Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

rustls cannot reach a cluster through ip #153

Closed
clux opened this issue Feb 27, 2020 · 6 comments · Fixed by #597 or #1183
Closed

rustls cannot reach a cluster through ip #153

clux opened this issue Feb 27, 2020 · 6 comments · Fixed by #597 or #1183
Labels
blocked awaiting upstream work bug Something isn't working client http issues with the client rustls rustls-tls related

Comments

@clux
Copy link
Member

clux commented Feb 27, 2020 •
edited
Loading 

kube api: ReqwestError: error sending request for url (https://192.168.64.3:8443/apis/babylontech.co.uk/v1/namespaces/apps/shipcatmanifests/dummy-s
ervice2/status?): error trying to connect: invalid dnsname: ReqwestError(reqwest::Error { kind: Request, url: "https://192.168.64.3:8443/apis/babylontech.co.uk/v1/namespaces/apps/shipcatmanifests/dummy-service2/status?", source: hyper::Error(Connect, Custom { kind: Other, error: "invalid dnsname" }) })

This is due to missing support for it upstream: rustls/hyper-rustls#56

In-cluster broken fixed

Cannot seem to get this to work within-cluster yet because we always get a straight IP to connect to.
At least in EKS I seem to just get a straight IP to connect to the api server. So this is pretty ununsable for me atm.

Update: in-cluster fixed in #597

local minikube / k3d workaround

Add an ip entry (here 192.168.64.3 localhost) to /etc/hosts, then and search replace the ip with localhost in ~/.kube/config
@clux clux added the config Kube config related label Feb 27, 2020
@clux clux mentioned this issue Feb 27, 2020
Merged
@clux clux added bug Something isn't working client http issues with the client and removed config Kube config related labels Feb 27, 2020
@kazk kazk added the blocked awaiting upstream work label Jan 10, 2021
@kazk kazk mentioned this issue Feb 10, 2021
Open
@clux clux mentioned this issue Mar 2, 2021
Closed
whatisaphone added a commit to whatisaphone/ingress-status-sync that referenced this issue May 1, 2021
@whatisaphone
Switch to openssl to fix connecting via IP address
ec63b47 
kube-rs/kube#153
This was referenced May 25, 2021
Closed
Merged
kazk added a commit to kazk/kube-rs that referenced this issue May 31, 2021
@kazk
Expose methods to configure TLS connection
75077fe 
- Add `Config::native_tls_connector` and `Config::rustls_client_config`
- Remove the requirement of having `native-tls` or `rustls-tls` enabled when
  `client` is enabled. Allow one, both or none.
  - When both, the default Service will use `native-tls` because of kube-rs#153.
    `rustls` can be still used with a custom client.
    Users will have an option to configure TLS at runtime.
  - When none, HTTP connector is used.
- Note that `oauth` feature still requires tls feature.
- Remove tls features from kube-runtime
kazk added a commit to kazk/kube-rs that referenced this issue May 31, 2021
@kazk
Expose methods to configure TLS connection
b934991 
- Add `Config::native_tls_connector` and `Config::rustls_client_config`
- Remove the requirement of having `native-tls` or `rustls-tls` enabled when
  `client` is enabled. Allow one, both or none.
  - When both, the default Service will use `native-tls` because of kube-rs#153.
    `rustls` can be still used with a custom client.
    Users will have an option to configure TLS at runtime.
  - When none, HTTP connector is used.
- Note that `oauth` feature still requires tls feature.
- Remove tls features from kube-runtime
kazk added a commit to kazk/kube-rs that referenced this issue Jun 3, 2021
@kazk
Expose methods to configure TLS connection
37ad7f0 
- Add `Config::native_tls_connector` and `Config::rustls_client_config`
- Remove the requirement of having `native-tls` or `rustls-tls` enabled when
  `client` is enabled. Allow one, both or none.
  - When both, the default Service will use `native-tls` because of kube-rs#153.
    `rustls` can be still used with a custom client.
    Users will have an option to configure TLS at runtime.
  - When none, HTTP connector is used.
- Note that `oauth` feature still requires tls feature.
- Remove tls features from kube-runtime
@kazk kazk added the rustls rustls-tls related label Jun 4, 2021
@kazk kazk mentioned this issue Jun 4, 2021
Closed
@tgeoghegan tgeoghegan mentioned this issue Jun 21, 2021
Closed
This was referenced Jul 21, 2021
Closed
Merged
@clux clux closed this as completed in #597 Jul 26, 2021
@clux
Copy link
Member Author

clux commented Jul 26, 2021

This is not really "fixed" but worked around in master. We now connect to the apiserver using cluster dns via solution suggested in #587 .

@mattsawyer77
Copy link

@clux there doesn't appear to be any workaround for accessing a cluster with a numeric hostname from the outside with rustls. Though I'm not sure kube-rs has any responsibility here, at least until the following issues are resolved?

That said, should this remain open for tracking?

@clux
Copy link
Member Author

clux commented Aug 1, 2021

Outside the cluster you can workaround it by tweaking /etc/hosts and making a non-ip alias. Not sure that will work for all cases though.

I think you're right and that even though it's by default worked around in-cluster, it still requires work outside.

@clux clux reopened this Aug 1, 2021
@mattsawyer77
Copy link

@clux thanks for the quick response. Unfortunately, I don’t think I can override in my case, because the certs won’t match the hostname.

@kazk kazk mentioned this issue Aug 9, 2021
Closed
@kazk kazk mentioned this issue Aug 23, 2021
Closed
@etungsten etungsten mentioned this issue Aug 23, 2021
Merged
@webern webern mentioned this issue Sep 21, 2021
Closed
3 tasks
@viccuad viccuad mentioned this issue Jan 14, 2022
Closed
@clux clux mentioned this issue Feb 14, 2022
Merged
3 tasks
@clux clux mentioned this issue Mar 19, 2022
Closed
@kazk kazk mentioned this issue Mar 31, 2022
Merged
clux added a commit to clux/dotfiles that referenced this issue Jun 5, 2022
@clux
k3d workarounds for rustls - due to kube-rs/kube#153
4ae7316 
Signed-off-by: clux <[email protected]>
@branlwyd branlwyd mentioned this issue Jul 15, 2022
Merged
branlwyd added a commit to divviup/janus that referenced this issue Jul 15, 2022
@branlwyd
Update Dockerfile to install openssl dev dependencies.
90f703e 
Unfortunately, kube doesn't work with rustls when talking to local
clusters: kube-rs/kube#153

Thankfully, openssl is only a dependency if the test-utils feature is
enabled, so our release builds will not depend on openssl.
Unfortunately, that means that our release builds will be interacting
with Kubernetes using a different TLS library than our tests use.
@branlwyd branlwyd mentioned this issue Jul 22, 2022
Closed
@clux clux mentioned this issue Sep 6, 2022
Closed
@clux clux mentioned this issue Nov 3, 2022
Closed
@markmandel markmandel mentioned this issue Jan 5, 2023
Merged
@jpmcb jpmcb mentioned this issue Jan 27, 2023
Merged
2 tasks
@flavio
Copy link
Contributor

flavio commented Feb 28, 2023

JFYI: the rustls folks have forked the webpki crate and their fork has a fix for this issue. You can see the issue about IP support here: rustls/webpki#4

Currently there's no official release of this forked crate, plus a bunch of projects will need to switch to rustls-webpki instead of webpki. Hence it will take time for this fix to be "consumable", but at least there's hope to get a proper fix 🤞

This was referenced Apr 3, 2023
Merged
Merged
@clux clux linked a pull request Apr 3, 2023 that will close this issue
Run rustls CI against IP cluster address #1183
Merged
@clux
Copy link
Member Author

clux commented Apr 3, 2023

This does indeed appear fixed in main now. @flavio's efforts ❤️ have trickled down through rustls, and our previously failing rustls ci checks are back #1183. So will close this issue in the hope that we can finally leave this multi-year saga behind 🧓

Expect this change included in [email protected].

@clux clux closed this as completed in #1183 Apr 3, 2023
This was referenced Apr 3, 2023
Closed
Closed
@fornwall fornwall mentioned this issue Jan 25, 2024
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
blocked awaiting upstream work bug Something isn't working client http issues with the client rustls rustls-tls related
Projects
None yet
Milestone
No milestone
4 participants
@flavio @clux @mattsawyer77 @kazk