SSL Issue with Pinecone in Semantic Router

[clioo]

When integrating Pinecone with Semantic Router, we encountered an SSL issue that prevents secure communication with the Pinecone service when operating under Zscaler security. Disabling SSL verification (ssl_verify=False) temporarily bypasses the issue, but this is not a viable solution due to security concerns. Additionally, disabling Zscaler is not an option.

Steps to Reproduce:

1. Connect to Zscaler and run a Python container with Semantic Router installed within a Kubernetes cluster.
2. Requests to Pinecone fail with an SSL error, despite using the default system certificates as environment variables pointing to (/etc/ssl/certs/ca-certificates.crt).
3. Create a vanilla Pinecone client disabling ssl_verify allows the request to succeed, confirming an issue with certificate verification.
4. Add a Zscaler certificate to the container, updating the certificates, and specifying the new certificates in vanilla Pinecone client resolves the issue.

Findings:

• The way PineconeIndex initializes the Pinecone client currently prevents specifying custom SSL certificates or other necessary options.
• When running Semantic Router inside a container, adding the necessary certificates during the build process alone does not resolve the issue. Explicitly specifying the certificate in the Pinecone client initialization is required, but the current implementation does not allow for this customization.
  Proposed Solution:
• Modify Semantic Router to allow passing a custom Pinecone client, enabling users to explicitly configure SSL certificates and other necessary options.
• Ensure that Pinecone endpoints are properly configurable.
• Validate that the fix works both inside and outside Docker environments.
• Add unit tests to confirm proper SSL verification behavior and handling of custom certificates.

Would the maintainers be open to a PR addressing this issue? Let me know if any additional context is required. Thanks!

[jamescalam]

hi @clioo — thanks for raising the issue. The team unfortunately doesn't have active access to zscaler so we cannot confirm the behaviour but we can see that the custom SSL support it not currently implemented. If this is something you're able to contribute we'd be happy to review and merge.

Note that it's likely you'd need to add the SSL support to the pinecone client but also to the async pinecone calls, hope that helps!