EC Keys are not supported when using the native binary

[agilob]

kubectl infinispan --help
Exception in thread "main" java.lang.RuntimeException: java.lang.RuntimeException: EC Keys are not supported when using the native binary
 at org.infinispan.cli.commands.CLI.main(CLI.java:345)
 at org.infinispan.cli.commands.CLI.main(CLI.java:354)
 at org.infinispan.cli.commands.CLI.main(CLI.java:358)
 at org.infinispan.cli.quarkus.CliQuarkus.main(CliQuarkus.java:14)
Caused by: java.lang.RuntimeException: EC Keys are not supported when using the native binary
 at io.fabric8.kubernetes.client.internal.CertUtils.handleECKey(CertUtils.java:16)
 at io.fabric8.kubernetes.client.internal.CertUtils.loadKey(CertUtils.java:130)
 at io.fabric8.kubernetes.client.internal.CertUtils.createKeyStore(CertUtils.java:108)
 at io.fabric8.kubernetes.client.internal.CertUtils.createKeyStore(CertUtils.java:244)
 at io.fabric8.kubernetes.client.internal.SSLUtils.keyManagers(SSLUtils.java:128)
 at io.fabric8.kubernetes.client.internal.SSLUtils.keyManagers(SSLUtils.java:122)
 at io.fabric8.kubernetes.client.utils.HttpClientUtils.createHttpClient(HttpClientUtils.java:129)
 at io.fabric8.kubernetes.client.utils.HttpClientUtils.createHttpClient(HttpClientUtils.java:66)
 at io.fabric8.kubernetes.client.BaseClient.<init>(BaseClient.java:51)
 at io.fabric8.kubernetes.client.BaseClient.<init>(BaseClient.java:43)
 at io.fabric8.kubernetes.client.BaseKubernetesClient.<init>(BaseKubernetesClient.java:146)
 at io.fabric8.kubernetes.client.DefaultKubernetesClient.<init>(DefaultKubernetesClient.java:32)
 at org.infinispan.cli.impl.KubernetesContext.<init>(KubernetesContext.java:24)
 at org.infinispan.cli.commands.CLI.initialCommandRuntimeBuilder(CLI.java:315)
 at org.infinispan.cli.commands.CLI.main(CLI.java:341)
 ... 3 more

I'm getting this on infinispan-cli-13.0.6.Final and infinispan-cli-14.0.0.Dev01 I'm on linux

[tristantarrant]

This is a problem with https://github.com/fabric8io/kubernetes-client which only supports EC keys with the BouncyCastle FIPS jar, which has a restrictive redistribution license.
Ideally, if the JDK has been configured with a FIPS-compliant security provider, this should work without explicitly requiring BouncyCastle on the classpath.

[tristantarrant]

I've opened an issue fabric8io/kubernetes-client#3952

[manusa]

This is probably also related to: quarkusio/quarkus#21849

[larsw]

I'm experiencing the same thing.

$ kubectl infinispan
Exception in thread "main" java.lang.RuntimeException: java.lang.RuntimeException: EC Keys are not supported when using the native binary, please add the org.bouncycastle:bcpkix-jdk18on dependency
	at org.infinispan.cli.commands.CLI.main(CLI.java:382)
	at org.infinispan.cli.commands.CLI.main(CLI.java:391)
	at org.infinispan.cli.commands.CLI.main(CLI.java:404)
	at org.infinispan.cli.quarkus.CliQuarkus.main(CliQuarkus.java:16)
Caused by: java.lang.RuntimeException: EC Keys are not supported when using the native binary, please add the org.bouncycastle:bcpkix-jdk18on dependency
	at io.fabric8.kubernetes.client.internal.CertUtils.handleECKey(CertUtils.java:15)
	at io.fabric8.kubernetes.client.internal.CertUtils.loadKey(CertUtils.java:140)
	at io.fabric8.kubernetes.client.internal.CertUtils.createKeyStore(CertUtils.java:116)
	at io.fabric8.kubernetes.client.internal.CertUtils.createKeyStore(CertUtils.java:251)
	at io.fabric8.kubernetes.client.internal.SSLUtils.keyManagers(SSLUtils.java:168)
	at io.fabric8.kubernetes.client.internal.SSLUtils.keyManagers(SSLUtils.java:157)
	at io.fabric8.kubernetes.client.utils.HttpClientUtils.applyCommonConfiguration(HttpClientUtils.java:207)
	at io.fabric8.kubernetes.client.okhttp.OkHttpClientFactory.newBuilder(OkHttpClientFactory.java:94)
	at io.fabric8.kubernetes.client.okhttp.OkHttpClientFactory.newBuilder(OkHttpClientFactory.java:31)
	at io.fabric8.kubernetes.client.utils.HttpClientUtils.createHttpClient(HttpClientUtils.java:146)
	at io.fabric8.kubernetes.client.DefaultKubernetesClient.<init>(DefaultKubernetesClient.java:56)
	at io.fabric8.kubernetes.client.DefaultKubernetesClient.<init>(DefaultKubernetesClient.java:48)
	at org.infinispan.cli.impl.KubernetesContext.<init>(KubernetesContext.java:24)
	at org.infinispan.cli.commands.CLI.initialCommandRuntimeBuilder(CLI.java:353)
	at org.infinispan.cli.commands.CLI.main(CLI.java:379)
	... 3 more

[ryanemerson]

@larsw What version of Infinispan are you using? This should have been resolved when we upgraded to Quarkus 2.6.0.Final quarkusio/quarkus#21849.

[larsw]

Latest - 14.0.20.Final Weird thing is, it only fails when I rename it and move it to/usr/local/bin as the doc prescribes. If I run it in a local directory (not via kubectl infinispan) it behaves like the normal infinispan CLI

…

On Wed, 15 Nov 2023 at 10:22, Ryan Emerson ***@***.***> wrote: @larsw <https://github.com/larsw> What version of Infinispan are you using? This should have been resolved when we upgraded to Quarkus 2.6.0.Final quarkusio/quarkus#21849 <quarkusio/quarkus#21849>. — Reply to this email directly, view it on GitHub <#87 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAAPOA5MCZ6DTBXMI3YQFFDYESCCBAVCNFSM5PECB5PKU5DIOJSWCZC7NNSXTN2JONZXKZKDN5WW2ZLOOQ5TCOBRGIYDONBZGU3Q> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[stephankoelle]

using ln -s infinispan-cli kubectl-infinispan instead of renaming might be a solution