Bug 2099484
| Summary: | IPADNSSystemRecordsCheck displays warning message for 2 expected ipa-ca AAAA records. | |||
|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Sudhir Menon <sumenon> | |
| Component: | ipa-healthcheck | Assignee: | Rob Crittenden <rcritten> | |
| Status: | CLOSED ERRATA | QA Contact: | ipa-qe <ipa-qe> | |
| Severity: | unspecified | Docs Contact: | ||
| Priority: | unspecified | |||
| Version: | --- | CC: | fcami, frenaud, gkaihoro, mpolovka, myusuf, rcritten, rjeffman | |
| Target Milestone: | pre-dev-freeze | Keywords: | Triaged | |
| Target Release: | --- | Flags: | pm-rhel:
mirror+
|
|
| Hardware: | Unspecified | |||
| OS: | Unspecified | |||
| Whiteboard: | ||||
| Fixed In Version: | ipa-healthcheck-0.12-1.el8 | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | ||
| Clone Of: | ||||
| : | 2099497 (view as bug list) | Environment: | ||
| Last Closed: | 2023-05-16 08:28:45 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | 2158775, 2166326 | |||
| Bug Blocks: | 2099497 | |||
Adding Flo's observation on the pagure ticket.
The issue happens when IPv4 or IPv6 is configured on one server but not on all the servers.
Relevant code:
freeipa-healthcheck/src/ipahealthcheck/ipa/idns.py
195 ca_count = 0
196 for server in system_records.servers_data:
197 master = system_records.servers_data.get(server)
198 if 'CA server' in master.get('roles'):
199 ca_count += 1
200
201 if len(answers) != ca_count:
freeipa-healthcheck/src/ipahealthcheck/ipa/idns.py
230 ca_count = 0
231 for server in system_records.servers_data:
232 master = system_records.servers_data.get(server)
233 if 'CA server' in master.get('roles'):
234 ca_count += 1
235
236 if len(answers) != ca_count:
ca_count is incremented for each server with the CA role, not considering that the server could have either IPv4 or IPv6 disabled.
The code assumes all-or-nothing: if one server has an IPv4 address, all the other ones are expected to also have an IPv4 address
and ipa-ca should contain an A record for each server with the CA role. Same for IPv6.
This is working as designed. There is no way to know at execution time whether this is on purpose or not. A missing ipa-ca record can impact ACME in particular. Hence it is marked as a WARNING. Upstream version 0.10 added the option to suppress a source, a check or a key. This would be one way to silence the warning if it does not apply. In this case the ca_count_a_rec could be suppressed so that healthcheck returns 0 if this is a desired configuration. *** Bug 2115275 has been marked as a duplicate of this bug. *** Use new approach to validate whether the ipa-ca DNS record is complete The previous method counted the number of servers with CA's and expected an identical count of servers in ipa-ca, for each of the A and AAAA types. If one server had only A or AAAA records then this count could be off and issue a spurious warning. Instead get the list of A and AAAA records for servers with a CA and compare the IP addresses to those of the A and AAAA records of ipa-ca. Return a warning if any are missing or not expected (e.g. a server was removed but remains in ipa-ca). Upstream PR https://github.com/freeipa/freeipa-healthcheck/pull/274 Fixed upstream. https://github.com/freeipa/freeipa-healthcheck/commit/a00e0293f937faa5a927361baf3a9a951d746466 https://github.com/freeipa/freeipa-healthcheck/commit/51e582aeb82c5c5ccff7410dd148f8b34d545048 Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (idm:client and idm:DL1 bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2023:2794 |
Description of problem: IPADNSSystemRecordsCheck displays warning message for 2 expected ipa-ca AAAA records. Version-Release number of selected component (if applicable): ipa-server-4.9.8-8.module+el8.7.0+14711+1e093de3.x86_64 How reproducible: Always. Steps to Reproduce: 1. Install IPA server and replica with ca having both --ip-address=ipv4-address and --ip-address=ipv6-address 2. Run ipa-healthcheck tool for IPADNSSystemRecordsCheck and check the result. Actual results: Although IPA Server and replica both are having IPV6 address assigned to CA, the healthcheck tool complains that only one entry is present. #ipa-healthcheck --failures-only { "source": "ipahealthcheck.ipa.idns", "check": "IPADNSSystemRecordsCheck", "result": "WARNING", "uuid": "5fe925f2-6bd5-411c-9a0d-352d850b792c", "when": "20220617143708Z", "duration": "0.038578", "kw": { "msg": "Got {count} ipa-ca A records, expected {expected}", "count": 1, "expected": 2 } Expected results: Fix the WARNING message displayed. Additional info: Logging this bug to have it tracked for 8.7 release. Upstream issue has already been logged. https://github.com/freeipa/freeipa-healthcheck/issues/270