Bug 1504737
| Summary: | Upgraded capsule content sync fails with 'Pulp message bus connection issue' | ||
|---|---|---|---|
| Product: | Red Hat Satellite | Reporter: | Lukas Pramuk <lpramuk> |
| Component: | Upgrades | Assignee: | Eric Helms <ehelms> |
| Status: | CLOSED WONTFIX | QA Contact: | Lukas Pramuk <lpramuk> |
| Severity: | urgent | Docs Contact: | |
| Priority: | urgent | ||
| Version: | 6.3.0 | CC: | bbuckingham, bjarolim, cmarinea, ehelms, inecas, ktordeur, mbacovsk, mlele, takirby |
| Target Milestone: | Unspecified | Keywords: | Regression, Reopened, Triaged |
| Target Release: | Unused | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2018-04-15 10:27:56 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Lukas Pramuk
2017-10-20 13:58:08 UTC
Qpid at 6.2 capsule is listening unrestricted at 0.0.0.0:5671 while at 6.3 capsule it got restricted to 127.0.0.1:5671 So probably cert migration/refresh is missing during upgrades # grep :5671 /etc/pulp/server.conf url: ssl://localhost:5671 broker_url: qpid://localhost:5671 # grep ^[^#] /etc/qpid/qpidd.conf log-enable=error+ log-to-syslog=yes auth=no require-encryption=yes ssl-require-client-authentication=yes ssl-port=5671 ssl-cert-db=/etc/pki/katello/nssdb ssl-cert-password-file=/etc/pki/katello/nssdb/nss_db_password-file ssl-cert-name=broker interface=lo Settings in comment#4 are the same for both upgraded and fresh 6.3 capsule. I believe this is due to inaccurate upgrade commands for 6.2 to 6.3. Please test with: Generating Certs Add --certs-update-all to the capsule-certs-generate command, for example: capsule-certs-generate --certs-tar ~/tmp/mycerts.tar.gz --foreman-proxy-fqdn pipeline-capsule-6-2-rhel7.woodford.example.com --certs-update-all Upgrading Capsule When upgrading the capsule, with our updated certs bundle, we need to ensure these new certs are deployed and the nssdb is regenerated. Do this by ensuring '--certs-regenerate true' and --'certs-deploy true' and '--certs-update-all' are included in the upgrade command. For example: satellite-installer --upgrade --foreman-proxy-content-certs-tar ~/mycerts.tar.gz --certs-update-all --certs-regenerate true --certs-deploy true VERIFIED. @Satellite/Capsule 6.3.0 Snap22 by manual reproducer in comment#0: 1. assign capsule to LFE 2. upgrade capsule to 6.3 @SAT: # capsule-certs-generate --foreman-proxy-fqdn cap.example.com --certs-tar ~/cap.example.com.tar --certs-update-all # scp ~/cap.example.com.tar cap.example.com: @CAPSULE: #satellite-installer --upgrade --foreman-proxy-content-certs-tar ~/cap.example.com.tar --certs-update-all --certs-regenerate true --certs-deploy true Marking certificate /root/ssl-build/cap.example.com/cap.example.com-qpid-router-server for update Marking certificate /root/ssl-build/cap.example.com/cap.example.com-qpid-router-client for update Marking certificate /root/ssl-build/cap.example.com/cap.example.com-foreman-proxy for update Marking certificate /root/ssl-build/cap.example.com/cap.example.com-foreman-proxy-client for update Marking certificate /root/ssl-build/cap.example.com/cap.example.com-foreman-client for update Marking certificate /root/ssl-build/cap.example.com/cap.example.com-puppet-client for update Marking certificate /root/ssl-build/cap.example.com/cap.example.com-qpid-client-cert for update Marking certificate /root/ssl-build/cap.example.com/cap.example.com-qpid-broker for update Marking certificate /root/ssl-build/cap.example.com/cap.example.com-apache for update ... Upgrade completed! 3. trigger capsule sync either in UI or CLI @SAT: # hammer capsule content synchronize --id 2 [...............................................................................................................] [100%] @CAPSULE: # service pulp_celerybeat status -l ... Nov 01 09:45:59 cap.example.com pulp[23023]: kombu.transport.qpid:INFO: Connected to qpid with SASL mechanism ANONYMOUS Nov 01 09:55:59 cap.example.com pulp[23023]: celery.beat:INFO: Scheduler: Sending due task download_deferred_content (pulp.server.controllers.repository.queue_download_deferred) >>> capsule sync was triggered successfully and pulp was able to connect to qpid message bus Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA.
> >
> > For information on the advisory, and where to find the updated files, follow the link below.
> >
> > If the solution does not work for you, open a new bug report.
> >
> > https://access.redhat.com/errata/RHSA-2018:0336
Closing this bug out as the issue was related to the Satellite HA upgrade from 6.2 to 6.3 which is currently unsupported. |