fix: remove bc optional dependency

[shawkins]

Description

Removes the bc optional dependency

closes: #6008

Type of change

• Bug fix (non-breaking change which fixes an issue)
• Feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change
• Chore (non-breaking change which doesn't affect codebase;
  test, version modification, documentation, etc.)

Checklist

• Code contributed by me aligns with current project license: Apache 2.0
• I Added CHANGELOG entry regarding this change
• I have implemented unit tests to cover my changes
• I have added/updated the javadocs and other documentation accordingly
• No new bugs, code smells, etc. in SonarCloud report
• I tested my code in Kubernetes
• I tested my code in OpenShift

[rohanKanojia]

@coopstah13 : Could you please review it to see if it meets your expectations?

[shawkins]

@rohanKanojia unfortunately it still does have an issue. The remaining failures are related to:

java.security.InvalidAlgorithmParameterException: Curve not supported: secp256k1 (1.3.132.0.10)

JDK 15+ dropped support for secp256k1, but we're using a key from that algorithm for KubernetesClientLoadWithFipsProviderTest.

We can either:

• Bring back a little bit of our reliance on bouncy castle - however we don't need an optional dependency. If the user installs bc / bcfips as a provider this will work if we instead call KeyPairGenerator.getInstance("EC", bc_provider)
• Drop support for this EC - do we know what is in use for supported versions of kubernetes?

[coopstah13]

I think it would be acceptable to leave fall-back code with the optional dependency for supporting that. Basically, first you'd try to do it using JDK internals, but maybe catch the exception and fall back to the Callable code which lets it dynamically link to the BC dependency and leave BC as an optional dependency defined in your pom.

Appreciate the effort on this.

[shawkins]

I've opted for suggesting that BC be installed as a provider if there's a problem with the algorithm. This approach means that we won't have any direct compile / runtime dependency on BC.

[coopstah13]

this change seems odd to me

[shawkins]

Why? It's now a test dependency.

[sonarqubecloud]

Quality Gate failed

Failed conditions
73.2% Coverage on New Code (required ≥ 80%)

See analysis details on SonarCloud

[manusa]

LGTM, nice job.
Thx!