Bug 2173235
| Summary: | satellite-maintain backup offline does not collect custom certificates and thus can't restore by passing katello-cert-check | ||
|---|---|---|---|
| Product: | Red Hat Satellite | Reporter: | Ricardo Santamaria <risantam> |
| Component: | Satellite Maintain | Assignee: | satellite6-bugs <satellite6-bugs> |
| Status: | CLOSED MIGRATED | QA Contact: | Satellite QE Team <sat-qe-bz-list> |
| Severity: | high | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 6.10.7 | CC: | alsouza, egolov, ehelms |
| Target Milestone: | Unspecified | Keywords: | MigratedToJIRA, Triaged |
| Target Release: | Unused | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2024-06-06 16:09:14 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
I think the root cause of the issue is that the files are either not present during backup or not readable by foreman-maintain during the backup process (permissions? selinux?). This part would have to be confirmed on the user's system by looking closer. Here is my reasoning for this after doing some testing. The foreman-maintain code around backups does not check that every file marked to be included in the backup actually exists at the time of the backup. Well, I should say, it does check for their existence but it does not throw an error if they do not exist, instead it omits them from the file set that is included in the backup: https://github.com/evgeni/foreman_maintain/blob/53dac01cb8d1bc6da382562d9b4449cec732da9c/definitions/procedures/backup/config_files.rb#L58 That line is effectively saying -- only keep the ones that exist, see example logic: irb(main):008:0> File.exist?('/root/custom_certificates/certs/test.key') => false irb(main):009:0> configs = ['/root/custom_certificates/certs/test.key'] => ["/root/custom_certificates/certs/test.key"] irb(main):010:0> configs.compact.select { |path| Dir.glob(path).any? } => [] This BZ has been automatically migrated to the issues.redhat.com Red Hat Issue Tracker. All future work related to this report will be managed there. Due to differences in account names between systems, some fields were not replicated. Be sure to add yourself to Jira issue's "Watchers" field to continue receiving updates and add others to the "Need Info From" field to continue requesting information. To find the migrated issue, look in the "Links" section for a direct link to the new issue location. The issue key will have an icon of 2 footprints next to it, and begin with "SAT-" followed by an integer. You can also find this issue by visiting https://issues.redhat.com/issues/?jql= and searching the "Bugzilla Bug" field for this BZ's number, e.g. a search like: "Bugzilla Bug" = 1234567 In the event you have trouble locating or viewing this issue, you can file an issue by sending mail to rh-issues. You can also visit https://access.redhat.com/articles/7032570 for general account information. |
Description of problem: Version-Release number of selected component (if applicable): satellite-6.10.7.1-1.el7sat.noarch on RHEL 7.9 (3.10.0-1160.59.1) How reproducible: Generate backup of Satellite 6.10 with custom certificates Steps to Reproduce: 1. Generate backup of Satellite with customer certificates # satellite-maintain backup offline --skip-pulp-content /var/backup_directory 2. On reproducer/restore target attempt to restore using backup files: # satellite-maintain restore /var/backup_directory 3. Restore fails: <SNIP> Checking to see if the private key matches the certificate: Error opening Private Key /etc/pki/tls/private/satellite-wildcard.example.com.key 140094951200656:error:02001002:system library:fopen:No such file or directory:bss_file.c:402:fopen('/etc/pki/tls/private/satellite-wildcard.example.com.key','r') 140094951200656:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:404: unable to load Private Key [FAIL] </SNIP> Actual results: If custom certs are present satellite-maintain does not collect Expected results: Expected satellite-maintain backup to collected needed /etc/pki/tls/* certs to properly restore database Additional info: