Bug 1995047 - Typo in error message when using incorrect VAULT_BACKEND value
Summary: Typo in error message when using incorrect VAULT_BACKEND value
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat OpenShift Container Storage
Classification: Red Hat Storage
Component: csi-driver
Version: 4.8
Hardware: Unspecified
OS: Unspecified
unspecified
low
Target Milestone: ---
: OCS 4.8.2
Assignee: yati padia
QA Contact: Rachael
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2021-08-18 10:58 UTC by Rachael
Modified: 2021-09-29 15:03 UTC (History)
5 users (show)

Fixed In Version: v4.8.2-179.ci
Doc Type: No Doc Update
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-09-29 15:03:28 UTC
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github ceph ceph-csi pull 2112 0 None None None 2021-08-18 12:25:56 UTC
Github openshift ceph-csi pull 68 0 None None None 2021-08-30 08:37:28 UTC
Red Hat Product Errata RHBA-2021:3695 0 None None None 2021-09-29 15:03:39 UTC

Description Rachael 2021-08-18 10:58:39 UTC
Description of problem (please be detailed as possible and provide log
snippets):

When the VAULT_BACKEND value is set to "kv" for a backend path which uses "kv-v2" secret engine as shown below:

2-vault: '{"KMS_PROVIDER":"vaulttokens","KMS_SERVICE_NAME":"vault","VAULT_ADDR":"https://vault.qe.rh-ocs.com:8200","VAULT_BACKEND_PATH":"bug","VAULT_CACERT":"ocs-kms-ca-secret-7uefva","VAULT_TLS_SERVER_NAME":"","VAULT_CLIENT_CERT":"ocs-kms-client-cert-9lsmr","VAULT_CLIENT_KEY":"ocs-kms-client-key-wuuvkp","VAULT_NAMESPACE":"","VAULT_TOKEN_NAME":"ocs-kms-token","VAULT_CACERT_FILE":"fullchain.pem","VAULT_CLIENT_CERT_FILE":"cert.pem","VAULT_CLIENT_KEY_FILE":"privkey.pem","VAULT_BACKEND":"kv"}'


The creation of encrypted PVCs fails with the following error:

    Warning  ProvisioningFailed    6s                openshift-storage.rbd.csi.ceph.com_csi-rbdplugin-provisioner-6697c46c77-7nfk8_3d3412aa-cb7f-493a-bcc5-db233bd46bcd  failed to provision volume with StorageClass "test-pv-encryption-v2-vb-1": rpc error: code = Internal desc = failed to setup encroption for image ocs-storagecluster-cephblockpool/csi-vol-de702eca-fff6-11eb-91fa-0a580a83006b: failed to save the passphrase for 0001-0011-openshift-storage-0000000000000001-de702eca-fff6-11eb-91fa-0a580a83006b: saving passphrase at 0001-0011-openshift-storage-0000000000000001-de702eca-fff6-11eb-91fa-0a580a83006b request to vault failed: failed to put secret: backendPath=vb-sys-v2, backendV2=false, namespace=, secretID=0001-0011-openshift-storage-0000000000000001-de702eca-fff6-11eb-91fa-0a580a83006b: Error making API request.

The word "encryption" is spelled as "encroption" in the error message.

Version of all relevant components (if applicable):
OCS: ocs-operator.v4.8.1-177.ci
OCP: 4.8.0-0.nightly-2021-08-09-135211

Does this issue impact your ability to continue to work with the product
(please explain in detail what is the user impact)?
No

Is there any workaround available to the best of your knowledge?
No

Rate from 1 - 5 the complexity of the scenario you performed that caused this
bug (1 - very simple, 5 - very complex)?
1

Can this issue reproducible?
Yes

Can this issue reproduce from the UI?
Yes

If this is a regression, please provide more details to justify this:
No

Steps to Reproduce:
1. Create a storage class with encryption enabled using a backend path with kv-v2 (https://access.redhat.com/documentation/en-us/red_hat_openshift_container_storage/4.8/html-single/managing_and_allocating_storage_resources/index#creating-a-storage-class-for-persistent-volume-encryption_rhocs)
2. Find out the encryptionKMSID being used for the storageclass
   $ oc get sc <sc_name> -o yaml |grep encryptionKMSID
   encryptionKMSID=2-vault
3. Edit the vault config for the KMSID from the step above in the csi-kms-connection-details configmap
   $ oc edit cm csi-kms-connection-details -n openshift-storage
4. Set the VAULT_BACKEND parameter to "kv" as shown below

       2-vault: '{"KMS_PROVIDER":"vaulttokens","KMS_SERVICE_NAME":"vault","VAULT_ADDR":"https://vault.qe.rh-ocs.com:8200","VAULT_BACKEND_PATH":"bug","VAULT_CACERT":"ocs-kms-ca-secret- 
       7uefva","VAULT_TLS_SERVER_NAME":"","VAULT_CLIENT_CERT":"ocs-kms-client-cert-9lsmr","VAULT_CLIENT_KEY":"ocs-kms-client-key-wuuvkp","VAULT_NAMESPACE":"","VAULT_TOKEN_NAME":"ocs-kms- 
       token","VAULT_CACERT_FILE":"fullchain.pem","VAULT_CLIENT_CERT_FILE":"cert.pem","VAULT_CLIENT_KEY_FILE":"privkey.pem","VAULT_BACKEND":"kv"}'

5. Save the configmap
6. Create a PVC using the SC 
7. Check the status of the PVC, using oc describe pvc <pvc_name>

Actual results:
The error message has "encryption" spelled incorrectly, as shown in the output above

Comment 2 Mudit Agarwal 2021-08-18 12:25:56 UTC
Exists only in 4.8

Comment 3 Humble Chirammal 2021-08-19 02:25:48 UTC
Upstream PR to be backported:
https://github.com/ceph/ceph-csi/pull/2112

Comment 15 errata-xmlrpc 2021-09-29 15:03:28 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Red Hat OpenShift Container Storage 4.8.2 bug fix update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2021:3695


Note You need to log in before you can comment on or make changes to this bug.