You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@knox.apache.org by "moresandeep (via GitHub)" <gi...@apache.org> on 2023/07/17 14:02:08 UTC
[GitHub] [knox] moresandeep opened a new pull request, #772: KNOX-2932 - Fix TLS Ciphers issue and add kerberos support to the docker image
moresandeep opened a new pull request, #772:
URL: https://github.com/apache/knox/pull/772
## What changes were proposed in this pull request?
Currently docker image appears to be broken with TLS failures, this appears to be due to the underlying alpine base image. This update upgrades the alpine base image (which also pulls in few security fixes) and adds support for kerberos.
## How was this patch tested?
This patch was tested locally.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@knox.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [knox] moresandeep merged pull request #772: KNOX-2932 - Fix TLS Ciphers issue and add kerberos support to the docker image
Posted by "moresandeep (via GitHub)" <gi...@apache.org>.
moresandeep merged PR #772:
URL: https://github.com/apache/knox/pull/772
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@knox.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [knox] risdenk commented on a diff in pull request #772: KNOX-2932 - Fix TLS Ciphers issue and add kerberos support to the docker image
Posted by "risdenk (via GitHub)" <gi...@apache.org>.
risdenk commented on code in PR #772:
URL: https://github.com/apache/knox/pull/772#discussion_r1265452807
##########
gateway-docker/src/main/resources/docker/Dockerfile:
##########
@@ -13,11 +13,11 @@
# See the License for the specific language governing permissions and
# limitations under the License.
-FROM openjdk:8-jre-alpine
+FROM openjdk:8-jre-alpine3.8
Review Comment:
openjdk images aren't updated anymore. see https://hub.docker.com/_/openjdk
you probably want to replace this with:
https://hub.docker.com/_/eclipse-temurin/tags?page=1&name=11-alpine
```
FROM eclipse-temurin:11-alpine
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@knox.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [knox] risdenk commented on a diff in pull request #772: KNOX-2932 - Fix TLS Ciphers issue and add kerberos support to the docker image
Posted by "risdenk (via GitHub)" <gi...@apache.org>.
risdenk commented on code in PR #772:
URL: https://github.com/apache/knox/pull/772#discussion_r1267135769
##########
gateway-docker/src/main/resources/docker/Dockerfile:
##########
@@ -13,11 +13,11 @@
# See the License for the specific language governing permissions and
# limitations under the License.
-FROM openjdk:8-jre-alpine
+FROM openjdk:8-jre-alpine3.8
Review Comment:
`openjdk` just isn't even an option anymore. Its not updated period. Even switching the tag. openjdk image is just plain wrong. See https://hub.docker.com/_/openjdk
> The only tags which will continue to receive updates beyond July 2022 will be Early Access builds (which are sourced from [jdk.java.net](https://jdk.java.net/)), as those are not published/supported by any of the above projects.
so really can't use `openjdk`
related to the error you are getting - I don't know.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@knox.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [knox] risdenk commented on a diff in pull request #772: KNOX-2932 - Fix TLS Ciphers issue and add kerberos support to the docker image
Posted by "risdenk (via GitHub)" <gi...@apache.org>.
risdenk commented on code in PR #772:
URL: https://github.com/apache/knox/pull/772#discussion_r1267265619
##########
gateway-docker/src/main/resources/docker/Dockerfile:
##########
@@ -13,11 +13,11 @@
# See the License for the specific language governing permissions and
# limitations under the License.
-FROM openjdk:8-jre-alpine
+FROM openjdk:8-jre-alpine3.8
Review Comment:
I mean https://issues.apache.org/jira/browse/KNOX-2932 doesn't detail anything about the docker image being broken. It talks about adding support for Kerberos - which is a new feature not necessarily meaning things are broken.
The title of the PR was updated to include "TLS Ciphers Issue" but no details as to what that means or why moving to 3.8 alpine actually fixes that.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@knox.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [knox] risdenk commented on a diff in pull request #772: KNOX-2932 - Fix TLS Ciphers issue and add kerberos support to the docker image
Posted by "risdenk (via GitHub)" <gi...@apache.org>.
risdenk commented on code in PR #772:
URL: https://github.com/apache/knox/pull/772#discussion_r1265647612
##########
gateway-docker/src/main/resources/docker/Dockerfile:
##########
@@ -13,11 +13,11 @@
# See the License for the specific language governing permissions and
# limitations under the License.
-FROM openjdk:8-jre-alpine
+FROM openjdk:8-jre-alpine3.8
Review Comment:
8-alpine exists too:
https://hub.docker.com/_/eclipse-temurin/tags?page=1&name=8-alpine
```
FROM eclipse-temurin:8-alpine
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@knox.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [knox] risdenk commented on a diff in pull request #772: KNOX-2932 - Fix TLS Ciphers issue and add kerberos support to the docker image
Posted by "risdenk (via GitHub)" <gi...@apache.org>.
risdenk commented on code in PR #772:
URL: https://github.com/apache/knox/pull/772#discussion_r1267138339
##########
gateway-docker/src/main/resources/docker/Dockerfile:
##########
@@ -13,11 +13,11 @@
# See the License for the specific language governing permissions and
# limitations under the License.
-FROM openjdk:8-jre-alpine
+FROM openjdk:8-jre-alpine3.8
Review Comment:
What command are you running to get that error? Does it happen everytime?
It looks like maybe TLS 1.3? Does Knox support TLS 1.3?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@knox.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [knox] moresandeep commented on a diff in pull request #772: KNOX-2932 - Fix TLS Ciphers issue and add kerberos support to the docker image
Posted by "moresandeep (via GitHub)" <gi...@apache.org>.
moresandeep commented on code in PR #772:
URL: https://github.com/apache/knox/pull/772#discussion_r1265645630
##########
gateway-docker/src/main/resources/docker/Dockerfile:
##########
@@ -13,11 +13,11 @@
# See the License for the specific language governing permissions and
# limitations under the License.
-FROM openjdk:8-jre-alpine
+FROM openjdk:8-jre-alpine3.8
Review Comment:
Thanks for @risdenk, yeah, noticed that, unfortunately (and frustratingly) we need support for Java 8. So, until we move away from Java 8 this is the best alternative i could find.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@knox.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [knox] moresandeep commented on a diff in pull request #772: KNOX-2932 - Fix TLS Ciphers issue and add kerberos support to the docker image
Posted by "moresandeep (via GitHub)" <gi...@apache.org>.
moresandeep commented on code in PR #772:
URL: https://github.com/apache/knox/pull/772#discussion_r1267169831
##########
gateway-docker/src/main/resources/docker/Dockerfile:
##########
@@ -13,11 +13,11 @@
# See the License for the specific language governing permissions and
# limitations under the License.
-FROM openjdk:8-jre-alpine
+FROM openjdk:8-jre-alpine3.8
Review Comment:
`curl -vvv -iku admin:admin-password https://localhost:8443/gateway/sandbox/knoxtoken/api/v1/token`
I understand it is wrong, but better than broken, right now Knox docker is broken. We need to fix it so atleast we have a working image then we can test with different base images and see which works.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@knox.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [knox] moresandeep commented on a diff in pull request #772: KNOX-2932 - Fix TLS Ciphers issue and add kerberos support to the docker image
Posted by "moresandeep (via GitHub)" <gi...@apache.org>.
moresandeep commented on code in PR #772:
URL: https://github.com/apache/knox/pull/772#discussion_r1267895593
##########
gateway-docker/src/main/resources/docker/Dockerfile:
##########
@@ -13,11 +13,11 @@
# See the License for the specific language governing permissions and
# limitations under the License.
-FROM openjdk:8-jre-alpine
+FROM openjdk:8-jre-alpine3.8
Review Comment:
The TLS issue was found while adding kerberos, this is how I noticed the image is broken. I am going to commit the changes and look for an official image that works. If you find something that work let us know I'd be happy to test.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@knox.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [knox] moresandeep commented on a diff in pull request #772: KNOX-2932 - Fix TLS Ciphers issue and add kerberos support to the docker image
Posted by "moresandeep (via GitHub)" <gi...@apache.org>.
moresandeep commented on code in PR #772:
URL: https://github.com/apache/knox/pull/772#discussion_r1267133229
##########
gateway-docker/src/main/resources/docker/Dockerfile:
##########
@@ -13,11 +13,11 @@
# See the License for the specific language governing permissions and
# limitations under the License.
-FROM openjdk:8-jre-alpine
+FROM openjdk:8-jre-alpine3.8
Review Comment:
I tried using `eclipse-temurin:8-alpine`, there are TLS issues with
```
* Trying 127.0.0.1:8443...
* Connected to localhost (127.0.0.1) port 8443 (#0)
* ALPN: offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS alert, user canceled (346):
* TLSv1.3 (IN), TLS alert, close notify (256):
* OpenSSL SSL_connect: SSL_ERROR_ZERO_RETURN in connection to localhost:8443
* Closing connection 0
curl: (35) OpenSSL SSL_connect: SSL_ERROR_ZERO_RETURN in connection to localhost:8443
```
I am not sure what the different is between this base image and the openjdk one but this appears broken (atleast as far as Knox is concerned).
Let me know if you have any concerns.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@knox.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [knox] moresandeep commented on a diff in pull request #772: KNOX-2932 - Fix TLS Ciphers issue and add kerberos support to the docker image
Posted by "moresandeep (via GitHub)" <gi...@apache.org>.
moresandeep commented on code in PR #772:
URL: https://github.com/apache/knox/pull/772#discussion_r1265657863
##########
gateway-docker/src/main/resources/docker/Dockerfile:
##########
@@ -13,11 +13,11 @@
# See the License for the specific language governing permissions and
# limitations under the License.
-FROM openjdk:8-jre-alpine
+FROM openjdk:8-jre-alpine3.8
Review Comment:
Interesting, i was looking for images by openjdk this is how I landed on jre-alpine3.8. I wasn't aware of the [Temurin](https://projects.eclipse.org/projects/adoptium.temurin), and reluctant to go with something that was not from openjdk. Looks like Temurin is a thing. I'll give this a try. Thanks for the inputs!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@knox.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org