[Pulp-list] goferd on consumers cannot connect to pulp server's queue after 2.7 -> 2.8 upgrade

Tue Apr 5 20:15:06 UTC 2016

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On 04/05/2016 02:40 PM, Konstantin M. Khankin wrote:
> On pulp-server:
> 
> [root at nms pulp]# LANG=C ls -l total 16 -rw-r-----. 1 root   apache 1021 *Mar 24* 23:47 ca.crt -rw-r-----.
> 1 root   apache 1675 *Mar 24* 23:47 ca.key drwxr-xr-x. 2 apache apache   33 Mar 15 08:32 content 
> -rw-r-----. 1 root   apache 1675 *Mar 24* 23:47 rsa.key -rw-r--r--. 1 root   apache  451 *Mar 24* 23:47
> rsa_pub.key
> 
> [root at nms pulp]# grep pulp /var/log/yum.log Mar 24 23:45:53 Erased:
> pulp-puppet-plugins-2.7.1-1.el7.noarch Mar 24 23:45:54 Erased: pulp-rpm-plugins-2.7.1-1.el7.noarch Mar 24
> 23:46:13 Erased: pulp-server-2.7.1-1.el7.noarch Mar 24 23:47:00 Updated:
> python-pulp-common-2.8.0-1.el7.noarch Mar 24 23:47:01 Updated: python-pulp-repoauth-2.8.0-1.el7.noarch 
> Mar 24 23:47:03 Updated: python-pulp-rpm-common-2.8.0-1.el7.noarch Mar 24 23:47:03 Updated:
> python-pulp-client-lib-2.8.0-1.el7.noarch Mar 24 23:47:04 Updated:
> python-pulp-puppet-common-2.8.0-1.el7.noarch Mar 24 23:47:04 Installed:
> python-pulp-docker-common-2.0.0-1.el7.noarch Mar 24 23:47:05 Updated:
> python-pulp-bindings-2.8.0-1.el7.noarch Mar 24 23:47:06 Updated: pulp-admin-client-2.8.0-1.el7.noarch 
> *Mar 24 23:47:14 Installed: pulp-server-2.8.0-1.el7.noarch* Mar 24 23:47:15 Installed:
> pulp-docker-plugins-2.0.0-1.el7.noarch Mar 24 23:47:16 Updated:
> pulp-rpm-admin-extensions-2.8.0-1.el7.noarch Mar 24 23:47:17 Updated:
> pulp-puppet-admin-extensions-2.8.0-1.el7.noarch Mar 24 23:47:18 Updated:
> python-pulp-oid_validation-2.8.0-1.el7.noarch Mar 24 23:49:01 Updated: pulp-selinux-2.8.0-1.el7.noarch 
> Mar 25 00:01:40 Installed: pulp-rpm-plugins-2.8.0-1.el7.noarch Mar 25 04:31:03 Обновлено:
> python-kombu.noarch 1:3.0.33-4.pulp.el7 Mar 25 04:31:13 Установлено: pulp-docker-admin-extensions.noarch
> 2.0.0-1.el7
> 
> On pulp-consumer key was not changed since pulp-consumer installation time (June 2015)
> 
> I think the root cause for this is here ->
> http://pulp.readthedocs.org/en/latest/user-guide/release-notes/2.8.x.html#upgrade-instructions-for-2-7-x-2-8
- -x.
>
> 
Removing python-semantic-version package causes removal of pulp-server package. Later on when I reinstalled
> server, certificates were updated as well

Yikes.  We should be advising users to do:

$ rpm -e --nodeps python-semantic-version

instead of using yum/dnf for just this reason when working around this upgrade problem.

> 
> Discussion thread is here -> https://www.redhat.com/archives/pulp-list/2016-March/msg00078.html
> 
> 
> 2016-04-05 16:32 GMT+03:00 Jeff Ortel <jortel at redhat.com <mailto:jortel at redhat.com>>:
> 
> 
> 
> On 04/04/2016 09:53 AM, Konstantin M. Khankin wrote:
>> Hi Jeff!
> 
>> [root at drone ~]# pulp-consumer -v history 
>> +----------------------------------------------------------------------+ Consumer History [drone] 
>> +----------------------------------------------------------------------+
> 
>> 2016-04-04 19:46:18,164 - ERROR - Client-side exception occurred Traceback (most recent call last):
>> File "/usr/lib/python2.7/site-packages/pulp/client/extensions/core.py", line 474, in run exit_code = 
>> Cli.run(self, args) File "/usr/lib/python2.7/site-packages/okaara/cli.py", line 974, in run exit_code
>> = command_or_section.execute(self.prompt, remaining_args) File 
>> "/usr/lib/python2.7/site-packages/pulp/client/extensions/extensions.py", line 210, in execute return 
>> self.method(*arg_list, **clean_kwargs) File 
>> "/usr/lib/python2.7/site-packages/pulp/client/consumer/cli.py", line 367, in history 
>> kwargs['start-date'], kwargs['end-date']).response_body File 
>> "/usr/lib/python2.7/site-packages/pulp/bindings/consumer.py", line 199, in history return 
>> self.server.GET(path, queries) File "/usr/lib/python2.7/site-packages/pulp/bindings/server.py", line
>> 92, in GET return self._request('GET', path, queries, ignore_prefix=ignore_prefix) File 
>> "/usr/lib/python2.7/site-packages/pulp/bindings/server.py", line 152, in _request response_code, 
>> response_body = self.server_wrapper.request(method, url, body) File 
>> "/usr/lib/python2.7/site-packages/pulp/bindings/server.py", line 349, in request raise 
>> exceptions.ConnectionException(None, str(err), None) ConnectionException: (None, 'tlsv1 alert decrypt 
>> error', None) An error occurred attempting to contact the server. More information may be found using
>> the -v flag.
> 
>> /etc/pulp/consumer/consumer.conf looks correct (correct server name and verify_ssl: False). Checked on
>> a server - httpd's configs pulp.conf and pulp.conf.rpmsave have no differences in SSL section. 
>> .pulp/consumer.log does not contain any recent records
> 
>> I just think that maybe I need to re-register my consumers... But then again why could it have
>> happened?
> 
> I wonder if the /etc/pki/pulp/ca.* got updated somehow during the upgrade.  Can you check the date on
> those files?
> 
> 
>> 2016-04-04 17:21 GMT+03:00 Jeff Ortel <jortel at redhat.com <mailto:jortel at redhat.com>
> <mailto:jortel at redhat.com <mailto:jortel at redhat.com>>>:
> 
>> Konstantin,
> 
>> The agent validates registration by making a REST API call to the server using the consumer
>> certificate. On the consumer, can you try running a pulp-consumer command?
> 
>> For example:
> 
>> $ pulp-consumer history
> 
>> Thanks,
> 
>> Jeff
> 
>> On 04/02/2016 04:51 PM, Konstantin M. Khankin wrote:
>>> Hello!
> 
>>> After 2.7->2.8 upgrade all consumers cannot talk to pulp server - goferd returns the next error on
>>> any operation: [WARNING][MainThread] pulp.agent.gofer.pulpplugin:107 - validate registration failed: 
>>> (None, 'tlsv1 alert decrypt error', None)
> 
>>> I didn't change any keys or configs. Logs also do not help. What could went wrong?
> 
>>> Thanks!
> 
>>> -- Konstantin Khankin
> 
> 
>>> _______________________________________________ Pulp-list mailing list Pulp-list at redhat.com
>>> <mailto:Pulp-list at redhat.com>
>> <mailto:Pulp-list at redhat.com <mailto:Pulp-list at redhat.com>>
>>> https://www.redhat.com/mailman/listinfo/pulp-list
> 
> 
> 
> 
> 
>> -- Ханкин Константин
> 
> 
> 
> 
> -- Ханкин Константин
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCAAGBQJXBBzIAAoJEM9lW7UwFwZXFLwP/R/gaQLT80CmEu4XzIvrCCnc
626lxKdYd3qKgyLNJvFrfgY4pFFbcwHCNGx9BhX1skt+gUoQ5yw3JxzIMTuenbma
vL3LLSwiCaszKfEd1Lcl4EBhgcZ56Z4+88AFcj4JOs2tKLYlDsn4Y1vaC0tuKbnr
RFVpjb8QiPi0PJXZwI/kv1PQTwOV8NwE7VOgDqcrkXVEdlYniSs6qG419ajipRdC
QNbFPpRolY23+hztW4wL7PBMbapGF2iWQurAJer4xLX5WuB6Yxfcxr+Aw6uqVdf0
is7teO2yTphVXSBcmaYy2WGdLMl4TA7LGInlveTvHiD3be6uachFESD/s7dwnr14
djqi7Y1093xQF8jzPW0RV2G8ZVxUntVE5onQ89SII08YP32li3S7aUQjt/ii6pes
pprjJAdBGAl29v9cnbYx9NUOI5caasyk1w4I01H7dg6b43tjkm2jM/tJTV+PKgWP
y4PKeS8afaaKdThBLCisQ19mnDQ04voknK1UTDnOSaRSIjY2Mx8iB8BD7iXwVbOx
Q2q6Pqy6t+KsfbQ9YkzDZq/a54O+dYbAZMBDztFvvAvDrqodm6qpnyJX2klolChV
j6MoOp5dmRpmq5nadQ9rtZhEa5LUccF39y97hWMwDQEEUTuON3owZc24yxYQYARj
I+j+OPn3WX81RTD7GFlS
=b1v5
-----END PGP SIGNATURE-----