rustls cannot use client-key in EC Private Keys format

[kazk]

rustls does not support EC Private Key (rustls/rustls#332).
This prevents using rustls with k3d cluster (after working around #153). Note that in-cluster config is not affected by this.

A workaround is to use OpenSSL to convert to PKCS#8 and update the config.

Get the client-key-data for the cluster and confirm that it's EC Private Key:

# replace `k3d-dev` with the name of your cluster
kubectl config view \
    --raw \
    -o jsonpath='{.users[?(@.name == "admin@k3d-dev")].user.client-key-data}' \
| base64 -d

-----BEGIN EC PRIVATE KEY-----
................................................................
................................................................
.....................
-----END EC PRIVATE KEY-----

Convert to PKCS#8 with OpenSSL and update the config:

kubectl config view \
    --raw \
    -o jsonpath='{.users[?(@.name == "admin@k3d-dev")].user.client-key-data}' \
| base64 -d \
| openssl pkcs8 -topk8 -nocrypt \
| base64 -w0 \
| xargs -I{} kubectl config set [email protected] {}

Don't forget to also change server to use localhost for #153.

kubectl config view \
    --raw \
    -o jsonpath='{.clusters[?(@.name == "k3d-dev")].cluster.server}' \
| sed 's/0\.0\.0\.0/localhost/' \
| xargs -I{} kubectl config set clusers.k3d-dev.server {}

[olix0r]

This prevents using rustls with k3d cluster (after working around #153).

Interestingly, we're using kube-rs without issue on k3d (from within the cluster using service account tokens, not using the admin kubeconfig). Presumably, this is because in this case we use bearer auth to the API and don't need to parse PEM-formatted EC keys?

Though, we have users hitting this problem in other contexts: linkerd/linkerd2#7011

[kazk]

from within the cluster using service account tokens, not using the admin kubeconfig

Workaround for #153 is no longer necessary for in-cluster connection since kube 0.59.0 because kubernetes.default.svc is used (#597).

Presumably, this is because in this case we use bearer auth to the API and don't need to parse PEM-formatted EC keys?

Yes

https://github.com/kube-rs/kube-rs/blob/50acf98ce7513809634d297392663539c06478c2/kube/src/client/tls.rs#L87-L90

Updated the issue to mention in-cluster config is not affected. Thanks.