kubernetes: dnf/yum/rpm installation of Kubernetes packages from official repos fails on RHEL 8 systems with FIPS enabled

What happened: yum/dnf/rpm installation of kubernetes packages from the official repo fail on RHEL 8 machines with FIPS enabled.

yum/dnf installations fail with:

package: <kubernetes_package> does not verify: no digest

rpm --checksig <kubernetes_rpm>

fails with: <kubernetes_package>: DIGESTS signatures NOT OK

What you expected to happen: yum/dnf/rpm installation complete successfully.

How to reproduce it (as minimally and precisely as possible):

fips-mode-setup --enable
systemctl reboot
dnf install <kubernetes package>

Anything else we need to know?: Please see attached screenshot which points out a missing Payload SHA256 digest. Red Hat recommends building the RPMs with rpm 4.14 so the entire package payload is signed. Please see rpm error “does not verify: no digest” and 8.0 Release Notes - Section 5.1.4 Software Management: RPM now validates the entire package contents before starting an installation

I assume this would also affect CentOS 8; however, I do not have an instance to test.

Environment:

Kubernetes version (use kubectl version): 1.18.4
Cloud provider or hardware configuration:
OS (e.g: cat /etc/os-release): RHEL 8.2 (Ootpa)
Kernel (e.g. uname -a): 4.18.0-193.14.3.el8_2.x86_64
Install tools: kubeadm
Network plugin and version (if this is a network-related bug): kubernetes-cni 0.8.7-0
Others:

About this issue

Original URL
State: closed
Created 4 years ago
Comments: 27 (18 by maintainers)

Most upvoted comments

This was where the build was https://github.com/kubernetes/release/tree/master/packages/rpm

but I’m not sure what the OBS effort is doing exactly. I’d suggest checking in with the release-packages-poc group

BenTheElder on Aug 29, 2023

My team only runs the builds and publishes them to the registry, the sources for the build are in https://github.com/kubernetes/release/tree/master/packages

Ideally these should be community run and community published, but for now the community still relies on the GCP package host, so we have to publish the builds, and currently the k/k release build doesn’t build RPMs/DEBs either so we also run the scripts in order to have something to publish. But we don’t work on the deb/rpm build system and don’t consume these ourselves.

Agreed, would be the best if the community that uses the RPM packaging schema for k/k help in this effort. /help

go.k8s.io/oncall <-- google-build-admin, I am going OOO for real now 😃

Enjoy 😃

dougsland on Jul 15, 2021