tls: client offered only unsupported versions

[theautoroboto]

Expected Behavior

tekton-triggers-core-interceptors v0.21.0 pod to run as expected on OpenShift v4.10.30

The deployment process has been tested on v0.20.0, v0.20.1, and v0.20.2 without issue

Actual Behavior

tekton-triggers-core-interceptors v0.21.0 pod fails with the error

http: TLS handshake error from 10.128.2.1:36306: tls: client offered only unsupported versions: [303]

Steps to Reproduce the Problem

1. Deploy fresh or update to v0.21.0/interceptors.yaml

kubectl apply -f https://storage.googleapis.com/tekton-releases/triggers/previous/v0.21.0/interceptors.notags.yaml
or
kubectl apply -f https://storage.googleapis.com/tekton-releases/triggers/previous/v0.21.0/interceptors.yaml

Additional Info

• Kubernetes version:

Client Version: 4.11.2
Kustomize Version: v4.5.4
Server Version: 4.10.30
Kubernetes Version: v1.23.5+012e945

• Tekton Pipeline version:

v0.40.2

• pods logs

{"level":"info","ts":1665673664.7329836,"logger":"fallback","caller":"injection/injection.go:61","msg":"Starting informers..."}
{"level":"info","ts":1665673668.7711773,"caller":"interceptors/main.go:178","msg":"Listen and serve on port 8443"}
2022/10/13 15:07:52 http: TLS handshake error from 10.128.2.1:54862: tls: client offered only unsupported versions: [303]
2022/10/13 15:08:02 http: TLS handshake error from 10.128.2.1:49866: tls: client offered only unsupported versions: [303]
2022/10/13 15:08:12 http: TLS handshake error from 10.128.2.1:33576: tls: client offered only unsupported versions: [303]
2022/10/13 15:08:22 http: TLS handshake error from 10.128.2.1:53678: tls: client offered only unsupported versions: [303]

[dibyom]

/cc @savitaashture @khrm

[savitaashture]

Hi @theautoroboto

I tried installing Pipeline and Triggers on Openshift v4.10.30

Openshift Version

$ oc version
Client Version: 4.6.8
Server Version: 4.10.30
Kubernetes Version: v1.23.5+012e945

Tekton Component Version

$ tkn version
Client version: 0.23.1
Pipeline version: v0.40.2
Triggers version: v0.21.0

When i send curl request to Triggers eventlistener i get success result

Here is the tekton-triggers-core-interceptors pod logs

$ kubectl logs -f tekton-triggers-core-interceptors-856fdf766c-h8rkc -n tekton-pipelines


{"level":"info","ts":1666880213.9664106,"logger":"fallback","caller":"injection/injection.go:61","msg":"Starting informers..."}
{"level":"info","ts":1666880215.8424182,"caller":"interceptors/main.go:178","msg":"Listen and serve on port 8443"}
{"level":"info","ts":1666881224.9199014,"caller":"server/server.go:150","msg":"Interceptor response is: &{Extensions:map[] Continue:true Status:{Code:OK Message:}}"}
{"level":"info","ts":1666881224.92724,"caller":"server/server.go:150","msg":"Interceptor response is: &{Extensions:map[] Continue:true Status:{Code:OK Message:}}"}

Let me know if you still get the issues as i am not able to reproduce it

[jfuerneisen]

Hi,

we have the same issue in an openshift 4.11.12 cluster

kubernetes version v1.24.6+5157800

$ tkn version
Client version: 0.24.0
Pipeline version: v0.41.0
Triggers version: v0.21.0
Dashboard version: v0.30.0

we are running the same setup on an okd 4.11.0-0.okd-2022-11-05-030711 cluster
kubernetes version v1.24.0-2566+5157800f2a3bc3-dirty

$ tkn version
Client version: 0.24.0
Pipeline version: v0.41.0
Triggers version: v0.21.0
Dashboard version: v0.30.0

A big difference between these clusters is, that the openshift cluster has fips enabled the okd runs without fips.

Can u maybe confirm if u have (not) fips enabled... @theautoroboto @savitaashture

with v0.20.2 everything works fine on both clusters.

[theautoroboto]

Yes, we have fips enabled

[tekton-robot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale with a justification.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close with a justification.
If this issue should be exempted, mark the issue as frozen with /lifecycle frozen with a justification.

/lifecycle stale

Send feedback to tektoncd/plumbing.

[savitaashture]

/remove-lifecycle stale

[jfuerneisen]

$ tkn version
Client version: 0.28.0
Pipeline version: v0.44.0
Triggers version: v0.22.2
Dashboard version: v0.32.0

openshift 4.12.3
kubernetes v1.25.4+a34b9e9
fips enabled

Everything works now.

[tekton-robot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale with a justification.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close with a justification.
If this issue should be exempted, mark the issue as frozen with /lifecycle frozen with a justification.

/lifecycle stale

Send feedback to tektoncd/plumbing.

[tekton-robot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten with a justification.
Rotten issues close after an additional 30d of inactivity.
If this issue is safe to close now please do so with /close with a justification.
If this issue should be exempted, mark the issue as frozen with /lifecycle frozen with a justification.

/lifecycle rotten

Send feedback to tektoncd/plumbing.

[tekton-robot]

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen with a justification.
Mark the issue as fresh with /remove-lifecycle rotten with a justification.
If this issue should be exempted, mark the issue as frozen with /lifecycle frozen with a justification.

/close

Send feedback to tektoncd/plumbing.

[tekton-robot]

@tekton-robot: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen with a justification.
Mark the issue as fresh with /remove-lifecycle rotten with a justification.
If this issue should be exempted, mark the issue as frozen with /lifecycle frozen with a justification.

/close

Send feedback to tektoncd/plumbing.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.