Support FIPS mode in kubernetes-client with BouncyCastleFipsProvider #2788

gulyaev13 · 2021-02-05T14:27:12Z

Support FIPS mode in kubernetes-client with BouncyCastleFipsProvider сonnected externally.
Solving the issue described in #2732

Description

Type of change

Bug fix (non-breaking change which fixes an issue)
Feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to change
Chore (non-breaking change which doesn't affect codebase;
test, version modification, documentation, etc.)

Checklist

Code contributed by me aligns with current project license: Apache 2.0
I Added CHANGELOG entry regarding this change
I have implemented unit tests to cover my changes
I have added/updated the javadocs and other documentation accordingly
No new bugs, code smells, etc. in SonarCloud report
I tested my code in Kubernetes
I tested my code in OpenShift

centos-ci · 2021-02-05T14:27:14Z

Can one of the admins verify this patch?

sonarqubecloud · 2021-02-05T14:49:47Z

Kudos, SonarCloud Quality Gate passed!

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

28.6% Coverage
0.0% Duplication

metacosm · 2021-02-08T09:19:43Z

kubernetes-client/src/main/java/io/fabric8/kubernetes/client/internal/CertUtils.java

@@ -145,7 +145,7 @@ private static PrivateKey handleECKey(InputStream keyInputStream) throws IOExcep
        @Override
        public PrivateKey call() {
          try {
-            if (Security.getProvider("BC") == null) {
+            if (Security.getProvider("BC") == null && Security.getProvider("BCFIPS") == null) {
              Security.addProvider(new org.bouncycastle.jce.provider.BouncyCastleProvider());


Shouldn't you be adding the BouncyCastleFipsProvider here if it's not found, instead of the regular BC provider?

According to Bouncy Castle FIPS Java API User Guide security provider can be added in java.security file.

I chose to support only the external configuration due to the following reasons:

Additional flag for FIPS mode isn't required

No need to add dependency with BC FIPS and update versions

Adding FIPS provider at the state of initialization of Kubernetes client is too late. So much code can be executed in an application using kubernetes-client. Initialization on startup of JVM is preferable.

As I understand, this statement prevents the the BouncyCastleProvider to be added if you configured your JVM to use the BCFIPS provider, right?

On the other hand, these changes should be harmless in case no BC configuration is provided, right?

Hmm, still not convinced… Doesn't this mean that someone might be requesting the FIPS provider and actually getting the regular one?

@manusa , yes! Changes should be harmless in case no BC configuration is provided.
There are 4 cases:

None of the BouncyCastle security providers configured in JVM -> BC will be added in runtime

BC configured in JVM -> BC will not be added in runtime

BCFIPS configured in JVM -> BC will not be added in runtime

Another FIPS provider configured in JVM (is it exist?) -> BC will be added in runtime

@metacosm , looks like you are asking about case №4, aren't you?
I see 2 solutions:

The additional flag can be added to prevent adding BC provider in case if someone would like to use an external provider.

We can say that kubernetes-client works only with the family of BouncyCastle security providers (BC/BCFIPS).

What I don't understand is why we add the BC provider when the user asks for BCFIPS and not the BouncyCastleFipsProvider? How will that address the issue?

@metacosm , because there is no option in kubernetes-client configuration for add BouncyCastleFipsProvider(BCFIPS) instead of BouncyCastleProvider(BC).

But if the user will configure JVM for use BouncyCastleFipsProvider(BCFIPS) kubernetes-client will not add BouncyCastleProvider(BC). See case №3 in my previous message.

gulyaev13 · 2021-02-12T11:39:59Z

@oscerd , hello!
If my PR will be approved what should I do to backport changes to kubernetes-client 4.11.?
I've planned to add these changes in Jenkins plugin with Kubernetes API and looks like they are still using 4.11. releases. Updating the Jenkins plugin to the 5.1.0 release seems a big project for this small patch.
https://github.com/jenkinsci/kubernetes-client-api-plugin/blob/master/pom.xml#L16

oscerd · 2021-02-12T11:51:47Z

I don't think 4.11 is an active branch, only for critical CVE.

gulyaev13 · 2021-02-12T12:20:09Z

@oscerd , understood, thanks!
I will try to propose an update of kubernetes-client version in Jenkins plugins to 5 and more.

gulyaev13 · 2021-03-13T15:13:09Z

@manusa , hello!
Are there some blockers for merge?

manusa · 2021-03-13T15:53:26Z

Hi @gulyaev13,
Everything is fine with the PR. We're waiting on a security team to double check everything is OK (unfortunately it's taking longer than expected 😓, sorry).

DimoDonchev · 2021-03-29T12:16:27Z

@manusa , hello!
Is there any update on the double checking from the security team?

…connected externally

manusa · 2021-04-07T15:38:36Z

Hi @DimoDonchev, sorry for the delay. We'll try to include this in our upcoming 5.4.0 release.

sonarqubecloud · 2021-04-07T15:59:18Z

Kudos, SonarCloud Quality Gate passed!

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

28.6% Coverage
0.0% Duplication

oleg-nenashev · 2021-05-12T10:21:32Z

Hi @manusa . Is there a ETA for the 2.4.0 release? We use this library in Jenkins Kubernetes Plugin and in a few developer tools. It would be great to hqve a release. Please let me know if any help needed

manusa · 2021-05-12T10:25:17Z

Hi @manusa . Is there a ETA for the 2.4.0 release? We use this library in Jenkins Kubernetes Plugin and in a few developer tools. It would be great to hqve a release. Please let me know if any help needed

I guess you mean 5.4.0. Release is imminent, we are long overdue our initial ETA. Not sure if we'll be able to deliver by the end of the week, but our intention is to release ASAP.

oleg-nenashev · 2021-05-12T10:48:10Z

Yeah, thanks for the update and sorry for the typo. Thanks for working on this and for maintaining the library

…

On Wed, May 12, 2021, 12:25 Marc Nuri ***@***.***> wrote: Hi @manusa <https://github.com/manusa> . Is there a ETA for the 2.4.0 release? We use this library in Jenkins Kubernetes Plugin and in a few developer tools. It would be great to hqve a release. Please let me know if any help needed I guess you mean 5.4.0. Release is imminent, we are long overdue our initial ETA. Not sure if we'll be able to deliver by the end of the week, but our intention is to release ASAP. — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#2788 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAW4RIE7N63VFLUJBXKZPH3TNJJSJANCNFSM4XE3KIUA> .

FuyaoLi2017 · 2021-06-08T20:13:36Z

@gulyaev13 @manusa Hello Team, I am using Apache Flink 1.13.0 and Flink references the 4.9.2 version of the Fabric8 kubernetes client. I am writing an kubernetes operator for Flink and 5.4.0 is not compatible with Flink since the APIs changes a lot between these two versions because I need to call some Flink internal methods which is actually using 4.9.2 Fabric library.

However, I still want to make Fabric8 version 4.9.2 FIPS compliant, is it possible to do to monkey patch for such changes?

manusa · 2021-06-10T07:16:34Z

I don't know how heavily Apache Flink relies on the client, but it would make sense to update their dependency.
4.9.2 was released almost a year ago, so it might be worthier to spend the time upgrading Flink to use the latest release of the Fabric8 client instead (as I said, depending on how complex this turn out to be).

gulyaev13 mentioned this pull request Feb 5, 2021

Question on fips compliance #2732

Closed

rohanKanojia requested review from oscerd, manusa and metacosm February 5, 2021 14:36

metacosm reviewed Feb 8, 2021

View reviewed changes

oscerd approved these changes Feb 9, 2021

View reviewed changes

manusa added this to the 5.1.0 milestone Feb 9, 2021

manusa modified the milestones: 5.1.0, 5.2.0 Feb 17, 2021

manusa modified the milestones: 5.2.0, 5.3.0 Mar 11, 2021

manusa modified the milestones: 5.4.0, 5.3.0 Apr 7, 2021

Support FIPS mode in kubernetes-client with BouncyCastleFipsProvider …

eb18f9f

…connected externally

manusa force-pushed the fips-mode branch from ad5b63e to eb18f9f Compare April 7, 2021 15:34

manusa modified the milestones: 5.3.0, 5.4.0 Apr 8, 2021

manusa merged commit 0c5a49b into fabric8io:master Apr 27, 2021

manusa added changelog missing A line to changelog.md regarding the change is not added and removed changelog missing A line to changelog.md regarding the change is not added labels Apr 27, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Support FIPS mode in kubernetes-client with BouncyCastleFipsProvider #2788

Support FIPS mode in kubernetes-client with BouncyCastleFipsProvider #2788

gulyaev13 commented Feb 5, 2021 •

edited

Loading

centos-ci commented Feb 5, 2021

sonarqubecloud bot commented Feb 5, 2021

metacosm Feb 8, 2021

gulyaev13 Feb 8, 2021

manusa Feb 9, 2021

manusa Feb 9, 2021

metacosm Feb 10, 2021

gulyaev13 Feb 11, 2021

metacosm Feb 12, 2021

gulyaev13 Feb 12, 2021

gulyaev13 commented Feb 12, 2021

oscerd commented Feb 12, 2021

gulyaev13 commented Feb 12, 2021

gulyaev13 commented Mar 13, 2021

manusa commented Mar 13, 2021

DimoDonchev commented Mar 29, 2021

manusa commented Apr 7, 2021 •

edited

Loading

sonarqubecloud bot commented Apr 7, 2021

oleg-nenashev commented May 12, 2021

manusa commented May 12, 2021

oleg-nenashev commented May 12, 2021 via email

FuyaoLi2017 commented Jun 8, 2021

manusa commented Jun 10, 2021

Support FIPS mode in kubernetes-client with BouncyCastleFipsProvider #2788

Support FIPS mode in kubernetes-client with BouncyCastleFipsProvider #2788

Conversation

gulyaev13 commented Feb 5, 2021 • edited Loading

Description

Type of change

Checklist

centos-ci commented Feb 5, 2021

sonarqubecloud bot commented Feb 5, 2021

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

gulyaev13 commented Feb 12, 2021

oscerd commented Feb 12, 2021

gulyaev13 commented Feb 12, 2021

gulyaev13 commented Mar 13, 2021

manusa commented Mar 13, 2021

DimoDonchev commented Mar 29, 2021

manusa commented Apr 7, 2021 • edited Loading

sonarqubecloud bot commented Apr 7, 2021

oleg-nenashev commented May 12, 2021

manusa commented May 12, 2021

oleg-nenashev commented May 12, 2021 via email

FuyaoLi2017 commented Jun 8, 2021

manusa commented Jun 10, 2021

gulyaev13 commented Feb 5, 2021 •

edited

Loading

manusa commented Apr 7, 2021 •

edited

Loading