Bug 1995047
| Summary: | Typo in error message when using incorrect VAULT_BACKEND value | ||
|---|---|---|---|
| Product: | [Red Hat Storage] Red Hat OpenShift Container Storage | Reporter: | Rachael <rgeorge> |
| Component: | csi-driver | Assignee: | yati padia <ypadia> |
| Status: | CLOSED ERRATA | QA Contact: | Rachael <rgeorge> |
| Severity: | low | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 4.8 | CC: | hchiramm, madam, mrajanna, muagarwa, ocs-bugs |
| Target Milestone: | --- | Keywords: | ZStream |
| Target Release: | OCS 4.8.2 | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | v4.8.2-179.ci | Doc Type: | No Doc Update |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2021-09-29 15:03:28 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Exists only in 4.8 Upstream PR to be backported: https://github.com/ceph/ceph-csi/pull/2112 Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Red Hat OpenShift Container Storage 4.8.2 bug fix update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2021:3695 |
Description of problem (please be detailed as possible and provide log snippets): When the VAULT_BACKEND value is set to "kv" for a backend path which uses "kv-v2" secret engine as shown below: 2-vault: '{"KMS_PROVIDER":"vaulttokens","KMS_SERVICE_NAME":"vault","VAULT_ADDR":"https://vault.qe.rh-ocs.com:8200","VAULT_BACKEND_PATH":"bug","VAULT_CACERT":"ocs-kms-ca-secret-7uefva","VAULT_TLS_SERVER_NAME":"","VAULT_CLIENT_CERT":"ocs-kms-client-cert-9lsmr","VAULT_CLIENT_KEY":"ocs-kms-client-key-wuuvkp","VAULT_NAMESPACE":"","VAULT_TOKEN_NAME":"ocs-kms-token","VAULT_CACERT_FILE":"fullchain.pem","VAULT_CLIENT_CERT_FILE":"cert.pem","VAULT_CLIENT_KEY_FILE":"privkey.pem","VAULT_BACKEND":"kv"}' The creation of encrypted PVCs fails with the following error: Warning ProvisioningFailed 6s openshift-storage.rbd.csi.ceph.com_csi-rbdplugin-provisioner-6697c46c77-7nfk8_3d3412aa-cb7f-493a-bcc5-db233bd46bcd failed to provision volume with StorageClass "test-pv-encryption-v2-vb-1": rpc error: code = Internal desc = failed to setup encroption for image ocs-storagecluster-cephblockpool/csi-vol-de702eca-fff6-11eb-91fa-0a580a83006b: failed to save the passphrase for 0001-0011-openshift-storage-0000000000000001-de702eca-fff6-11eb-91fa-0a580a83006b: saving passphrase at 0001-0011-openshift-storage-0000000000000001-de702eca-fff6-11eb-91fa-0a580a83006b request to vault failed: failed to put secret: backendPath=vb-sys-v2, backendV2=false, namespace=, secretID=0001-0011-openshift-storage-0000000000000001-de702eca-fff6-11eb-91fa-0a580a83006b: Error making API request. The word "encryption" is spelled as "encroption" in the error message. Version of all relevant components (if applicable): OCS: ocs-operator.v4.8.1-177.ci OCP: 4.8.0-0.nightly-2021-08-09-135211 Does this issue impact your ability to continue to work with the product (please explain in detail what is the user impact)? No Is there any workaround available to the best of your knowledge? No Rate from 1 - 5 the complexity of the scenario you performed that caused this bug (1 - very simple, 5 - very complex)? 1 Can this issue reproducible? Yes Can this issue reproduce from the UI? Yes If this is a regression, please provide more details to justify this: No Steps to Reproduce: 1. Create a storage class with encryption enabled using a backend path with kv-v2 (https://access.redhat.com/documentation/en-us/red_hat_openshift_container_storage/4.8/html-single/managing_and_allocating_storage_resources/index#creating-a-storage-class-for-persistent-volume-encryption_rhocs) 2. Find out the encryptionKMSID being used for the storageclass $ oc get sc <sc_name> -o yaml |grep encryptionKMSID encryptionKMSID=2-vault 3. Edit the vault config for the KMSID from the step above in the csi-kms-connection-details configmap $ oc edit cm csi-kms-connection-details -n openshift-storage 4. Set the VAULT_BACKEND parameter to "kv" as shown below 2-vault: '{"KMS_PROVIDER":"vaulttokens","KMS_SERVICE_NAME":"vault","VAULT_ADDR":"https://vault.qe.rh-ocs.com:8200","VAULT_BACKEND_PATH":"bug","VAULT_CACERT":"ocs-kms-ca-secret- 7uefva","VAULT_TLS_SERVER_NAME":"","VAULT_CLIENT_CERT":"ocs-kms-client-cert-9lsmr","VAULT_CLIENT_KEY":"ocs-kms-client-key-wuuvkp","VAULT_NAMESPACE":"","VAULT_TOKEN_NAME":"ocs-kms- token","VAULT_CACERT_FILE":"fullchain.pem","VAULT_CLIENT_CERT_FILE":"cert.pem","VAULT_CLIENT_KEY_FILE":"privkey.pem","VAULT_BACKEND":"kv"}' 5. Save the configmap 6. Create a PVC using the SC 7. Check the status of the PVC, using oc describe pvc <pvc_name> Actual results: The error message has "encryption" spelled incorrectly, as shown in the output above