Bug 2293621

Summary: bug in encryption key rotation steps while removing key slot
Product: [Red Hat Storage] Red Hat OpenShift Data Foundation Reporter: Rakshith <rar>
Component: rookAssignee: Niraj Yadav <niryadav>
Status: CLOSED ERRATA QA Contact: Parag Kamble <pakamble>
Severity: urgent Docs Contact:
Priority: unspecified    
Version: 4.16CC: muagarwa, niryadav, odf-bz-bot, srai, tnielsen
Target Milestone: ---   
Target Release: ODF 4.16.0   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: 4.16.0-131 Doc Type: No Doc Update
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2024-07-17 13:25:19 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Rakshith 2024-06-21 11:23:43 UTC
Description of problem (please be detailed as possible and provide log
snippests):

Rook has a bug related to encryption key rotation.
The case is actually very hard to hit.
When this particular bug is hit, the key rotation jobs will start to fail.
There is no risk to OSD data.

```
While adding a new encryption key to slot 1
if there exists a key in slot 1 which is not
equal to the one we want to update it with,
we kill the slot and then add the new key to it.

While killing the slot, the existing code uses
the new key, which is not valid in such cases.

This patch modifies the code to use the key in
slot 0 (the one that we know works) to kill the slot.
```




Is there any workaround available to the best of your knowledge?
manually delete fetch key from kms and delete keyslot 1. 


Rate from 1 - 5 the complexity of the scenario you performed that caused this
bug (1 - very simple, 5 - very complex)?
5

Can this issue reproducible?
Very difficult to reproduce from manual deletion of key rotation jobs.
The job has to be deleted right before a particular step which is nearly impossible

Can this issue reproduce from the UI?
no

If this is a regression, please provide more details to justify this:
not a regression.

Steps to Reproduce:
1.
2.
3.


Actual results:


Expected results:


Additional info:

Comment 7 Sunil Kumar Acharya 2024-06-25 12:09:21 UTC
Please update the RDT flag/text appropriately.

Comment 10 errata-xmlrpc 2024-07-17 13:25:19 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Important: Red Hat OpenShift Data Foundation 4.16.0 security, enhancement & bug fix update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2024:4591