Fedora Account System
Red Hat Associate
Red Hat Customer
Description of problem (please be detailed as possible and provide log snippets): When the VAULT_BACKEND value is set to "kv" for a backend path which uses "kv-v2" secret engine as shown below: 2-vault: '{"KMS_PROVIDER":"vaulttokens","KMS_SERVICE_NAME":"vault","VAULT_ADDR":"https://vault.qe.rh-ocs.com:8200","VAULT_BACKEND_PATH":"bug","VAULT_CACERT":"ocs-kms-ca-secret-7uefva","VAULT_TLS_SERVER_NAME":"","VAULT_CLIENT_CERT":"ocs-kms-client-cert-9lsmr","VAULT_CLIENT_KEY":"ocs-kms-client-key-wuuvkp","VAULT_NAMESPACE":"","VAULT_TOKEN_NAME":"ocs-kms-token","VAULT_CACERT_FILE":"fullchain.pem","VAULT_CLIENT_CERT_FILE":"cert.pem","VAULT_CLIENT_KEY_FILE":"privkey.pem","VAULT_BACKEND":"kv"}' The creation of encrypted PVCs fails with the following error: Warning ProvisioningFailed 6s openshift-storage.rbd.csi.ceph.com_csi-rbdplugin-provisioner-6697c46c77-7nfk8_3d3412aa-cb7f-493a-bcc5-db233bd46bcd failed to provision volume with StorageClass "test-pv-encryption-v2-vb-1": rpc error: code = Internal desc = failed to setup encroption for image ocs-storagecluster-cephblockpool/csi-vol-de702eca-fff6-11eb-91fa-0a580a83006b: failed to save the passphrase for 0001-0011-openshift-storage-0000000000000001-de702eca-fff6-11eb-91fa-0a580a83006b: saving passphrase at 0001-0011-openshift-storage-0000000000000001-de702eca-fff6-11eb-91fa-0a580a83006b request to vault failed: failed to put secret: backendPath=vb-sys-v2, backendV2=false, namespace=, secretID=0001-0011-openshift-storage-0000000000000001-de702eca-fff6-11eb-91fa-0a580a83006b: Error making API request. The word "encryption" is spelled as "encroption" in the error message. Version of all relevant components (if applicable): OCS: ocs-operator.v4.8.1-177.ci OCP: 4.8.0-0.nightly-2021-08-09-135211 Does this issue impact your ability to continue to work with the product (please explain in detail what is the user impact)? No Is there any workaround available to the best of your knowledge? No Rate from 1 - 5 the complexity of the scenario you performed that caused this bug (1 - very simple, 5 - very complex)? 1 Can this issue reproducible? Yes Can this issue reproduce from the UI? Yes If this is a regression, please provide more details to justify this: No Steps to Reproduce: 1. Create a storage class with encryption enabled using a backend path with kv-v2 (https://access.redhat.com/documentation/en-us/red_hat_openshift_container_storage/4.8/html-single/managing_and_allocating_storage_resources/index#creating-a-storage-class-for-persistent-volume-encryption_rhocs) 2. Find out the encryptionKMSID being used for the storageclass $ oc get sc <sc_name> -o yaml |grep encryptionKMSID encryptionKMSID=2-vault 3. Edit the vault config for the KMSID from the step above in the csi-kms-connection-details configmap $ oc edit cm csi-kms-connection-details -n openshift-storage 4. Set the VAULT_BACKEND parameter to "kv" as shown below 2-vault: '{"KMS_PROVIDER":"vaulttokens","KMS_SERVICE_NAME":"vault","VAULT_ADDR":"https://vault.qe.rh-ocs.com:8200","VAULT_BACKEND_PATH":"bug","VAULT_CACERT":"ocs-kms-ca-secret- 7uefva","VAULT_TLS_SERVER_NAME":"","VAULT_CLIENT_CERT":"ocs-kms-client-cert-9lsmr","VAULT_CLIENT_KEY":"ocs-kms-client-key-wuuvkp","VAULT_NAMESPACE":"","VAULT_TOKEN_NAME":"ocs-kms- token","VAULT_CACERT_FILE":"fullchain.pem","VAULT_CLIENT_CERT_FILE":"cert.pem","VAULT_CLIENT_KEY_FILE":"privkey.pem","VAULT_BACKEND":"kv"}' 5. Save the configmap 6. Create a PVC using the SC 7. Check the status of the PVC, using oc describe pvc <pvc_name> Actual results: The error message has "encryption" spelled incorrectly, as shown in the output above
Exists only in 4.8
Upstream PR to be backported: https://github.com/ceph/ceph-csi/pull/2112
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Red Hat OpenShift Container Storage 4.8.2 bug fix update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2021:3695