Kubernetes - PEM is invalid: no begin marker

原创已于 2022-03-09 19:39:41 修改 · 1.3k 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#Kubernetes #K8S #Docker #PEM is invalid #no begin marker

于 2020-11-23 11:22:16 首次发布

Kubernetes 专栏收录该内容

26 篇文章

订阅专栏

本文解决了一个在fabric8 Kubernetes客户端中ConfigBuilder使用withClientKeyData()方法时出现的问题，该方法在3.1.8版本中无法正确处理密钥数据，通过将密钥数据Base64编码后传递解决了此问题。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

ConfigBuilder.withClientKeyData() is broken in 3.1.8.

withClientCertData and withCaCertData work just fine.

The following code snippit shows the problem and the workaround.

boolean useWorkaround = true;
if (useWorkaround) {
    File tempWorkaroundFile = null;
    try {
        tempWorkaroundFile = java.nio.file.Files.createTempFile("workaround", "tmp").toFile();
        Files.write(key, tempWorkaroundFile, Charsets.UTF_8);
        configBuilder = configBuilder.withClientCertFile(tempWorkaroundFile.getAbsolutePath());
    } finally {
        tempWorkaroundFile.delete();
    }
 } else {
    configBuilder = configBuilder.withClientKeyData(key);
}

The problem manifests as:

Caused by: java.io.IOException: PEM is invalid: no begin marker
	at io.fabric8.kubernetes.client.internal.CertUtils.decodePem(CertUtils.java:220)
	at io.fabric8.kubernetes.client.internal.CertUtils.createKeyStore(CertUtils.java:105)
	at io.fabric8.kubernetes.client.internal.CertUtils.createKeyStore(CertUtils.java:196)
	at io.fabric8.kubernetes.client.internal.SSLUtils.keyManagers(SSLUtils.java:127)
	at io.fabric8.kubernetes.client.internal.SSLUtils.keyManagers(SSLUtils.java:121)
	at io.fabric8.kubernetes.client.utils.HttpClientUtils.createHttpClient(HttpClientUtils.java:64)
	... 38 more

ConfigBuilder appears to be auto-generated so it is not clear to me how to fix this.

解决方案

It’s not a bug I learned with trial and error. Although it would make sense that the method would accept the contents of the file (which is already armored plaintext), it wants to see the key/cert data base64 encoded again.

Ps：看源码就知道，每次密钥文件会进行 base64 解密，但是这个解密并不是必然事件，随机性的，所以当不必要 base64 解密的时候但是源码进行了解密的话就会出现乱码问题，导致上面的报错信息，所以可以统一给密钥文件先加密 base64。