an invalid certificate.
+    #[error(transparent)]
     KubeError(#[from] kube::Error),
 
     #[error("Connection to agent failed: {0}")]