Make build command creates a image that cannot connect to GCS

[aamarques]

Hi,
I'm trying to create a Thanos image (as company policy, we need to compile from the source).
Basically, I'm have a docker-compose.yml and a Dockerfile using golang to run make build.
Until here, everything works on build.
But when I try to use this image in a deploy that works with thanos docker official image. (Prometheus/SideCar/Querier/Storage (to GCS)/ Compactor), Thanos Store can't sync with GCS.

Resuming: Works with official image ( quay.io/thanos/thanos:v0.24.0) and not with built image (using make build)

Dockerfile

FROM golang:1.17-alpine as builder
ARG GOPATH
ARG CGO_ENABLED
ARG GO111MODULE

RUN true \
    && apk add --no-cache alpine-sdk

ADD . /go/thanos/
WORKDIR $GOPATH/thanos/thanos
RUN RUN git update-index --refresh; make build

FROM debian:buster

COPY --from=builder /go/bin/thanos /bin/thanos
COPY --from=builder /go/thanos/thanos/MAINTAINERS.md /licenses/MAINTAINERS.md
COPY --from=builder /go/thanos/thanos/LICENSE /licenses/LICENSE
COPY --from=builder /go/thanos/thanos/VERSION /licenses/VERSION

ENTRYPOINT ["/bin/thanos"]

thanos_store        | level=info ts=2022-03-04T14:57:39.926006179Z caller=intrumentation.go:56 msg="changing probe status" status=ready
thanos_store        | level=info ts=2022-03-04T14:57:39.927120624Z caller=grpc.go:131 service=gRPC/server component=store msg="listening for serving gRPC" address=0.0.0.0:19191
thanos_store        | level=info ts=2022-03-04T14:57:39.927220356Z caller=http.go:103 service=http/server component=store msg="internal server is shutdown gracefully" err="bucket store initial sync: sync block: BaseFetcher: iter bucket: Get \"https://storage.googleapis.com/storage/v1/b/myproject-thanos/o?alt=json&delimiter=%2F&pageToken=&prefix=&prettyPrint=false&projection=full&versions=false\": oauth2: cannot fetch token: Post \"https://oauth2.googleapis.com/token\": x509: certificate signed by unknown authority"
thanos_store        | level=info ts=2022-03-04T14:57:39.927611464Z caller=intrumentation.go:81 msg="changing probe status" status=not-healthy reason="bucket store initial sync: sync block: BaseFetcher: iter bucket: Get \"https://storage.googleapis.com/storage/v1/b/myproject-thanos/o?alt=json&delimiter=%2F&pageToken=&prefix=&prettyPrint=false&projection=full&versions=false\": oauth2: cannot fetch token: Post \"https://oauth2.googleapis.com/token\": x509: certificate signed by unknown authority"
thanos_store        | level=warn ts=2022-03-04T14:57:39.928207094Z caller=intrumentation.go:67 msg="changing probe status" status=not-ready reason="bucket store initial sync: sync block: BaseFetcher: iter bucket: Get \"https://storage.googleapis.com/storage/v1/b/myproject-thanos/o?alt=json&delimiter=%2F&pageToken=&prefix=&prettyPrint=false&projection=full&versions=false\": oauth2: cannot fetch token: Post \"https://oauth2.googleapis.com/token\": x509: certificate signed by unknown authority"
thanos_store        | level=info ts=2022-03-04T14:57:39.928248579Z caller=grpc.go:138 service=gRPC/server component=store msg="internal server is shutting down" err="bucket store initial sync: sync block: BaseFetcher: iter bucket: Get \"https://storage.googleapis.com/storage/v1/b/myproject-thanos/o?alt=json&delimiter=%2F&pageToken=&prefix=&prettyPrint=false&projection=full&versions=false\": oauth2: cannot fetch token: Post \"https://oauth2.googleapis.com/token\": x509: certificate signed by unknown authority"
thanos_store        | level=info ts=2022-03-04T14:57:39.928315243Z caller=grpc.go:151 service=gRPC/server component=store msg="gracefully stopping internal server"
thanos_store        | level=info ts=2022-03-04T14:57:39.92875303Z caller=grpc.go:164 service=gRPC/server component=store msg="internal server is shutdown gracefully" err="bucket store initial sync: sync block: BaseFetcher: iter bucket: Get \"https://storage.googleapis.com/storage/v1/b/myproject-thanos/o?alt=json&delimiter=%2F&pageToken=&prefix=&prettyPrint=false&projection=full&versions=false\": oauth2: cannot fetch token: Post \"https://oauth2.googleapis.com/token\": x509: certificate signed by unknown authority"
thanos_store        | level=error ts=2022-03-04T14:57:39.929201331Z caller=main.go:158 err="Get \"https://storage.googleapis.com/storage/v1/b/myproject-thanos/o?alt=json&delimiter=%2F&pageToken=&prefix=&prettyPrint=false&projection=full&versions=false\": oauth2: cannot fetch token: Post \"https://oauth2.googleapis.com/token\": x509: certificate signed by unknown authority\nBaseFetcher: iter bucket\ngithub.com/thanos-io/thanos/pkg/block.(*BaseFetcher).fetchMetadata\n\t/go/thanos/thanos/pkg/block/fetcher.go:375\ngithub.com/thanos-io/thanos/pkg/block.(*BaseFetcher).fetch.func2\n\t/go/thanos/thanos/pkg/block/fetcher.go:439\ngithub.com/golang/groupcache/singleflight.(*Group).Do\n\t/go/pkg/mod/github.com/golang/[email protected]/singleflight/singleflight.go:56\ngithub.com/thanos-io/thanos/pkg/block.(*BaseFetcher).fetch\n\t/go/thanos/thanos/pkg/block/fetcher.go:437\ngithub.com/thanos-io/thanos/pkg/block.(*MetaFetcher).Fetch\n\t/go/thanos/thanos/pkg/block/fetcher.go:497\ngithub.com/thanos-io/thanos/pkg/store.(*BucketStore).SyncBlocks\n\t/go/thanos/thanos/pkg/store/bucket.go:457\ngithub.com/thanos-io/thanos/pkg/store.(*BucketStore).InitialSync\n\t/go/thanos/thanos/pkg/store/bucket.go:526\nmain.runStore.func3\n\t/go/thanos/thanos/cmd/thanos/store.go:366\ngithub.com/oklog/run.(*Group).Run.func1\n\t/go/pkg/mod/github.com/oklog/[email protected]/group.go:38\nruntime.goexit\n\t/usr/local/go/src/runtime/asm_amd64.s:1581\nsync block\ngithub.com/thanos-io/thanos/pkg/store.(*BucketStore).InitialSync\n\t/go/thanos/thanos/pkg/store/bucket.go:527\nmain.runStore.func3\n\t/go/thanos/thanos/cmd/thanos/store.go:366\ngithub.com/oklog/run.(*Group).Run.func1\n\t/go/pkg/mod/github.com/oklog/[email protected]/group.go:38\nruntime.goexit\n\t/usr/local/go/src/runtime/asm_amd64.s:1581\nbucket store initial sync\nmain.runStore.func3\n\t/go/thanos/thanos/cmd/thanos/store.go:368\ngithub.com/oklog/run.(*Group).Run.func1\n\t/go/pkg/mod/github.com/oklog/[email protected]/group.go:38\nruntime.goexit\n\t/usr/local/go/src/runtime/asm_amd64.s:1581\nstore command failed\nmain.main\n\t/go/thanos/thanos/cmd/thanos/main.go:158\nruntime.main\n\t/usr/local/go/src/runtime/proc.go:255\nruntime.goexit\n\t/usr/local/go/src/runtime/asm_amd64.s:1581"
thanos_store exited with code 1

What I'm doing work ?

Cheers
AM