Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CKR_SESSION_READ_ONLY in FIPS enabled environment #3621

Open
florin-szilagyi opened this issue Aug 10, 2024 · 2 comments
Open

CKR_SESSION_READ_ONLY in FIPS enabled environment #3621

florin-szilagyi opened this issue Aug 10, 2024 · 2 comments

Comments

@florin-szilagyi
Copy link

Describe the bug
Unable to connect to kubernetes in a fips enabled environment.
Seems very similar to this: fabric8io/kubernetes-client#3867

So I dug around a bit and it seems ApiClient is using the default keystore, instead of initializing it from the system one (as the fix was made here

Client Version
20.0.0

Kubernetes Version
1.28

Java Version
Java 17

To Reproduce
io.kubernetes.client.util.Config.fromCluster().getBasePath();

Expected behavior
A clear and concise description of what you expected to happen.

Server (please complete the following information):

  • OS: RHEL
  • Container
  • Azure

Additional context

sun.security.pkcs11.wrapper.PKCS11Exception: CKR_SESSION_READ_ONLY
	at sun.security.pkcs11.wrapper.PKCS11.C_CreateObject(PKCS11.java)
	at sun.security.pkcs11.wrapper.PKCS11.C_CreateObject(PKCS11.java:1961)
	at sun.security.pkcs11.P11KeyStore.storeCert(P11KeyStore.java:1567)
	at sun.security.pkcs11.P11KeyStore.engineSetEntry(P11KeyStore.java:1045)
	... 99 common frames omitted
Wrapped by: java.security.KeyStoreException: sun.security.pkcs11.wrapper.PKCS11Exception: CKR_SESSION_READ_ONLY
	at sun.security.pkcs11.P11KeyStore.engineSetEntry(P11KeyStore.java:1049)
	at sun.security.pkcs11.P11KeyStore.engineSetCertificateEntry(P11KeyStore.java:515)
	at java.security.KeyStore.setCertificateEntry(KeyStore.java:1235)
	at io.kubernetes.client.openapi.ApiClient.applySslSettings(ApiClient.java:1336)
@brendandburns
Copy link
Contributor

The current client does not use the FIPS compliant version of bouncy castle, this was fixed recently:

#3595

But is not in any release. If you can rebuild this client at HEAD you can see if that fixes things for you.

@DeanTupper
Copy link

is there any chance this going to be released any time soon? I don't see any releases for August or September. Is the suggestion here to fork and release our own artifacts for the time being?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants