#1573 [Core feature] Support SSL certificate validation using custom root CA certificates in Flytekit Remote API Issue created by AdrianoKF Motivation: Why do you think this is important? Currently, the Flytekit Remote API only supports two connection modes to the admin deployment: 1. Full secure SSL certificate validation based on the set of trusted CA root certificates bundled with gRPC, or 2. setting

insecure=True

, disabling HTTPS completely. Goal: What should the final outcome look like, ideally? Ideally, there should be a middle ground between these two extremes, e.g. allowing users of certificates issued by private CAs to validate certificates used for Flyte deployments accessed through the Remote API. Based on discussions on Slack (see here), I propose to add functionality to the Remote API to pass custom root certificates used for validation. This functionality could also be used to expand the sandbox cluster deployment with cert-manager and an ingress controller in the future, to move the sandbox closer to how a production deployment of Flyte could look in practice. Describe alternatives you've considered gRPC provides the

GRPC_DEFAULT_SSL_ROOTS_FILE_PATH

environment variable to override the trust root. However, this approach might not desirable depending on the usage scenario, since it affects every gRPC client which can see this variable. Propose: Link/Inline OR Additional context My proposal would be to add an optional

grpc_credentials

kwarg (of type `grpc.ChannelCredentials`) to the constructor of

FlyteRemote

, which will be passed on to the

RawSynchronousFlyteClient

instance, which already exposes a similar argument. Leaving out this argument would default to the current implementation, which would prevent incompatible changes with the current behavior. I have a local patch ready, which I need to add some tests to and then can submit as a MR for this issue. ☑︎ Are you sure this issue hasn't been raised already? ☑︎ Have you read the Code of Conduct? flyteorg/flyte