Cert manager in CLBO after update from 1.19.4 to version 1.20.3 with error "use of SHA-1 is not allowed in FIPS 140-only mode"

Products

• VMware vSphere Kubernetes Service

Issue/Introduction

After updating cert-manager in guest cluster from version 1.19.4 to version 1.20.3 the cert manager pod is in CLBO

 

Example update command:

tanzu package install update cert-manager \
  --package cert-manager.kubernetes.vmware.com \
  -n cert-manager \
  --version '1.20.3+vmware.1-vks.1'

 

kubectl get pods -A|grep cert
cert-manager                   cert-manager-############                             0/1     CrashLoopBackOff   1006 (4s ago)    4d22h
cert-manager                   cert-manager-approver-policy-############             1/1     Running            0                20d
cert-manager                   cert-manager-approver-policy-############             1/1     Running            0                104d
cert-manager                   cert-manager-cainjector-############                  1/1     Running            0                4d22h
cert-manager                   cert-manager-webhook-############                     1/1     Running            0                4d22h

 

kubectl describe pod cert-manager-############ -n cert-manager

kubelet  spec.containers{cert-manager-controller}: Back-off restarting failed container cert-manager-controller in pod cert-manager-############_cert-manager

 

kubectl logs cert-manager-############ -n cert-manager

panic: crypto/sha1: use of SHA-1 is not allowed in FIPS 140-only mode [recovered, repanicked]

Environment

VMware vSphere Kubernetes Service

Cause

cert-manager 1.20.3 and 1.21.1 implement a strict "fips140=only" mode 

Resolution

Update cert-manager changing the fips mode to "fips140=on"

 

1) Create an overlay file

cat patched-fips.yaml

#@ load("@ytt:overlay", "overlay")
#@overlay/match by=overlay.subset({"kind": "Deployment"}), expects="1+"
---
spec:
  template:
    spec:
      containers:
        env:
        #@overlay/match by="name"
        - name: GODEBUG
          value: fips140=on

 

2) Update cert-manager to 1.21.1 using the overlay file

 

Example update command:

tanzu package installed update cert-manager \
  --package cert-manager.kubernetes.vmware.com \
  -n cert-manager \
  --version '1.21.1+vmware.1-vks.1'\
  --ytt-overlay-file patched-fips.yaml