Remove openssl in favor of rustls-tls

[jpmcb]

Issue number:

N/a

Description of changes:

This PR removes our dependency on OpenSSL in favor of using rustls-tls

Testing done:

Built and pushed a custom image with these changes. Modified our bottlerocket-update-operator.yaml to use that image.
Integration tests pass!

Putting this patch up for now to get some early feedback and iteration, but could use additional validation for:

• IPv6 cluster upgrades work
• IPv4 cluster upgrades work

Terms of contribution:

By submitting this pull request, I agree that this contribution is dual-licensed under the terms of both the Apache License, version 2.0, and the MIT license.

[jpmcb]

I know what you're thinking.

"But John, I thought rustls-tls in kube didn't work with IPv6 clusters since webpki can't resolve hostnames via IP addresses?"

Thankfully, in d2b5d78 we switched to using the suggested work-around of reaching the kubernetes API server in cluster through kubernetes DNS. We now build our k8s clients by defining that they should use the incluster_dns in their config:

    let incluster_config =
        kube::Config::incluster_dns().context(controller_error::ConfigCreateSnafu)?;

    let k8s_client = kube::client::Client::try_from(incluster_config)
        .context(controller_error::ClientCreateSnafu)?;

So nothing right now is necessarily preventing us from using the rustls-tls feature in kube.

And it also looks like the next version of rustls-tls will have a fix for this upstream (which was fixed in their fork of webpki). This should flow downstream to kube and we can get the benefit of this if we need to create outside cluster clients in the future. Exciting stuff!

[jpmcb]

Testing in both IPv4 and IPv6 clusters looks good! Marking ready for review

[jpmcb]

Force pushed to address comments above and remove unused reqwest dependency in agent. Running through another quick integration test validation ✅

Further validation:

❯ rg -i openssl
CHANGELOG.md
20:* Upgraded Bottlerocket SDK to consume fix for OpenSSl CVE-2022-3602 and CVE-2022-3786 ([#331])

deny.toml
20:    "OpenSSL",
58:expression = "MIT AND ISC AND OpenSSL"

Cargo.lock
2187:name = "openssl-probe"
2633: "openssl-probe",

Looks like openssl-probe is a dependency of rustls-native-certs in the rustls dependency chain 👍🏼 no other cases of openssl in the cargo toml

[jpmcb]

Force pushed to rebase on develop which had removed webpki-roots in deny.toml. Added that exception back since the rustls dependency chain uses it.

---

Edit: integration test passed with the latest force push. All nodes upgrade from 1.9.0 to the latest bottlerocket

❯ k get brs -A
NAMESPACE                 NAME                                                STATE   VERSION   TARGET STATE   TARGET VERSION   CRASH COUNT
brupop-bottlerocket-aws   brs-ip-192-168-130-3.us-west-2.compute.internal     Idle    1.12.0    Idle                            0
brupop-bottlerocket-aws   brs-ip-192-168-134-58.us-west-2.compute.internal    Idle    1.12.0    Idle                            0
brupop-bottlerocket-aws   brs-ip-192-168-154-241.us-west-2.compute.internal   Idle    1.12.0    Idle                            0

[stmcginnis]

Looks good to me and all tests are passing.

[cbgbt]

🚀