handshake is failing with the latest Kubernate version

[MohammadNC]

Hi Team,

Client Version
19.0.0

Java Version
Java 17

Hi Team,

My application works fine with the following Kubernetes versions:
Client Version: v1.23.10
Server Version: v1.23.10

However, when using the following versions, the application fails continuously and doesn't start up. Please refer to the logs below:
Client Version: v1.30.2
Server Version: v1.30.2

{"time_stamp":"2024-09-02 12:48:52.145+0000","thread":"main","level":"INFO","logger":"okhttp3.OkHttpClient","message":"--> GET https://10.233.0.1/api/v1/namespaces/amararaj-ns/secrets","loc":"okhttp3.internal.platform.Platform.log(Platform.kt:133)"
{"time_stamp":"2024-09-02 12:48:52.147+0000","thread":"main","level":"INFO","logger":"okhttp3.OkHttpClient","message":"Accept: application/json","loc":"okhttp3.internal.platform.Platform.log(Platform.kt:133)"
{"time_stamp":"2024-09-02 12:48:52.148+0000","thread":"main","level":"INFO","logger":"okhttp3.OkHttpClient","message":"Content-Type: application/json","loc":"okhttp3.internal.platform.Platform.log(Platform.kt:133)"
{"time_stamp":"2024-09-02 12:48:52.149+0000","thread":"main","level":"INFO","logger":"okhttp3.OkHttpClient","message":"User-Agent: Kubernetes Java Client/19.0.0-SNAPSHOT","loc":"okhttp3.internal.platform.Platform.log(Platform.kt:133)"
{"time_stamp":"2024-09-02 12:48:52.150+0000","thread":"main","level":"INFO","logger":"okhttp3.OkHttpClient","message":"Authorization: Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6IlplLVpTT2pzLXFPVmlPaXU2T3FYWnpvSFNGTVFEb09xN3hmdDM5aTFhSWsifQ.eyJhdWQiOlsiaHR0cHM6Ly9rdWJlcm5ldGVzLmRlZmF1bHQuc3ZjLmJ1bWJsZWJlZSJdLCJleHAiOjE3NTY4MTcyMjEsImlhdCI6MTcyNTI4MTIyMSwiaXNzIjoiaHR0cHM6Ly9rdWJlcm5ldGVzLmRlZmF1bHQuc3ZjLmJ1bWJsZWJlZSIsImp0aSI6IjY4ZGE3NTQxLTMwMzMtNDJjNi04YzZlLWFiZmZiNGY1YWRlOSIsImt1YmVybmV0ZXMuaW8iOnsibmFtZXNwYWNlIjoiYW1hcmFyYWotbnMiLCJub2RlIjp7Im5hbWUiOiJidW1ibGViZWUtazhzLW5vZGUtMTMiLCJ1aWQiOiIzMDRkZDVhNS0yZWU5LTQ1NDMtYWNkMi1jY2VkY2FiMmMyOGUifSwicG9kIjp7Im5hbWUiOiJvY3NjcC1zY3Atd29ya2VyLWI2ODg3NDVjNy1tcXdnbSIsInVpZCI6ImIzNmY2Y2ViLTdlMzktNDc3Zi04OTcwLWFkOWJmOWE0ODg5MyJ9LCJzZXJ2aWNlYWNjb3VudCI6eyJuYW1lIjoib2NzY3Atc2NwLXNlcnZpY2VhY2NvdW50IiwidWlkIjoiN2QzYmY5MDMtM2NjYy00MGNlLThhNDctYTM1NjBhYThiY2U0In0sIndhcm5hZnRlciI6MTcyNTI4NDgyOH0sIm5iZiI6MTcyNTI4MTIyMSwic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50OmFtYXJhcmFqLW5zOm9jc2NwLXNjcC1zZXJ2aWNlYWNjb3VudCJ9.HNNTNToPeZDzMBOBq3-Kglzy3frrXuHLqpTLvgv7fsoQ7n9yd4oitEdoYnPdcGmTQexLNcotbysdBG0YaJ1lcCXJxtE6uEYfam_tNYi-adyi3w9WxvCUVX04G1irtKsH8XUuyAmFXrhuTD3yoyLFQ6H4ospg379RC0J9nnTSX6mEGI1T825Hc8xmxOBvDxzVo9bzM5fq11cHwerw4U1_FWP37bIpQYA5jMbRJd4e_gx-UUQe6lD0Cjb9zVTuYOpCN_ZqeV-KIsAOlo20tS_gwByCGwUprmY5cYMMZ7muixhmI9r15m4F9yv2t1SSi1pr0SdXQCWfPyByquLFnsD9mQ","loc":"okhttp3.internal.platform.Platform.log(Platform.kt:133)"
{"time_stamp":"2024-09-02 12:48:52.151+0000","thread":"main","level":"INFO","logger":"okhttp3.OkHttpClient","message":"--> END GET","loc":"okhttp3.internal.platform.Platform.log(Platform.kt:133)"
{"time_stamp":"2024-09-02 12:48:53.258+0000","thread":"main","level":"INFO","logger":"okhttp3.OkHttpClient","message":"<-- HTTP FAILED: javax.net.ssl.SSLHandshakeException: Received fatal alert: protocol_version","loc":"okhttp3.internal.platform.Platform.log(Platform.kt:133)"
{"time_stamp":"2024-09-02 12:48:53.260+0000","thread":"main","level":"ERROR","logger":"ssl.util.CommonUtils","message":"Bad configuration.javax.net.ssl.SSLHandshakeException: Received fatal alert: protocol_version","loc":"ssl.util.CommonUtils.configureSsl(CommonUtils.java:143)"
Exception in thread "main" java.lang.reflect.InvocationTargetException
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.base/java.lang.reflect.Method.invoke(Method.java:568)
at org.springframework.boot.loader.MainMethodRunner.run(MainMethodRunner.java:49)
at org.springframework.boot.loader.Launcher.launch(Launcher.java:108)
at org.springframework.boot.loader.Launcher.launch(Launcher.java:58)
at org.springframework.boot.loader.JarLauncher.main(JarLauncher.java:65)
Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'initContainer': Injection of autowired dependencies failed; nested exception is ssl.util.ConfigException: javax.net.ssl.SSLHandshakeException: Received fatal alert: protocol_version
at org.springframework.beans.factory.annotation.AutowiredAnnotationBeanPostProcessor.postProcessProperties(AutowiredAnnotationBeanPostProcessor.java:414)
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.populateBean(AbstractAutowireCapableBeanFactory.java:1431)
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:619)
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:542)
at org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:336)
at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:234)
at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:334)
at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:209)
at org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingletons(DefaultListableBeanFactory.java:955)
at org.springframework.context.support.AbstractApplicationContext.finishBeanFactoryInitialization(AbstractApplicationContext.java:932)
at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:591)
at org.springframework.boot.web.servlet.context.ServletWebServerApplicationContext.refresh(ServletWebServerApplicationContext.java:147)
at org.springframework.boot.SpringApplication.refresh(SpringApplication.java:732)
at org.springframework.boot.SpringApplication.refreshContext(SpringApplication.java:409)
at org.springframework.boot.SpringApplication.run(SpringApplication.java:308)
at org.springframework.boot.SpringApplication.run(SpringApplication.java:1300)
at org.springframework.boot.SpringApplication.run(SpringApplication.java:1289)
at ssl.SslInitContainer.main(SslInitContainer.java:23)
... 8 more
Caused by: ssl.util.ConfigException: javax.net.ssl.SSLHandshakeException: Received fatal alert: protocol_version
at ssl.util.CommonUtils.configureSsl(CommonUtils.java:144)
at ssl.InitContainer.setConfigInfo(InitContainer.java:96)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.base/java.lang.reflect.Method.invoke(Method.java:568)
at org.springframework.beans.factory.annotation.AutowiredAnnotationBeanPostProcessor$AutowiredMethodElement.inject(AutowiredAnnotationBeanPostProcessor.java:782)
at org.springframework.beans.factory.annotation.InjectionMetadata.inject(InjectionMetadata.java:119)
at org.springframework.beans.factory.annotation.AutowiredAnnotationBeanPostProcessor.postProcessProperties(AutowiredAnnotationBeanPostProcessor.java:408)
... 25 more

please let me know if any additional configuration are need to make it work.

Additionally, I've noticed another issue: I've set a timeout for the following API, but it's not being applied, and my thread is getting stuck without exiting.

V1SecretList listSecret = new CoreV1Api().listNamespacedSecret(nameSpace, null, null, null, null,
null, null, null, null, null, 1, null);

Please advise on how to properly set the timeout for this API.

[brendandburns]

My guess is that the newest versions of Kubernetes don't support the older SSL protocol that you are using. I don't think that this is an issue with this client.

[MohammadNC]

Could you tell me where the Java Kubernetes client reads the supported TLS versions when it is initialized? In my Java application, it always defaults to TLSv1.2, even though I haven't specified the JVM argument -Djdk.tls.client.protocols.

[brendandburns]

This client doesn't do anything to configure particular TLS versions, that's set in your JVM.

My guess is that you are using an old version of Java 8 that doesn't support TLS 1.3

There's more info here:
https://www.java.com/en/configure_crypto.html

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle stale
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale