java
java copied to clipboard
CKR_SESSION_READ_ONLY in FIPS enabled environment
Describe the bug Unable to connect to kubernetes in a fips enabled environment. Seems very similar to this: https://github.com/fabric8io/kubernetes-client/pull/3867
So I dug around a bit and it seems ApiClient is using the default keystore, instead of initializing it from the system one (as the fix was made here
Client Version 20.0.0
Kubernetes Version 1.28
Java Version Java 17
To Reproduce
io.kubernetes.client.util.Config.fromCluster().getBasePath();
Expected behavior A clear and concise description of what you expected to happen.
Server (please complete the following information):
- OS: RHEL
- Container
- Azure
Additional context
sun.security.pkcs11.wrapper.PKCS11Exception: CKR_SESSION_READ_ONLY
at sun.security.pkcs11.wrapper.PKCS11.C_CreateObject(PKCS11.java)
at sun.security.pkcs11.wrapper.PKCS11.C_CreateObject(PKCS11.java:1961)
at sun.security.pkcs11.P11KeyStore.storeCert(P11KeyStore.java:1567)
at sun.security.pkcs11.P11KeyStore.engineSetEntry(P11KeyStore.java:1045)
... 99 common frames omitted
Wrapped by: java.security.KeyStoreException: sun.security.pkcs11.wrapper.PKCS11Exception: CKR_SESSION_READ_ONLY
at sun.security.pkcs11.P11KeyStore.engineSetEntry(P11KeyStore.java:1049)
at sun.security.pkcs11.P11KeyStore.engineSetCertificateEntry(P11KeyStore.java:515)
at java.security.KeyStore.setCertificateEntry(KeyStore.java:1235)
at io.kubernetes.client.openapi.ApiClient.applySslSettings(ApiClient.java:1336)