java icon indicating copy to clipboard operation
java copied to clipboard

CKR_SESSION_READ_ONLY in FIPS enabled environment

Open florin-szilagyi opened this issue 6 months ago • 2 comments

Describe the bug Unable to connect to kubernetes in a fips enabled environment. Seems very similar to this: https://github.com/fabric8io/kubernetes-client/pull/3867

So I dug around a bit and it seems ApiClient is using the default keystore, instead of initializing it from the system one (as the fix was made here

Client Version 20.0.0

Kubernetes Version 1.28

Java Version Java 17

To Reproduce io.kubernetes.client.util.Config.fromCluster().getBasePath();

Expected behavior A clear and concise description of what you expected to happen.

Server (please complete the following information):

  • OS: RHEL
  • Container
  • Azure

Additional context

sun.security.pkcs11.wrapper.PKCS11Exception: CKR_SESSION_READ_ONLY
	at sun.security.pkcs11.wrapper.PKCS11.C_CreateObject(PKCS11.java)
	at sun.security.pkcs11.wrapper.PKCS11.C_CreateObject(PKCS11.java:1961)
	at sun.security.pkcs11.P11KeyStore.storeCert(P11KeyStore.java:1567)
	at sun.security.pkcs11.P11KeyStore.engineSetEntry(P11KeyStore.java:1045)
	... 99 common frames omitted
Wrapped by: java.security.KeyStoreException: sun.security.pkcs11.wrapper.PKCS11Exception: CKR_SESSION_READ_ONLY
	at sun.security.pkcs11.P11KeyStore.engineSetEntry(P11KeyStore.java:1049)
	at sun.security.pkcs11.P11KeyStore.engineSetCertificateEntry(P11KeyStore.java:515)
	at java.security.KeyStore.setCertificateEntry(KeyStore.java:1235)
	at io.kubernetes.client.openapi.ApiClient.applySslSettings(ApiClient.java:1336)

florin-szilagyi avatar Aug 10 '24 07:08 florin-szilagyi