RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 2102292 - stonith_admin --validate seems to be broken
Summary: stonith_admin --validate seems to be broken
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 9
Classification: Red Hat
Component: pacemaker
Version: 9.0
Hardware: All
OS: All
urgent
medium
Target Milestone: rc
: 9.1
Assignee: Chris Lumens
QA Contact: cluster-qe@redhat.com
URL:
Whiteboard:
Depends On:
Blocks: 1553712 1816852 2112270 2112271
TreeView+ depends on / blocked
 
Reported: 2022-06-29 15:18 UTC by Tomas Jelinek
Modified: 2022-11-15 10:06 UTC (History)
7 users (show)

Fixed In Version: pacemaker-2.1.4-3.el9
Doc Type: No Doc Update
Doc Text:
There currently is no pcs interface to the affected command, and the average user will never see it
Clone Of:
Environment:
Last Closed: 2022-11-15 09:49:38 UTC
Type: Bug
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github ClusterLabs pacemaker pull 2748 0 None open Fix regressions in stonith_admin --validate 2022-06-30 18:15:45 UTC
Red Hat Issue Tracker RHELPLAN-126632 0 None None None 2022-06-29 15:29:34 UTC
Red Hat Product Errata RHBA-2022:7937 0 None None None 2022-11-15 09:50:09 UTC

Description Tomas Jelinek 2022-06-29 15:18:20 UTC 
Description of problem:
Running `stonith_admin --validate` doesn't seem to properly process and pass data from fence agents. Based on bz1434936 comment 23, stonith_admin is expected to return the same results as:
echo -e "action=validate-all\nport=node1\n<param>=<value>\n<param>=<value>\n<etc.>" | fence_<whatever>
That doesn't seem to be happening.


Version-Release number of selected component (if applicable):
pacemaker-2.1.4-1.el9.x86_64


How reproducible:
always, easily


Steps to Reproduce:
> run a fence agent directly in such a way that validation fails:
# echo -e "action=validate-all\nport=node1" | fence_apc
2022-06-29 17:10:52,108 ERROR: Failed: You have to set login name

2022-06-29 17:10:52,109 ERROR: Failed: You have to enter fence address

2022-06-29 17:10:52,109 ERROR: Failed: You have to enter password, password script or identity file

2022-06-29 17:10:52,109 ERROR: validate-all failed

2022-06-29 17:10:52,109 ERROR: Please use '-h' for usage
# echo $?
1

> run a fence agent via stonith_admin in such a way that validation fails:
# stonith_admin --output-as=xml --validate --agent fence_apc
<pacemaker-result api-version="2.20" request="stonith_admin --output-as=xml --validate --agent fence_apc">
  <validate agent="fence_apc" valid="true">
    <command code="-103"/>
  </validate>
  <status code="102" message="Not connected"/>
</pacemaker-result>
# echo $?
102

issues:
* actual: valid="true", expected: valid="false"
* actual: messages from the fence agent are not present in stonith_admin output, expected: messages from the fence agent are present in stonith_admin output



> run a fence agent directly in such a way that validation passes:
# echo -e "action=validate-all\nport=node1\nusername=apc\npasswd=apc\nip=192.168.122.254" | fence_apc
# echo $?
0

> run a fence agent via stonith_admin in such a way that validation passes:
# stonith_admin --output-as=xml  --validate --agent fence_apc --option username=apc --option passwd=apc --option ip=192.168.122.254
<pacemaker-result api-version="2.20" request="stonith_admin --output-as=xml --validate --agent fence_apc --option username=apc --option passwd=apc --option ip=192.168.122.254">
  <validate agent="fence_apc" valid="false">
    <command code="0"/>
  </validate>
  <status code="0" message="OK"/>
</pacemaker-result>
# echo $?
0

issues:
* actual: valid="false", expected: valid="true"
Comment 1 Tomas Jelinek 2022-06-29 15:32:42 UTC 
This is working as I expect in pacemaker 2.0:

# stonith_admin --output-as=xml --validate --agent fence_apc
<pacemaker-result api-version="2.2" request="stonith_admin --output-as=xml --validate --agent fence_apc">
  <validate agent="fence_apc" valid="false">
    <command code="-201">
      <output source="stderr">2022-06-29 17:29:05,499 ERROR: Failed: You have to set login name

2022-06-29 17:29:05,500 ERROR: Failed: You have to enter fence address

2022-06-29 17:29:05,500 ERROR: Failed: You have to enter password, password script or identity file

2022-06-29 17:29:05,500 ERROR: validate-all failed

2022-06-29 17:29:05,500 ERROR: Please use '-h' for usage

</output>
    </command>
  </validate>
  <status code="1" message="Error occurred"/>
</pacemaker-result>
# echo $?
1
# rpm -q pacemaker
pacemaker-2.0.4-6.el8.x86_64
Comment 2 Ken Gaillot 2022-06-29 19:44:56 UTC 
At least the first issue here is a regression: Since commit 91a2b2e417 in the Pacemaker 2.0.5 release (RHEL 8.4), the sense of "valid" in the XML output was accidentally flipped. I.e. the XML output has valid="true" if the options are invalid and valid="false" if they are valid :-/

Pacemaker currently doesn't have regression tests for stonith_admin --validate, so that obviously needs to be added.

The second issue (regarding the error messages) requires more investigation.
Comment 6 Reid Wahl 2022-06-30 00:12:25 UTC 
The "not connected" issue began with this commit:
  - Low: libcrmservice: always set rc/status when executing files (https://github.com/ClusterLabs/pacemaker/pull/2512/commits/b441925e2da6b938db0674b98783d1dfb3d2a096)
Comment 12 Ken Gaillot 2022-07-21 20:47:49 UTC 
The fix was merged in the upstream main branch as of commit 81e83683

Bumping the DTM one week. The build is actually done but there is an unrelated issue affecting gating with a fix working its way through the system
Comment 13 Ken Gaillot 2022-07-28 23:01:19 UTC 
Bumping the DTM another week. The gating fix is done but all the jobs haven't been rerun yet. :-/ If it's not done by early next week I may waive that test.
Comment 20 jrehova 2022-08-24 14:20:14 UTC 
Version of pacemaker:

> [root@node_01 ~]# rpm -q pacemaker
> pacemaker-2.1.4-5.el9.x86_64

Run a fence agent directly in such a way that validation fails:

> [root@node_01 ~]# echo -e "action=validate-all\nport=node1" | fence_apc
> 2022-08-24 09:02:25,407 ERROR: Failed: You have to set login name
> 
> 2022-08-24 09:02:25,407 ERROR: Failed: You have to enter fence address
> 
> 2022-08-24 09:02:25,408 ERROR: Failed: You have to enter password, password script or identity file
> 
> 2022-08-24 09:02:25,408 ERROR: validate-all failed
> 
> 2022-08-24 09:02:25,408 ERROR: Please use '-h' for usage
 
> [root@node_01 ~]# echo $?
> 1

Run a fence agent via stonith_admin in such a way that validation fails:

> [root@node_01 ~]# stonith_admin --output-as=xml --validate --agent fence_apc
> <pacemaker-result api-version="2.22" request="stonith_admin --output-as=xml --validate --agent fence_apc">
>   <validate agent="fence_apc" valid="false">
>     <command code="-201">
>       <output source="stderr">2022-08-24 09:03:44,867 ERROR: Failed: You have to set login name
> 
> 2022-08-24 09:03:44,867 ERROR: Failed: You have to enter fence address
> 
> 2022-08-24 09:03:44,867 ERROR: Failed: You have to enter password, password script or identity file
> 
> 2022-08-24 09:03:44,868 ERROR: validate-all failed
> 
> 2022-08-24 09:03:44,868 ERROR: Please use '-h' for usage
> 
> </output>
>     </command>
>   </validate>
>   <status code="1" message="Error occurred"/>
> </pacemaker-result>
 
> [root@node_01 ~]# echo $?
> 1

Run a fence agent directly in such a way that validation passes:

> [root@node_01 ~]# echo -e "action=validate-all\nport=node1\nusername=abc\npasswd=abc\nip=192.168.122.254" | fence_apc
 
> [root@node_01 ~]# echo $?
> 0

Run a fence agent via stonith_admin in such a way that validation passes:

> [root@node_01 ~]# stonith_admin --output-as=xml  --validate --agent fence_apc --option username=abc --option passwd=abc --option ip=192.168.122.254
> <pacemaker-result api-version="2.22" request="stonith_admin --output-as=xml --validate --agent fence_apc --option username=abc --option passwd=abc --option ip=192.168.122.254">
>   <validate agent="fence_apc" valid="true">
>     <command code="0"/>
>   </validate>
>   <status code="0" message="OK"/>
> </pacemaker-result>
 
> [root@node_01 ~]# echo $?
> 0
Comment 22 errata-xmlrpc 2022-11-15 09:49:38 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (pacemaker bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2022:7937
Note You need to log in before you can comment on or make changes to this bug.