X509Certificate Exception with BuildConfigFromConfigFile

[dontspeak]

I have a .kubeconfig file that is perfectly working when I use kubectl via windows command line or powershell.

But when I try to initialize

var config = KubernetesClientConfiguration.BuildConfigFromConfigFile(configFile);

I immediately get an exception "Object not found" with following stacktrace.

How can I solve that? Thank you.

bei Internal.Cryptography.Pal.CertificatePal.FromBlobOrFile(ReadOnlySpan1 rawData, String fileName, SafePasswordHandle password, X509KeyStorageFlags keyStorageFlags)
bei System.Security.Cryptography.X509Certificates.X509Certificate..ctor(ReadOnlySpan1 data)
bei k8s.KubernetesClientConfiguration.SetClusterDetails(K8SConfiguration k8SConfig, Context activeContext)
bei k8s.KubernetesClientConfiguration.InitializeContext(K8SConfiguration k8SConfig, String currentContext)
bei k8s.KubernetesClientConfiguration.GetKubernetesClientConfiguration(String currentContext, String masterUrl, K8SConfiguration k8SConfig)
bei k8s.KubernetesClientConfiguration.d__19.MoveNext()
bei k8s.KubernetesClientConfiguration.BuildConfigFromConfigFile(FileInfo kubeconfig, String currentContext, String masterUrl, Boolean useRelativePaths)

[tg123]

could you please try embed cert?
if it works, i believe it is either permission issue or sdk bug.

[dontspeak]

Sorry for delay, will answer quikly now.

How do you mean that, "embed cert" ?

[dontspeak]

Anyone?

[tg123]

embed:
certificate-authority-data: LS0tLS1CRUdJT......

non-embed
client-certificate: client.crt

[dontspeak]

Hi, its already embedded. Here is the cubeconfig Im using, with all names and ip replaced:

apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: LS0tLS1CR[...]tLQ==
    server: https://12.34.56.78:6443
  name: mycluster
contexts:
- context:
    cluster: mycluster
    user: mycluster-user
  name: mycluster-user
current-context: mycluster-user
kind: Config
preferences: {}
users:
- name: mycluster-user
  user:
    client-certificate-data: LS0tLS[...]LS0=
    client-key-data: LS0tLS1[...]S0t

[tg123]

could you please share your cluster CA data? do not paste key here

[dontspeak]

LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUZQRENDQXlTZ0F3SUJBZ0lVUlRHWHJKeVNvc0tXNjdQSGxadDg3SmxSRitRd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0Z6RVZNQk1HQTFVRUF4TU1hemh6TWkxak5URndNRGc1TUNJWUR6QXdNREV3TVRBeE1EQXdNREF3V2hnUApNakV5TVRBMk1UUXdPRFEwTURCYU1CY3hGVEFUQmdOVkJBTVRER3M0Y3pJdFl6VXhjREE0T1RDQ0FpSXdEUVlKCktvWklodmNOQVFFQkJRQURnZ0lQQURDQ0Fnb0NnZ0lCQUxyVnVlOHNjS2xDdHhLTHdpbkRscTdLQ3hTUXBoangKeEVHUzRLV3UzV0crMWJXc2Njc1ZLcWNxTFJCVTBEcUhZK25Wb1doYzBUbGdzT0RDbEd4WE9sbjhRdGhVbjJwMwpLNlBqUmk4bVkxeEZzRGtwNS84RjF5TXFlMnFtcE9JM3ROWnRoQjQrVHlFbGd6MUZoWGY0Z1J4VHd0cFV5TWhMCkNhWnFLOGVGNUpqVC9yMWRaU1E5SG1FeGh6djR1RitCeFVRUFNZditWdkpLbVc0ZUJPRFcrVnNRd0RPaWlOUE4KWitzSWsxL0Vvd0krMXJOcUl6NTE1UkVLd0VwOERxRFRRTlphSHhDdGZ5YTZ6dS8wZXYrbm9kZXp6TXZPVTVuTgpIYXI2RjRqRStmSHY0K3NOMVMyYVV4Vmh5aTQxY09zb2dYeWQyVzhTamY0Q0hCK1JVWFVPd2lFZ3J3NWhqeVlLCjRRWTkwTUt6K2g2RG1CblRnRFUyVEM0Q2FqWEpPNFNSc1dPOEVBWkJqTDVGN25KZFZ0K2lzcWtzOWxPMHJHQXQKdFNOYnRCZFlxd2QrK1dYN1VyK3FTaHVwdmtLbUM3TUxVeE5TZnk2QUtOUXFaSWxxVUkzZE5pSWNYUGdOU3J4TgpDMEhCWnpHV3d0TG9Yb0U5bEtzeHBPMzNuMVNmYmR3OVhkczlFNFp1c0NHcllXVVc5UE1SSzFpTHRUU3V4Yk5zCldqcE4ySEZrNkRzN2YrOXpsUi9ENWJMeWlZeWhuNlBsU1MyMXVrejY2N0ZEME5ReGhYSUlyTnNXU3FUN2dMb0sKWDBzV2JrWVYwZmNPV0FqcGszV3M0U0kwN3pyS1Z5MkRzOGVrNXZKNUhxN0JESXRiMS8raUgvSXN5aWNJaXdiYQpZdWt2MElJS3ljVzdBZ01CQUFHamZEQjZNQTRHQTFVZER3RUIvd1FFQXdJQkJqQVBCZ05WSFJNQkFmOEVCVEFECkFRSC9NQjBHQTFVZERnUVdCQlRERHMwY05ZK1B6a2x2MWRPNndDWVQvZ3d3dHpBZkJnTlZIU01FR0RBV2dCVEQKRHMwY05ZK1B6a2x2MWRPNndDWVQvZ3d3dHpBWEJnTlZIUkVFRURBT2dneHJPSE15TFdNMU1YQXdPRGt3RFFZSgpLb1pJaHZjTkFRRUxCUUFEZ2dJQkFGc1BpU3pRSTd3OFQrRCtsVlVhVWRtczc2NFNnQW1IZWwwbE1ZcEtpSTY2Ck1hT1NOVVp3WDYzOFgxd0VhNmU1Q1pzQWlmMUVkU0k4V0pJeHpxc2tGTm9SSUVTQjdrU1Z4YktIOEZkY1dGVkwKTkhEdUhPaUpUeHNzb2h4YnQzR09TQ245Qk05RDkxRWQ5Tlk5SWZqdDVmb2ZqcWRDY04yRkhhczF4b0N2QTF3cgorTFNCMmpBZmJjQTdkUG5pV0RuUDljZjZkcnBVdzdRRHVvZWVqNnZwSG1pNDJ1cUM5Tjc1ZUVYQ2RLOWFhdW10Cng4NkNqUzlmS1c3dTBUSWFERjQvc1d0RXRLN1gzNkw3RVh6eFJzTmhTRHRqSGhFSHdUa0U0dndzVmZQcVptUTUKSEZZUEljZzJRdDNZWlp3L0lsaFdhOWhPaE56SHpsN2lRNHhKSEZVQmhBNzRlcHowaTVkdk1URFpWYUNkbFdEWgo4dUFqMGhIU04yTTRhdElJMFpwbTNrbnNHQ2Z1ZjVuSW4xdTZCdW5SNGx5bWY3QWJOSnhJM1hmaitQWHJOTmtUCldoODI2NXpENjhiL2Nlc3Y4QzA1Y1p6Q0JUUC80OHJqMTFtUzAvYzFSbGZPY25XcHBiWHJYVjZhNGJzSUk5NmQKS1pDTUtQUXB3SnppcDZ1N2I1K1FheXhFcSt0SExjWEhOZ1JGazVaK3NleDVVcUtJczZUcjN2Tk9OYmhCS1NYdwpLQmtyUXB2OFFQUXRZd0IrZlZkOS9YVHcxdCt0N1RwSGF0UnNYRnAzZnJnL2RqdlJTL0VJdDlWeTVxNUZrOUJCCnVUdzR2MStOaUN3QkU3U2tYVXVBZTdsZ21zL1pjQ1pOQzEzTTQ0ZS9FalZoZHJnQ2dLUVNVQkpvT05PcmZFK0sKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQ==

[dontspeak]

any idea what this could be?

[tg123]

w32 err CRYPT_E_NO_MATCH

seems cant parse your cert
could you please put all cert in chain to base64?

[koureasstavros]

For my case is working using embed (certificate-authority-data) while running my app localhost
I am using this custom method to convert from base64Pem to X509

public static X509Certificate2 Base64PemToX509(string base64)
{
    //X509Certificate2 EXECUTES ON SERVER SIDE ONLY
    byte[] bytes = Convert.FromBase64String(base64);
    var cert = new X509Certificate2(bytes);
    return cert;
}

But, the same error occurs when I am publishing the app into Azure WebApp.

[tg123]

@koureasstavros did you also put all chain to base64 when deploying webapp?

[koureasstavros]

I manage to solve this yesterday by adding an environmental variable into the WebApp from the Azure Portal
WEBSITE_LOAD_USER_PROFILE=1
Documentation says that Cryptography need user profile to be able to operate properly but not sure exactly if this affects something else into the application.