CKR_SESSION_READ_ONLY in FIPS enabled environment

[florin-szilagyi]

Describe the bug
Unable to connect to kubernetes in a fips enabled environment.
Seems very similar to this: fabric8io/kubernetes-client#3867

So I dug around a bit and it seems ApiClient is using the default keystore, instead of initializing it from the system one (as the fix was made here

Client Version
20.0.0

Kubernetes Version
1.28

Java Version
Java 17

To Reproduce
io.kubernetes.client.util.Config.fromCluster().getBasePath();

Expected behavior
A clear and concise description of what you expected to happen.

Server (please complete the following information):

• OS: RHEL
• Container
• Azure

Additional context

sun.security.pkcs11.wrapper.PKCS11Exception: CKR_SESSION_READ_ONLY
	at sun.security.pkcs11.wrapper.PKCS11.C_CreateObject(PKCS11.java)
	at sun.security.pkcs11.wrapper.PKCS11.C_CreateObject(PKCS11.java:1961)
	at sun.security.pkcs11.P11KeyStore.storeCert(P11KeyStore.java:1567)
	at sun.security.pkcs11.P11KeyStore.engineSetEntry(P11KeyStore.java:1045)
	... 99 common frames omitted
Wrapped by: java.security.KeyStoreException: sun.security.pkcs11.wrapper.PKCS11Exception: CKR_SESSION_READ_ONLY
	at sun.security.pkcs11.P11KeyStore.engineSetEntry(P11KeyStore.java:1049)
	at sun.security.pkcs11.P11KeyStore.engineSetCertificateEntry(P11KeyStore.java:515)
	at java.security.KeyStore.setCertificateEntry(KeyStore.java:1235)
	at io.kubernetes.client.openapi.ApiClient.applySslSettings(ApiClient.java:1336)

[brendandburns]

The current client does not use the FIPS compliant version of bouncy castle, this was fixed recently:

#3595

But is not in any release. If you can rebuild this client at HEAD you can see if that fixes things for you.

[DeanTupper]

is there any chance this going to be released any time soon? I don't see any releases for August or September. Is the suggestion here to fork and release our own artifacts for the time being?

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle stale
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle rotten
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Reopen this issue with /reopen
• Mark this issue as fresh with /remove-lifecycle rotten
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close not-planned

[k8s-ci-robot]

@k8s-triage-robot: Closing this issue, marking it as "Not Planned".

In response to this:

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Reopen this issue with /reopen
• Mark this issue as fresh with /remove-lifecycle rotten
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close not-planned

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.