Bug 1821216

Summary: Automatic unlock of root filesystem doesn't happen, with tang server configured with FQDN
Product: [Red Hat Storage] Red Hat Gluster Storage Reporter: SATHEESARAN <sasundar>
Component: rhhiAssignee: Gobinda Das <godas>
Status: CLOSED ERRATA QA Contact: SATHEESARAN <sasundar>
Severity: high Docs Contact:
Priority: unspecified    
Version: rhgs-3.5CC: rhs-bugs
Target Milestone: ---   
Target Release: RHHI-V 1.8   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: gluster-ansible-infra-1.0.4-8.el8rhgs Doc Type: No Doc Update
Doc Text:
Story Points: ---
Clone Of:
: 1821228 (view as bug list) Environment:
Last Closed: 2020-08-04 14:52:07 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1821228    
Bug Blocks: 1779977    

Description SATHEESARAN 2020-04-06 10:17:25 UTC 
Description of problem:
------------------------
After successfully configuring Network Bound Disk Encryption(NBDE) using Clevis-Tang, automatic unlock of root filesystem doesn't happen, only in the case when FQDN was used for tang server

Version-Release number of selected component (if applicable):
-------------------------------------------------------------
gluster-ansible-infra-1.0.4-7

How reproducible:
-----------------
Always

Steps to Reproduce:
--------------------
1. Configure NBDE with RHHI-B, post running ansible playbook that configures the same, with tang server having a FQDN
2. Reboot the host

Actual results:
----------------
Host doesn't automatically unlocks, Fails with 'Error communicating with server'

Expected results:
-----------------
Automatically unlock root filesystem  and server should be up, without waiting for root encryption passphrase
Comment 1 SATHEESARAN 2020-04-06 10:26:30 UTC 
It was with the help of Sergio Correia, we could root cause this problem

This is primarily because in RHEL 8, both 'network' and 'network-legacy' modules are loaded in initramfs
<snip>
[root@localhost ~]# lsinitrd /boot/initramfs-4.18.0-192.el8.x86_64.img | grep -i network
network-legacy
network
kernel-network-modules
</snip>

when 'network-legacy' module is removed ( as in Fedora 31 ), and using 'network-manager' everything works fine

Thanks Sergio for your efforts in help in RCA
Comment 2 SATHEESARAN 2020-04-06 10:30:46 UTC 
To fix the problem, the dracut drop-in configuration file ( /etc/dracut.conf.d/clevis.conf)  needs to be updated with following lines:


omit_dracutmodules+="network-legacy"
add_dracutmodules+="clevis network-manager"

Along with the original content of 'clevis.conf' file the following is the content:

</snip>
omit_dracutmodules+="ifcfg"
omit_dracutmodules+="network-legacy"
add_dracutmodules+="clevis network-manager"
</snip>
Comment 4 SATHEESARAN 2020-04-17 17:15:08 UTC 
Verified with gluster-ansible-infra-1.0.4-8.el8rhgs

1. Executed the playbook to setup NBDE, with DHCP based hostname for tang server
2. Post the playbook is executed successfully, reboot the host
3. Host could boot automatically without waiting passphrase prompt
Comment 6 errata-xmlrpc 2020-08-04 14:52:07 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (RHHI for Virtualization 1.8 bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2020:3314