CASMNET-2241 - Resolve external DNS test fails with port present in URL #614

spillerc-hpe · 2024-10-29T11:42:30Z

Summary and Scope

The Resolve external DNS Goss test fails if LDAP has been configured with a port in the URL as the script doesn't remove the port from the hostname before issuing the DNS query.

FIRST_URL=ldap.example.com:636
host -4 -t A ldap.example.com:636
Host ldap.example.com:636 not found: 3(NXDOMAIN)

This PR changes the test to be able to correctly handle a URL with a port while maintaining backwards compatibility with URLs that do not.

Issues and Related PRs

Resolves CASMNET-2241

Testing

List the environments in which these changes were tested.

Tested on:

drax

Test description:

URL without port

ncn-m002:~/cspiller # ./check_goss_k8s_resolve_external_dns.sh
SYSTEM_NAME=drax
SITE_DOMAIN=hpc.amslabs.hpecorp.net
SYSTEM_DOMAIN=drax.hpc.amslabs.hpecorp.net
INGRESS=https://auth.cmn.drax.hpc.amslabs.hpecorp.net
FORWARD_ADDR=16.110.135.51
LDAP_PROVIDER={
--snip--
Unbound and LDAP are configured
CONNECTION_URLS=ldaps://dcldap2.hpc.amslabs.hpecorp.net
FIRST_URL=dcldap2.hpc.amslabs.hpecorp.net
Attempting to resolve (A record) dcldap2.hpc.amslabs.hpecorp.net
dcldap2.hpc.amslabs.hpecorp.net has address 10.101.116.10
PASSED

ncn-m002:~/cspiller # ./check_goss_k8s_resolve_external_dns.sh
SYSTEM_NAME=drax
SITE_DOMAIN=hpc.amslabs.hpecorp.net
SYSTEM_DOMAIN=drax.hpc.amslabs.hpecorp.net
INGRESS=https://auth.cmn.drax.hpc.amslabs.hpecorp.net
FORWARD_ADDR=16.110.135.51
LDAP_PROVIDER={
  "id": "23ef31ae-1143-4e94-935d-4abec8b66836",
  "name": "shasta-user-federation-ldap",
  "providerId": "ldap",
  "providerType": "org.keycloak.storage.UserStorageProvider",
  "parentId": "d086f62a-b2a1-481a-88eb-4a2ae272858f",
  "config": {
    "fullSyncPeriod": [
      "-1"
    ],
    "pagination": [
      "true"
    ],
    "startTls": [
      "false"
    ],
    "usersDn": [
      "dc=dcldap,dc=dit"
    ],
    "connectionPooling": [
      "true"
    ],
    "cachePolicy": [
      "DEFAULT"
    ],
    "useKerberosForPasswordAuthentication": [
      "false"
    ],
    "importEnabled": [
      "true"
    ],
    "enabled": [
      "true"
    ],
    "usernameLDAPAttribute": [
      "uid"
    ],
    "changedSyncPeriod": [
      "-1"
    ],
    "lastSync": [
      "1728039651"
    ],
    "vendor": [
      "other"
    ],
    "uuidLDAPAttribute": [
      "uid"
    ],
    "allowKerberosAuthentication": [
      "false"
    ],
    "connectionUrl": [
      "ldaps://dcldap2.hpc.amslabs.hpecorp.net"
    ],
    "syncRegistrations": [
      "false"
    ],
    "authType": [
      "none"
    ],
    "debug": [
      "true"
    ],
    "searchScope": [
      "2"
    ],
    "useTruststoreSpi": [
      "ldapsOnly"
    ],
    "usePasswordModifyExtendedOp": [
      "false"
    ],
    "trustEmail": [
      "false"
    ],
    "priority": [
      "1"
    ],
    "userObjectClasses": [
      "posixAccount"
    ],
    "rdnLDAPAttribute": [
      "uid"
    ],
    "editMode": [
      "READ_ONLY"
    ],
    "validatePasswordPolicy": [
      "false"
    ],
    "batchSizeForSync": [
      "4000"
    ]
  }
}
Unbound and LDAP are configured
CONNECTION_URLS=ldaps://dcldap2.hpc.amslabs.hpecorp.net
FIRST_URL=dcldap2.hpc.amslabs.hpecorp.net
Attempting to resolve (A record) dcldap2.hpc.amslabs.hpecorp.net
dcldap2.hpc.amslabs.hpecorp.net has address 10.101.116.10
PASSED

URL with port

ncn-m002:~/cspiller # ./check_goss_k8s_resolve_external_dns.sh
SYSTEM_NAME=drax
SITE_DOMAIN=hpc.amslabs.hpecorp.net
SYSTEM_DOMAIN=drax.hpc.amslabs.hpecorp.net
INGRESS=https://auth.cmn.drax.hpc.amslabs.hpecorp.net
FORWARD_ADDR=16.110.135.51
LDAP_PROVIDER={
--snip--
Unbound and LDAP are configured
CONNECTION_URLS=ldaps://dcldap2.hpc.amslabs.hpecorp.net:636
FIRST_URL=dcldap2.hpc.amslabs.hpecorp.net
Attempting to resolve (A record) dcldap2.hpc.amslabs.hpecorp.net
dcldap2.hpc.amslabs.hpecorp.net has address 10.101.116.10
PASSED

ncn-m002:~/cspiller # ./check_goss_k8s_resolve_external_dns.sh
SYSTEM_NAME=drax
SITE_DOMAIN=hpc.amslabs.hpecorp.net
SYSTEM_DOMAIN=drax.hpc.amslabs.hpecorp.net
INGRESS=https://auth.cmn.drax.hpc.amslabs.hpecorp.net
FORWARD_ADDR=16.110.135.51
LDAP_PROVIDER={
  "id": "23ef31ae-1143-4e94-935d-4abec8b66836",
  "name": "shasta-user-federation-ldap",
  "providerId": "ldap",
  "providerType": "org.keycloak.storage.UserStorageProvider",
  "parentId": "d086f62a-b2a1-481a-88eb-4a2ae272858f",
  "config": {
    "fullSyncPeriod": [
      "-1"
    ],
    "pagination": [
      "true"
    ],
    "startTls": [
      "false"
    ],
    "usersDn": [
      "dc=dcldap,dc=dit"
    ],
    "connectionPooling": [
      "true"
    ],
    "cachePolicy": [
      "DEFAULT"
    ],
    "useKerberosForPasswordAuthentication": [
      "false"
    ],
    "importEnabled": [
      "true"
    ],
    "enabled": [
      "true"
    ],
    "usernameLDAPAttribute": [
      "uid"
    ],
    "changedSyncPeriod": [
      "-1"
    ],
    "lastSync": [
      "1728039651"
    ],
    "vendor": [
      "other"
    ],
    "uuidLDAPAttribute": [
      "uid"
    ],
    "connectionUrl": [
      "ldaps://dcldap2.hpc.amslabs.hpecorp.net:636"
    ],
    "allowKerberosAuthentication": [
      "false"
    ],
    "syncRegistrations": [
      "false"
    ],
    "authType": [
      "none"
    ],
    "debug": [
      "true"
    ],
    "searchScope": [
      "2"
    ],
    "useTruststoreSpi": [
      "ldapsOnly"
    ],
    "usePasswordModifyExtendedOp": [
      "false"
    ],
    "trustEmail": [
      "false"
    ],
    "priority": [
      "1"
    ],
    "userObjectClasses": [
      "posixAccount"
    ],
    "rdnLDAPAttribute": [
      "uid"
    ],
    "editMode": [
      "READ_ONLY"
    ],
    "validatePasswordPolicy": [
      "false"
    ],
    "batchSizeForSync": [
      "4000"
    ]
  }
}
Unbound and LDAP are configured
CONNECTION_URLS=ldaps://dcldap2.hpc.amslabs.hpecorp.net:636
FIRST_URL=dcldap2.hpc.amslabs.hpecorp.net
Attempting to resolve (A record) dcldap2.hpc.amslabs.hpecorp.net
dcldap2.hpc.amslabs.hpecorp.net has address 10.101.116.10
PASSED

Multiple URLs

ncn-m002:~/cspiller # ./check_goss_k8s_resolve_external_dns.sh
SYSTEM_NAME=drax
SITE_DOMAIN=hpc.amslabs.hpecorp.net
SYSTEM_DOMAIN=drax.hpc.amslabs.hpecorp.net
INGRESS=https://auth.cmn.drax.hpc.amslabs.hpecorp.net
FORWARD_ADDR=16.110.135.51
LDAP_PROVIDER={
--snip--
Unbound and LDAP are configured
CONNECTION_URLS=ldaps://dcldap2.hpc.amslabs.hpecorp.net:636 ldaps://dcldap3.hpc.amslabs.hpecorp.net:636
FIRST_URL=dcldap2.hpc.amslabs.hpecorp.net
Attempting to resolve (A record) dcldap2.hpc.amslabs.hpecorp.net
dcldap2.hpc.amslabs.hpecorp.net has address 10.101.116.10
PASSED

ncn-m002:~/cspiller # ./check_goss_k8s_resolve_external_dns.sh
SYSTEM_NAME=drax
SITE_DOMAIN=hpc.amslabs.hpecorp.net
SYSTEM_DOMAIN=drax.hpc.amslabs.hpecorp.net
INGRESS=https://auth.cmn.drax.hpc.amslabs.hpecorp.net
FORWARD_ADDR=16.110.135.51
LDAP_PROVIDER={
  "id": "23ef31ae-1143-4e94-935d-4abec8b66836",
  "name": "shasta-user-federation-ldap",
  "providerId": "ldap",
  "providerType": "org.keycloak.storage.UserStorageProvider",
  "parentId": "d086f62a-b2a1-481a-88eb-4a2ae272858f",
  "config": {
    "fullSyncPeriod": [
      "-1"
    ],
    "pagination": [
      "true"
    ],
    "startTls": [
      "false"
    ],
    "connectionPooling": [
      "true"
    ],
    "usersDn": [
      "dc=dcldap,dc=dit"
    ],
    "cachePolicy": [
      "DEFAULT"
    ],
    "useKerberosForPasswordAuthentication": [
      "false"
    ],
    "importEnabled": [
      "true"
    ],
    "enabled": [
      "true"
    ],
    "changedSyncPeriod": [
      "-1"
    ],
    "usernameLDAPAttribute": [
      "uid"
    ],
    "lastSync": [
      "1728039651"
    ],
    "vendor": [
      "other"
    ],
    "uuidLDAPAttribute": [
      "uid"
    ],
    "connectionUrl": [
      "ldaps://dcldap2.hpc.amslabs.hpecorp.net:636 ldaps://dcldap3.hpc.amslabs.hpecorp.net:636"
    ],
    "allowKerberosAuthentication": [
      "false"
    ],
    "syncRegistrations": [
      "false"
    ],
    "authType": [
      "none"
    ],
    "debug": [
      "true"
    ],
    "searchScope": [
      "2"
    ],
    "useTruststoreSpi": [
      "ldapsOnly"
    ],
    "usePasswordModifyExtendedOp": [
      "false"
    ],
    "trustEmail": [
      "false"
    ],
    "priority": [
      "1"
    ],
    "userObjectClasses": [
      "posixAccount"
    ],
    "rdnLDAPAttribute": [
      "uid"
    ],
    "editMode": [
      "READ_ONLY"
    ],
    "validatePasswordPolicy": [
      "false"
    ],
    "batchSizeForSync": [
      "4000"
    ]
  }
}
Unbound and LDAP are configured
CONNECTION_URLS=ldaps://dcldap2.hpc.amslabs.hpecorp.net:636 ldaps://dcldap3.hpc.amslabs.hpecorp.net:636
FIRST_URL=dcldap2.hpc.amslabs.hpecorp.net
Attempting to resolve (A record) dcldap2.hpc.amslabs.hpecorp.net
dcldap2.hpc.amslabs.hpecorp.net has address 10.101.116.10
PASSED

CSM health validation using old script

Using CONNECTION_URLS=ldaps://dcldap2.hpc.amslabs.hpecorp.net:636 ldaps://dcldap3.hpc.amslabs.hpecorp.net:636

ncn-m001:~ # /opt/cray/tests/install/ncn/automated/ncn-k8s-combined-healthcheck
NCN and Kubernetes Checks
------------------------------

DEBUG: cmsdev_test_list='bos cfs conman ims tftp vcs'
Writing full output to /opt/cray/tests/install/logs/print_goss_json_results/20241029_112901.152373-935911-MV3uMl4m/out

Running tests

Checking test results
Only errors will be printed to the screen

Result: FAIL
Source: http://ncn-m001.hmn:8998/ncn-healthcheck-master-single
Test Name: Resolve external DNS
Description: Validates that an external DNS name resolves.

The test passes if LDAP is not configured or if LDAP is configured and the first configured LDAP server hostname can be resolved.
The test fails in any of the following cases:

* Unbound is not configured
* The LDAP 'providerId' is configured but the LDAP 'connectionURL' is not.
* The LDAP server hostname fails to resolve.

In the case of failure, manually run /opt/cray/tests/install/ncn/scripts/check_goss_k8s_resolve_external_dns.sh on a Kubernetes NCN to see why the test failed.
Refer to 'operations/network/dns/Troubleshoot_Common_DNS_Issues.md' in the CSM documentation to troubleshoot external DNS issues.

Test Summary: Command: resolve_external_dns: exit-status:
Expected
    <int>: 1
to equal
    <int>: 0
Execution Time: 0.000020930 seconds
Node: ncn-m001



GRAND TOTAL: 647 passed, 1 failed
ERROR: There was at least one test failure

FAILED

CSM health validation using new script

Using CONNECTION_URLS=ldaps://dcldap2.hpc.amslabs.hpecorp.net:636 ldaps://dcldap3.hpc.amslabs.hpecorp.net:636

ncn-m001:~ # /opt/cray/tests/install/ncn/automated/ncn-k8s-combined-healthcheck
NCN and Kubernetes Checks
------------------------------

DEBUG: cmsdev_test_list='bos cfs conman ims tftp vcs'
Writing full output to /opt/cray/tests/install/logs/print_goss_json_results/20241029_113238.851943-960144-SAcnEddu/out

Running tests

Checking test results
Only errors will be printed to the screen

GRAND TOTAL: 648 passed, 0 failed

PASSED

Risks and Mitigations

Pull Request Checklist

Version number(s) incremented, if applicable
Copyrights updated
License file intact
Target branch correct
CHANGELOG.md updated
Testing is appropriate and complete, if applicable
HPC Product Announcement prepared, if applicable

spillerc-hpe · 2024-10-30T09:55:36Z

/backport release/1.5

github-actions · 2024-10-30T09:55:50Z

Backporting into branch release/1.5 was successful. New PR: #616

CASMNET-2241 - Resolve external DNS test fails with port present in UR

aee26bf

spillerc-hpe requested a review from a team as a code owner October 29, 2024 11:42

Merge branch 'release/1.6' into CASMNET-2241

c7f383a

jacobsalmela approved these changes Oct 29, 2024

View reviewed changes

spillerc-hpe merged commit baf7b52 into release/1.6 Oct 30, 2024
3 checks passed

spillerc-hpe deleted the CASMNET-2241 branch October 30, 2024 09:53

github-actions bot mentioned this pull request Oct 30, 2024

[Backport release/1.5] CASMNET-2241 - Resolve external DNS test fails with port present in URL #616

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

CASMNET-2241 - Resolve external DNS test fails with port present in URL #614

CASMNET-2241 - Resolve external DNS test fails with port present in URL #614

spillerc-hpe commented Oct 29, 2024

spillerc-hpe commented Oct 30, 2024

github-actions bot commented Oct 30, 2024

CASMNET-2241 - Resolve external DNS test fails with port present in URL #614

CASMNET-2241 - Resolve external DNS test fails with port present in URL #614

Conversation

spillerc-hpe commented Oct 29, 2024

Summary and Scope

Issues and Related PRs

Testing

Tested on:

Test description:

URL without port

URL with port

Multiple URLs

CSM health validation using old script

CSM health validation using new script

Risks and Mitigations

Pull Request Checklist

spillerc-hpe commented Oct 30, 2024

github-actions bot commented Oct 30, 2024