failed to retrieve node topology: failed to get storage pools for node #128
Comments
|
The same with ha-controller: It seems there is some incompatibility of golinstor with ssl on new linstor version. When I disabling SSL everything is starting working |
|
Version when it was working: Version when it stopped working: |
|
This looks like a configuration issue to me. Note that the HA controller hasn't changed since January, using an old golinstor version. I believe the |
Yes, I can confirm that certificates are fine. I can even exec into pod and call curl with the same certificates: kubectl exec -ti -n linstor linstor-csi-node-pgx2v -c linstor-csi-plugin -- bashapt update && apt install curl -y
mkdir -p /tls
echo "$LS_USER_CERTIFICATE" > /tls/tls.crt
echo "$LS_USER_KEY" > /tls/tls.key
echo "$LS_ROOT_CA" > /tls/ca.crt
curl --cacert /tls/ca.crt --cert /tls/tls.crt --key /tls/tls.key https://linstor-controller:3371/v1/nodes/m1c9/storage-pools
# [{"storage_pool_name":"DfltDisklessStorPool","node_name":"m1c9","provider_kind":"DISKLESS","props":{"PrefNic":"data"},"static_traits":{"SupportsSnapshots":"false"},"free_capacity":9223372036854775807,"total_capacity":9223372036854775807,"free_space_mgr_name":"m1c9:DfltDisklessStorPool","uuid":"f51e962d-e683-417e-b6d7-5acab23b538c","supports_snapshots":false,"external_locking":false},{"storage_pool_name":"thindata","node_name":"m1c9","provider_kind":"LVM_THIN","props":{"PrefNic":"data","StorDriver/LvmVg":"data","StorDriver/StorPoolName":"data/thindata","StorDriver/ThinPool":"thindata"},"static_traits":{"Provisioning":"Thin","SupportsSnapshots":"true"},"free_capacity":879688155,"total_capacity":884998144,"free_space_mgr_name":"m1c9:thindata","uuid":"ea1b64eb-fd48-4cd1-8fd7-2e9c286a7907","supports_snapshots":true,"external_locking":false}]
I have own Dockerfiles built from the source code, but I also tried the official images I'm going to try new golang version as well |
|
UPD: just tried |
|
SSL seems to be working fine in my tests. I tried it with the piraeus builds, with LINBIT builds and also with your docker images. Not sure what is different in your environment 😕 |
|
I tried both oficial images piraeus-server and piraeus-csi-driver, and I still have the same problem I'm just trying to dig it out, I run linstor-controller with while using curl, everything is fine: |
|
Thanks for digging into this issue. To me, it still looks like go/linstor-csi/linstor-ha doesn't like one of |
|
I don't think the problem in these certs, the same binaries are working with linstor-controller v1.13.0 and do not work with linstor-controller v1.14.0 in same configuration. Eg. connection log with linstor-controller v1.13.0: (I also updated client certificate name from linstor-controller to linstor-client kvaps/kube-linstor@b1599dc) |
|
Got it! If I understood this correctly, the problem was in fact that linstor-controller since v1.14.0 provides CAs list allowed to establish client connections: As we know go has own implementation of crypto/tls different from C which just ignores this field. But go is smart and does not provides any certificates with CA filed which is not matching the requested ones by server. Thus solution was simple to import CA into The interesting fact that the same logic is not working for linstor-satellite, as it requires import directly linstor-controller's client certificate and not working if only CA has imported. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Hi, after upgrade to linstor from v1.13.0 to v1.14.0, csi-node-driver-registrar container falling down with the following message:
The text was updated successfully, but these errors were encountered: