Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

castai-agent does not support TLS 1.3 #380

Open
lisenet opened this issue Jan 25, 2024 · 0 comments
Open

castai-agent does not support TLS 1.3 #380

lisenet opened this issue Jan 25, 2024 · 0 comments

Comments

@lisenet
Copy link

lisenet commented Jan 25, 2024

Running a Kubernetes cluster with TLS 1.3 only:

$ curl -vkI https://10.96.0.1:443/api
*   Trying 10.96.0.1:443...
* Connected to 10.96.0.1 (10.96.0.1) port 443 (#0)
* ALPN: offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Request CERT (13):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Certificate (11):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_128_GCM_SHA256
* ALPN: server accepted h2
* Server certificate:
*  subject: CN=kube-apiserver
*  start date: Jul  5 15:28:54 2023 GMT
*  expire date: Sep 11 09:17:14 2024 GMT
*  issuer: CN=kubernetes
*  SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.
* using HTTP/2
* h2h3 [:method: HEAD]
* h2h3 [:path: /api]
* h2h3 [:scheme: https]
* h2h3 [:authority: 10.96.0.1]
* h2h3 [user-agent: curl/8.0.1]
* h2h3 [accept: */*]
* Using Stream ID: 1 (easy handle 0x7f1030631af0)
> HEAD /api HTTP/2
> Host: 10.96.0.1
> user-agent: curl/8.0.1
> accept: */*
> 
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
< HTTP/2 405 
HTTP/2 405 
< audit-id: 793432e5-8d19-4714-88f7-b74a1737d9c5
audit-id: 793432e5-8d19-4714-88f7-b74a1737d9c5
< cache-control: no-cache, private
cache-control: no-cache, private
< content-type: application/json
content-type: application/json
< x-kubernetes-pf-flowschema-uid: b7b912df-2347-4ff0-bc46-03db625f6b68
x-kubernetes-pf-flowschema-uid: b7b912df-2347-4ff0-bc46-03db625f6b68
< x-kubernetes-pf-prioritylevel-uid: 91aefef1-aa34-43dd-bcba-e0d14858263e
x-kubernetes-pf-prioritylevel-uid: 91aefef1-aa34-43dd-bcba-e0d14858263e
< content-length: 229
content-length: 229
< date: Thu, 25 Jan 2024 18:18:54 GMT
date: Thu, 25 Jan 2024 18:18:54 GMT

< 
* Connection #0 to host 10.96.0.1 left intact

Castai-agent fails to connect to the API server:

I0125 18:10:12.686315       1 autoscaler.go:46] Scaling namespace: castai-agent, target: deployment/castai-agent
E0125 18:10:12.692345       1 autoscaler.go:49] failed to discover preferred resources: Get https://10.96.0.1:443/api?timeout=32s: remote error: tls: protocol version not supported
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant