Bug 2055316

Summary:	ipa-healthcheck: pki sources are not available when IPA is not configured with a CA
Product:	Red Hat Enterprise Linux 8	Reporter:	Sudhir Menon <sumenon>
Component:	ipa-healthcheck	Assignee:	Rob Crittenden <rcritten>
Status:	CLOSED ERRATA	QA Contact:	ipa-qe <ipa-qe>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	8.6	CC:	fcami, prisingh, skhandel
Target Milestone:	rc	Keywords:	Regression, Triaged
Target Release:	---	Flags:	pm-rhel: mirror+
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	ipa-healthcheck-0.7-10.el8	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-05-10 14:09:17 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Sudhir Menon 2022-02-16 16:52:38 UTC

Description of problem: ipa-healthcheck: Source 'pki.server.healthcheck.clones.connectivity_and_data' not found when run on replica

Version-Release number of selected component (if applicable):
ipa-server-4.9.8-2.module+el8.6.0+14113+b87cb360.x86_64
ipa-healthcheck-0.7-9.module+el8.6.0+14113+b87cb360.noarch
pki-ca-10.12.0-2.module+el8.6.0+14115+8b467244.noarch


How reproducible: Always

Steps to Reproduce:
1. On IPA Server run #ipa-healthcheck --source pki.server.healthcheck.clones.connectivity_and_data
2. Now run the above same command on replica

Actual results:
On IPA Server
[root@server ~]# ipa-healthcheck --source pki.server.healthcheck.clones.connectivity_and_data
[]
On IPA Replica
[root@replica ~]# ipa-healthcheck --source pki.server.healthcheck.clones.connectivity_and_data
Source 'pki.server.healthcheck.clones.connectivity_and_data' not found

For pki-healthcheck it doesn't work for both ipa server and replica.
[root@server ~]# pki-healthcheck --source pki.server.healthcheck.clones.connectivity_and_data
Source 'pki.server.healthcheck.clones.connectivity_and_data' not found

[root@replica ~]# pki-healthcheck --source pki.server.healthcheck.clones.connectivity_and_data
Source 'pki.server.healthcheck.clones.connectivity_and_data' not found

Expected results:
'Source ... not found'  should work on replica system as well.

Additional info:

Comment 1 Rob Crittenden 2022-02-16 19:58:42 UTC

You don't have a CA installed on the replica so there is nothing to check.

Comment 2 Rob Crittenden 2022-02-16 20:02:19 UTC

I suspect the problem is not visible on an IPA installation at all.

Currently a check is done to see if a CA is enabled by asking IPA. For a pure PKI installation this will always return False and therefore the pki checks will always be skipped.

This is all avoidable if the pki healthchecks would return nothing if a CA is not configured instead of yielding messages. They have to be skipped in order to avoid a whole ton of scary errors that a pki-tomcat instance is not configured.

Comment 10 Sudhir Menon 2022-02-25 10:58:19 UTC

Marking the bug as verified using latest nightly

ipa-healthcheck-0.7-10.module+el8.6.0+14292+18b36d36.noarch
ipa-healthcheck-core-0.7-10.module+el8.6.0+14292+18b36d36.noarch
ipa-server-4.9.8-6.module+el8.6.0+14224+4c38d4ea.x86_64
pki-ca-10.12.0-2.module+el8.6.0+14115+8b467244.noarch

Replica without CA
[root@replica2 ~]# pki-healthcheck --source pki.server.healthcheck.clones.connectivity_and_data
[
  {
    "source": "pki.server.healthcheck.clones.connectivity_and_data",
    "check": "ClonesConnectivyAndDataCheck",
    "result": "CRITICAL",
    "uuid": "698c474e-1ec4-4ed3-8102-60fffa3217e1",
    "when": "20220225105622Z",
    "duration": "0.000190",
    "kw": {
      "status": "Invalid PKI instance: pki-tomcat"
    }
  }
]

Comment 12 errata-xmlrpc 2022-05-10 14:09:17 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (idm:client and idm:DL1 bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2022:1884