search

kubernetes-client / java

Official Java client library for kubernetes
http://kubernetes.io/
Apache License 2.0
3.54k stars 1.88k forks source link

CKR_SESSION_READ_ONLY in FIPS enabled environment #3621

Open florin-szilagyi opened 1 month ago

florin-szilagyi commented 1 month ago

Describe the bug Unable to connect to kubernetes in a fips enabled environment. Seems very similar to this: https://github.com/fabric8io/kubernetes-client/pull/3867

So I dug around a bit and it seems ApiClient is using the default keystore, instead of initializing it from the system one (as the fix was made here

Client Version 20.0.0

Kubernetes Version 1.28

Java Version Java 17

To Reproduce io.kubernetes.client.util.Config.fromCluster().getBasePath();

Expected behavior A clear and concise description of what you expected to happen.

Server (please complete the following information):

Additional context

sun.security.pkcs11.wrapper.PKCS11Exception: CKR_SESSION_READ_ONLY
    at sun.security.pkcs11.wrapper.PKCS11.C_CreateObject(PKCS11.java)
    at sun.security.pkcs11.wrapper.PKCS11.C_CreateObject(PKCS11.java:1961)
    at sun.security.pkcs11.P11KeyStore.storeCert(P11KeyStore.java:1567)
    at sun.security.pkcs11.P11KeyStore.engineSetEntry(P11KeyStore.java:1045)
    ... 99 common frames omitted
Wrapped by: java.security.KeyStoreException: sun.security.pkcs11.wrapper.PKCS11Exception: CKR_SESSION_READ_ONLY
    at sun.security.pkcs11.P11KeyStore.engineSetEntry(P11KeyStore.java:1049)
    at sun.security.pkcs11.P11KeyStore.engineSetCertificateEntry(P11KeyStore.java:515)
    at java.security.KeyStore.setCertificateEntry(KeyStore.java:1235)
    at io.kubernetes.client.openapi.ApiClient.applySslSettings(ApiClient.java:1336)
brendandburns commented 1 month ago

The current client does not use the FIPS compliant version of bouncy castle, this was fixed recently:

https://github.com/kubernetes-client/java/pull/3595

But is not in any release. If you can rebuild this client at HEAD you can see if that fixes things for you.