Bug 1821228

Summary: Automatic unlock of root filesystem doesn't happen, with tang server configured with FQDN
Product: [Red Hat Storage] Red Hat Gluster Storage Reporter: SATHEESARAN <sasundar>
Component: gluster-ansibleAssignee: Gobinda Das <godas>
Status: CLOSED ERRATA QA Contact: SATHEESARAN <sasundar>
Severity: high Docs Contact:
Priority: unspecified    
Version: rhgs-3.5CC: godas, pprakash, puebele, rhs-bugs, sabose, sasundar
Target Milestone: ---Keywords: ZStream
Target Release: RHGS 3.5.z Batch Update 2   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: gluster-ansible-infra-1.0.4-8.el8rhgs,gluster-ansible-roles-1.0.5-8.el8rhgs Doc Type: No Doc Update
Doc Text:
Story Points: ---
Clone Of: 1821216 Environment:
rhhiv, rhel8
Last Closed: 2020-06-16 05:57:32 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1821216    

Description SATHEESARAN 2020-04-06 10:56:18 UTC 
Description of problem:
------------------------
After successfully configuring Network Bound Disk Encryption(NBDE) using Clevis-Tang, automatic unlock of root filesystem doesn't happen, only in the case when FQDN was used for tang server

Version-Release number of selected component (if applicable):
-------------------------------------------------------------
gluster-ansible-infra-1.0.4-7

How reproducible:
-----------------
Always

Steps to Reproduce:
--------------------
1. Configure NBDE with RHHI-B, post running ansible playbook that configures the same, with tang server having a FQDN
2. Reboot the host

Actual results:
----------------
Host doesn't automatically unlocks, Fails with 'Error communicating with server'

Expected results:
-----------------
Automatically unlock root filesystem  and server should be up, without waiting for root encryption passphrase

--- Additional comment from SATHEESARAN on 2020-04-06 10:26:30 UTC ---

It was with the help of Sergio Correia, we could root cause this problem

This is primarily because in RHEL 8, both 'network' and 'network-legacy' modules are loaded in initramfs
<snip>
[root@localhost ~]# lsinitrd /boot/initramfs-4.18.0-192.el8.x86_64.img | grep -i network
network-legacy
network
kernel-network-modules
</snip>

when 'network-legacy' module is removed ( as in Fedora 31 ), and using 'network-manager' everything works fine

Thanks Sergio for your efforts in help in RCA

--- Additional comment from SATHEESARAN on 2020-04-06 10:30:46 UTC ---

To fix the problem, the dracut drop-in configuration file ( /etc/dracut.conf.d/clevis.conf)  needs to be updated with following lines:


omit_dracutmodules+="network-legacy"
add_dracutmodules+="clevis network-manager"

Along with the original content of 'clevis.conf' file the following is the content:

</snip>
omit_dracutmodules+="ifcfg"
omit_dracutmodules+="network-legacy"
add_dracutmodules+="clevis network-manager"
</snip>
Comment 3 SATHEESARAN 2020-04-17 17:14:29 UTC 
Verified with gluster-ansible-infra-1.0.4-8.el8rhgs

1. Executed the playbook to setup NBDE, with DHCP based hostname for tang server
2. Post the playbook is executed successfully, reboot the host
3. Host could boot automatically without waiting passphrase prompt
Comment 5 errata-xmlrpc 2020-06-16 05:57:32 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2020:2575