Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

rustls cannot reach a cluster through ip #153

Closed
clux opened this issue Feb 27, 2020 · 6 comments · Fixed by #597 or #1183
Closed

rustls cannot reach a cluster through ip #153

clux opened this issue Feb 27, 2020 · 6 comments · Fixed by #597 or #1183
Labels
blocked awaiting upstream work bug Something isn't working client http issues with the client rustls rustls-tls related

Comments

@clux
Copy link
Member

clux commented Feb 27, 2020

kube api: ReqwestError: error sending request for url (https://192.168.64.3:8443/apis/babylontech.co.uk/v1/namespaces/apps/shipcatmanifests/dummy-s
ervice2/status?): error trying to connect: invalid dnsname: ReqwestError(reqwest::Error { kind: Request, url: "https://192.168.64.3:8443/apis/babylontech.co.uk/v1/namespaces/apps/shipcatmanifests/dummy-service2/status?", source: hyper::Error(Connect, Custom { kind: Other, error: "invalid dnsname" }) })

This is due to missing support for it upstream: rustls/hyper-rustls#56

In-cluster broken fixed

Cannot seem to get this to work within-cluster yet because we always get a straight IP to connect to.
At least in EKS I seem to just get a straight IP to connect to the api server. So this is pretty ununsable for me atm.

Update: in-cluster fixed in #597

local minikube / k3d workaround

Add an ip entry (here 192.168.64.3 localhost) to /etc/hosts, then and search replace the ip with localhost in ~/.kube/config

@clux clux added the config Kube config related label Feb 27, 2020
@clux clux added bug Something isn't working client http issues with the client and removed config Kube config related labels Feb 27, 2020
@kazk kazk added the blocked awaiting upstream work label Jan 10, 2021
whatisaphone added a commit to whatisaphone/ingress-status-sync that referenced this issue May 1, 2021
kazk added a commit to kazk/kube-rs that referenced this issue May 31, 2021
- Add `Config::native_tls_connector` and `Config::rustls_client_config`
- Remove the requirement of having `native-tls` or `rustls-tls` enabled when
  `client` is enabled. Allow one, both or none.
  - When both, the default Service will use `native-tls` because of kube-rs#153.
    `rustls` can be still used with a custom client.
    Users will have an option to configure TLS at runtime.
  - When none, HTTP connector is used.
- Note that `oauth` feature still requires tls feature.
- Remove tls features from kube-runtime
kazk added a commit to kazk/kube-rs that referenced this issue May 31, 2021
- Add `Config::native_tls_connector` and `Config::rustls_client_config`
- Remove the requirement of having `native-tls` or `rustls-tls` enabled when
  `client` is enabled. Allow one, both or none.
  - When both, the default Service will use `native-tls` because of kube-rs#153.
    `rustls` can be still used with a custom client.
    Users will have an option to configure TLS at runtime.
  - When none, HTTP connector is used.
- Note that `oauth` feature still requires tls feature.
- Remove tls features from kube-runtime
kazk added a commit to kazk/kube-rs that referenced this issue Jun 3, 2021
- Add `Config::native_tls_connector` and `Config::rustls_client_config`
- Remove the requirement of having `native-tls` or `rustls-tls` enabled when
  `client` is enabled. Allow one, both or none.
  - When both, the default Service will use `native-tls` because of kube-rs#153.
    `rustls` can be still used with a custom client.
    Users will have an option to configure TLS at runtime.
  - When none, HTTP connector is used.
- Note that `oauth` feature still requires tls feature.
- Remove tls features from kube-runtime
@kazk kazk added the rustls rustls-tls related label Jun 4, 2021
@clux clux closed this as completed in #597 Jul 26, 2021
@clux
Copy link
Member Author

clux commented Jul 26, 2021

This is not really "fixed" but worked around in master. We now connect to the apiserver using cluster dns via solution suggested in #587 .

@mattsawyer77
Copy link

@clux there doesn't appear to be any workaround for accessing a cluster with a numeric hostname from the outside with rustls. Though I'm not sure kube-rs has any responsibility here, at least until the following issues are resolved?

That said, should this remain open for tracking?

@clux
Copy link
Member Author

clux commented Aug 1, 2021

Outside the cluster you can workaround it by tweaking /etc/hosts and making a non-ip alias. Not sure that will work for all cases though.

I think you're right and that even though it's by default worked around in-cluster, it still requires work outside.

@clux clux reopened this Aug 1, 2021
@mattsawyer77
Copy link

@clux thanks for the quick response. Unfortunately, I don’t think I can override in my case, because the certs won’t match the hostname.

clux added a commit to clux/dotfiles that referenced this issue Jun 5, 2022
Signed-off-by: clux <sszynrae@gmail.com>
branlwyd added a commit to divviup/janus that referenced this issue Jul 15, 2022
Unfortunately, kube doesn't work with rustls when talking to local
clusters: kube-rs/kube#153

Thankfully, openssl is only a dependency if the test-utils feature is
enabled, so our release builds will not depend on openssl.
Unfortunately, that means that our release builds will be interacting
with Kubernetes using a different TLS library than our tests use.
@flavio
Copy link
Contributor

flavio commented Feb 28, 2023

JFYI: the rustls folks have forked the webpki crate and their fork has a fix for this issue. You can see the issue about IP support here: rustls/webpki#4

Currently there's no official release of this forked crate, plus a bunch of projects will need to switch to rustls-webpki instead of webpki. Hence it will take time for this fix to be "consumable", but at least there's hope to get a proper fix 🤞

@clux
Copy link
Member Author

clux commented Apr 3, 2023

This does indeed appear fixed in main now. @flavio's efforts ❤️ have trickled down through rustls, and our previously failing rustls ci checks are back #1183. So will close this issue in the hope that we can finally leave this multi-year saga behind 🧓

Expect this change included in kube@0.81.0.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
blocked awaiting upstream work bug Something isn't working client http issues with the client rustls rustls-tls related
Projects
None yet
4 participants