When creating a kafka instance, we get Error: "PBEWithHmacSHA256AndAES_256 AlgorithmParameters not available"

[javiermmenendez]

After installing operator, we create a Kafka CR and we get this error:
2022-11-25 11:53:37 ERROR AbstractOperator:258 - Reconciliation #1(watch) Kafka(pos-dev/borrar-pos-kafka): createOrUpdate failed
java.lang.RuntimeException: java.io.IOException: getPBEAlgorithmParameters failed: PBEWithHmacSHA256AndAES_256 AlgorithmParameters not available
at io.strimzi.operator.cluster.model.Ca.generateCaKeyAndCert(Ca.java:1031) ~[io.strimzi.operator-common-0.32.0.jar:0.32.0]
at io.strimzi.operator.cluster.model.Ca.createRenewOrReplace(Ca.java:542) ~[io.strimzi.operator-common-0.32.0.jar:0.32.0]
at io.strimzi.operator.cluster.operator.assembly.CaReconciler.lambda$reconcileCas$7(CaReconciler.java:269) ~[io.strimzi.cluster-operator-0.32.0.jar:0.32.0]
at io.vertx.core.impl.ContextBase.lambda$null$0(ContextBase.java:137) ~[io.vertx.vertx-core-4.3.4.jar:4.3.4]
at io.vertx.core.impl.ContextInternal.dispatch(ContextInternal.java:264) ~[io.vertx.vertx-core-4.3.4.jar:4.3.4]
at io.vertx.core.impl.ContextBase.lambda$executeBlocking$1(ContextBase.java:135) ~[io.vertx.vertx-core-4.3.4.jar:4.3.4]
at io.vertx.core.impl.TaskQueue.run(TaskQueue.java:76) ~[io.vertx.vertx-core-4.3.4.jar:4.3.4]
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128) ~[?:?]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628) ~[?:?]
at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30) ~[io.netty.netty-common-4.1.77.Final.jar:4.1.77.Final]
at java.lang.Thread.run(Thread.java:829) ~[?:?]
Caused by: java.io.IOException: getPBEAlgorithmParameters failed: PBEWithHmacSHA256AndAES_256 AlgorithmParameters not available
at sun.security.pkcs12.PKCS12KeyStore.getPBEAlgorithmParameters(PKCS12KeyStore.java:807) ~[?:?]
at sun.security.pkcs12.PKCS12KeyStore.encryptContent(PKCS12KeyStore.java:1895) ~[?:?]
at sun.security.pkcs12.PKCS12KeyStore.createEncryptedData(PKCS12KeyStore.java:1775) ~[?:?]
at sun.security.pkcs12.PKCS12KeyStore.engineStore(PKCS12KeyStore.java:1231) ~[?:?]
at sun.security.util.KeyStoreDelegator.engineStore(KeyStoreDelegator.java:189) ~[?:?]
at java.security.KeyStore.store(KeyStore.java:1411) ~[?:?]
at io.strimzi.certs.OpenSslCertManager.addCertToTrustStore(OpenSslCertManager.java:347) ~[io.strimzi.certificate-manager-0.32.0.jar:0.32.0]
at io.strimzi.operator.cluster.model.Ca.generateCaKeyAndCert(Ca.java:1010) ~[io.strimzi.operator-common-0.32.0.jar:0.32.0]
... 10 more
Caused by: java.security.NoSuchAlgorithmException: PBEWithHmacSHA256AndAES_256 AlgorithmParameters not available
at sun.security.jca.GetInstance.getInstance(GetInstance.java:159) ~[?:?]
at java.security.Security.getImpl(Security.java:779) ~[?:?]
at java.security.AlgorithmParameters.getInstance(AlgorithmParameters.java:158) ~[?:?]
at sun.security.pkcs12.PKCS12KeyStore.getPBEAlgorithmParameters(PKCS12KeyStore.java:803) ~[?:?]
at sun.security.pkcs12.PKCS12KeyStore.encryptContent(PKCS12KeyStore.java:1895) ~[?:?]
at sun.security.pkcs12.PKCS12KeyStore.createEncryptedData(PKCS12KeyStore.java:1775) ~[?:?]
at sun.security.pkcs12.PKCS12KeyStore.engineStore(PKCS12KeyStore.java:1231) ~[?:?]
at sun.security.util.KeyStoreDelegator.engineStore(KeyStoreDelegator.java:189) ~[?:?]
at java.security.KeyStore.store(KeyStore.java:1411) ~[?:?]
at io.strimzi.certs.OpenSslCertManager.addCertToTrustStore(OpenSslCertManager.java:347) ~[io.strimzi.certificate-manager-0.32.0.jar:0.32.0]
at io.strimzi.operator.cluster.model.Ca.generateCaKeyAndCert(Ca.java:1010) ~[io.strimzi.operator-common-0.32.0.jar:0.32.0]

To Reproduce

1. Create a Kafka instance

Expected behavior
2. Start of Kafka instance in namespace

Environment (please complete the following information):

• 0.32.0, Also tested 0.30.0
• Installation method: YAML files
• Kubernetes cluster: OpenShift 4.10

YAML files and logs
files.zip

[scholzj]

Any chance you are running on FIPS enabled Kubernetes cluster?

[javiermmenendez]

Hello, thanks for your help. Regarding tour question, yes, we have installed OpenShift with FIPS enabled.
Do you know if there is a kind of configuration in order to change crypto algorithms in operator ?

[scholzj]

In that case, you have to follow the docs to disable FIPS: https://strimzi.io/docs/operators/latest/full/configuring.html#proc-configuring-fips-mode-cluster-operator-str

There should be improved FIPS support in Strimzi 0.33.

[javiermmenendez]

Tested and working.
Thanks