FIPS error

[davidkarlsen]

Describe the bug
Operator fails with:

2022-03-11 14:57:48 INFO  Main:60 - ClusterOperator 0.28.0 is starting
2022-03-11 14:57:48 INFO  Main:62 - Cluster Operator configuration is ClusterOperatorConfig(namespaces=[*],reconciliationIntervalMs=120000,operationTimeoutMs=300000,connectBuildTimeoutMs=300000,createClusterRoles=false,networkPolicyGeneration=true,versions=versions{3.0.0={proto: 3.0 msg: 3.0 kafka-image: quay.io/strimzi/kafka@sha256:7c04f65e216bb941458aeadffb85e9eeee43d5ca67da566017c2c93a0664c98e connect-image: quay.io/strimzi/kafka@sha256:7c04f65e216bb941458aeadffb85e9eeee43d5ca67da566017c2c93a0664c98e mirrormaker-image: quay.io/strimzi/kafka@sha256:7c04f65e216bb941458aeadffb85e9eeee43d5ca67da566017c2c93a0664c98e mirrormaker2-image: quay.io/strimzi/kafka@sha256:7c04f65e216bb941458aeadffb85e9eeee43d5ca67da566017c2c93a0664c98e}, 3.1.0={proto: 3.1 msg: 3.1 kafka-image: quay.io/strimzi/kafka@sha256:06e9bda15495feb2b92d9950e834cdeed6ef20064f021a879610f1b59dd46950 connect-image: quay.io/strimzi/kafka@sha256:06e9bda15495feb2b92d9950e834cdeed6ef20064f021a879610f1b59dd46950 mirrormaker-image: quay.io/strimzi/kafka@sha256:06e9bda15495feb2b92d9950e834cdeed6ef20064f021a879610f1b59dd46950 mirrormaker2-image: quay.io/strimzi/kafka@sha256:06e9bda15495feb2b92d9950e834cdeed6ef20064f021a879610f1b59dd46950}},imagePullPolicy=null,imagePullSecrets=null,operatorNamespace=openshift-operators,operatorNamespaceLabels=null,rbacScope=CLUSTER,customResourceSelector=null,featureGates=FeatureGates(controlPlaneListener=true,ServiceAccountPatching=true,UseStrimziPodSets=false),zkAdminSessionTimeoutMs=10000,dnsCacheTtlSec=30)
Exception in thread "main" io.fabric8.kubernetes.client.KubernetesClientException: An error has occurred.
        at io.fabric8.kubernetes.client.KubernetesClientException.launderThrowable(KubernetesClientException.java:103)
        at io.fabric8.kubernetes.client.KubernetesClientException.launderThrowable(KubernetesClientException.java:97)
        at io.fabric8.kubernetes.client.utils.HttpClientUtils.applyCommonConfiguration(HttpClientUtils.java:214)
        at io.fabric8.kubernetes.client.okhttp.OkHttpClientFactory.createHttpClient(OkHttpClientFactory.java:89)
        at io.fabric8.kubernetes.client.utils.HttpClientUtils.createHttpClient(HttpClientUtils.java:164)
        at io.fabric8.kubernetes.client.BaseClient.<init>(BaseClient.java:48)
        at io.fabric8.kubernetes.client.BaseClient.<init>(BaseClient.java:40)
        at io.fabric8.kubernetes.client.BaseKubernetesClient.<init>(BaseKubernetesClient.java:151)
        at io.fabric8.kubernetes.client.DefaultKubernetesClient.<init>(DefaultKubernetesClient.java:34)
        at io.strimzi.operator.cluster.Main.main(Main.java:75)
Caused by: java.security.KeyStoreException: sun.security.pkcs11.wrapper.PKCS11Exception: CKR_SESSION_READ_ONLY
        at jdk.crypto.cryptoki/sun.security.pkcs11.P11KeyStore.engineSetEntry(P11KeyStore.java:1049)
        at jdk.crypto.cryptoki/sun.security.pkcs11.P11KeyStore.engineSetCertificateEntry(P11KeyStore.java:515)
        at java.base/java.security.KeyStore.setCertificateEntry(KeyStore.java:1235)
        at io.fabric8.kubernetes.client.internal.CertUtils.createTrustStore(CertUtils.java:100)
        at io.fabric8.kubernetes.client.internal.CertUtils.createTrustStore(CertUtils.java:74)
        at io.fabric8.kubernetes.client.internal.SSLUtils.trustManagers(SSLUtils.java:140)
        at io.fabric8.kubernetes.client.internal.SSLUtils.trustManagers(SSLUtils.java:90)
        at io.fabric8.kubernetes.client.utils.HttpClientUtils.applyCommonConfiguration(HttpClientUtils.java:203)
        ... 7 more
Caused by: sun.security.pkcs11.wrapper.PKCS11Exception: CKR_SESSION_READ_ONLY
        at jdk.crypto.cryptoki/sun.security.pkcs11.wrapper.PKCS11.C_CreateObject(Native Method)
        at jdk.crypto.cryptoki/sun.security.pkcs11.wrapper.PKCS11$FIPSPKCS11.C_CreateObject(PKCS11.java:1950)
        at jdk.crypto.cryptoki/sun.security.pkcs11.P11KeyStore.storeCert(P11KeyStore.java:1567)
        at jdk.crypto.cryptoki/sun.security.pkcs11.P11KeyStore.engineSetEntry(P11KeyStore.java:1045)
        ... 14 more

when the cluster is FIPS enabled.

To Reproduce
Steps to reproduce the behavior:

1. FIPS enable cluster
2. Install operator

Expected behavior
Should not fail

Environment (please complete the following information):

• Strimzi version: 0.28.0
• Installation method: OLM
• Kubernetes cluster: OCP 4.9
• Infrastructure: bare metal

YAML files and logs

Additional context
fabric8io/kubernetes-client#3582 is fixed and released now

[scholzj]

Strimzi is not FIPS compliant. If you want to run it on FIPS enabled cluster, you have to explicitely use a switch to disable the OpenJDK FIPS mode: https://strimzi.io/docs/operators/latest/full/configuring.html#proc-configuring-fips-mode-cluster-operator-str

[davidkarlsen]

Thanks - that works well