search

operator-framework / operator-lifecycle-manager

A management framework for extending Kubernetes with Operators
https://olm.operatorframework.io
Apache License 2.0
1.69k stars 543 forks source link

Provide support for PKCS8 TLS key format #2191

Open fvaleri opened 3 years ago

fvaleri commented 3 years ago

When I try to deploy a bundle containing a a ValidatingAdmissionWebhook linked to a Quarkus application deployment, I get the following exception when loading the generated TLS key:

io.vertx.core.VertxException: java.security.spec.InvalidKeySpecException: java.security.InvalidKeyException: IOException : version mismatch: (supported:     00, parsed:     01
    at java.base/sun.security.pkcs.PKCS8Key.decode(PKCS8Key.java:350)
    at java.base/sun.security.pkcs.PKCS8Key.decode(PKCS8Key.java:355)
    at jdk.crypto.ec/sun.security.ec.ECPrivateKeyImpl.<init>(ECPrivateKeyImpl.java:74)
    at jdk.crypto.ec/sun.security.ec.ECKeyFactory.implGeneratePrivate(ECKeyFactory.java:237)
    at jdk.crypto.ec/sun.security.ec.ECKeyFactory.engineGeneratePrivate(ECKeyFactory.java:165)
    at java.base/java.security.KeyFactory.generatePrivate(KeyFactory.java:390)
    at io.vertx.core.net.impl.KeyStoreHelper.lambda$loadPrivateKey$1(KeyStoreHelper.java:265)
    at io.vertx.core.net.impl.KeyStoreHelper.loadPems(KeyStoreHelper.java:335)
    at io.vertx.core.net.impl.KeyStoreHelper.loadPrivateKey(KeyStoreHelper.java:259)
    at io.vertx.core.net.impl.KeyStoreHelper.loadKeyCert(KeyStoreHelper.java:246)
    at io.vertx.core.net.PemKeyCertOptions.getHelper(PemKeyCertOptions.java:405)
    at io.vertx.core.net.KeyStoreHelperTest.testKeyStoreHelperSupportsECPrivateKeys(KeyStoreHelperTest.java:69)

Now, the OLM generates the key in SEC1/PEM format instead of the PKCS8/PEM format, which is required by the JDK. If I get the key from the generated secret and convert it to PKCS8 format, then it works fine.

openssl pkcs8 -topk8 -inform pem -in tls.key -outform pem -nocrypt -out tls-new.key

Instead, certificates generated by the Service CA Operator work fine.

These are the format delimiters that you can see when extracting the key from the secret.

OLM key (KO): -----BEGIN EC PRIVATE KEY-----
Converted OLM key (OK): -----BEGIN PRIVATE KEY-----
Service CA key (OK): -----BEGIN RSA PRIVATE KEY-----

Is there a way to generate the key in PKCS8 format? If not, can we add a flag to support it?

exdx commented 3 years ago

Does cert-manager support this feature?

OLM currently manages certs and generates self-signed certs for things like webhooks but we are interested in getting out of that altogether and delegating to a tool like cert-manager instead. This is on the near term roadmap.

fvaleri commented 3 years ago

@exdx it looks like it is supported: https://cert-manager.io/docs/reference/api-docs/#cert-manager.io/v1.CertificatePrivateKey

ppatierno commented 3 years ago

My concern is about "near term roadmap" meaning ... any real ETA for that? Good to know that OLM is moving toward using cert-manager but I don't see it as a trivial task but maybe I could be wrong.

fvaleri commented 3 years ago

@exdx in the meantime, is it possible to add a flag to enable that conversion?

exdx commented 3 years ago

I think it's possible, we would definitely review a patch with that enabled.

We will triage this issue more in our Thursday issue triage call at 10 AM EST, if you wanted to discuss with the members of the OLM team. https://docs.google.com/document/d/1LMQ5QlEYgGBeSc75fhHh-VFJ8_B2j4ieBcagIa-QfwU/edit#heading=h.8ngolbigvi7q

fvaleri commented 3 years ago

Thanks @exdx, that would be great.

exdx commented 3 years ago

One option is to create another volume mount in every APIService/Webhook that OLM creates in the PKCS8 such that this change is backwards-compatible. Changing the cert to PKCS8 entirely may risk breaking some of the existing APIServices and other components.

ppatierno commented 3 years ago

@exdx yes it makes more sense.