[mgmt-framework]: service fails to start on 201911 #4291
Comments
|
@dutta-partha please have a look |
|
@nazariig REST server is failing to load the certificate file. Is it present in mgmt-framework docker ? "Failed to load server cert/key -- open /etc/sonic/telemetry/streamingtelemetryserver.cer: no such file or directory" |
|
Hi @nazariig , both telemetry and mgmt-framework containers read server certificate configurations from DEVICE_METADATA['x509'] config_db entry. So, both containers should include same certificate files at same path. Please copy /etc/sonic/telemetry/streamingtelemetryserver.cer and /etc/sonic/telemetry/streamingtelemetryserver.key to mgmt-framework repo as well. |
|
@sachinholla , can you check? it is strange that mgmt-framework container tries to read streaming telmetry cert. is this by design? |
|
Yes, it is by design. Is DEVICE_METADATA['x509'] entry intended only for telemetry container? I don't think it is practical to have different server & CA certificates for different management services on one box. This must be the reason for having certificate configurations in a generic DEVICE_METADATA['x509'] table entry; while other telemetry service specific configurations (like port) in the TELEMETRY['gnmi'] table. Only caveat is that certificate files should be present in both containers at same path. This can be achieved by maintaining them under host /etc/sonic. |
|
in this pr, the telemetry is not using its own cert. a0d213c we are deprecating DEVICE_METADATA['x509'] as a cert location. mgmt-framework should have it's own certs location, even if it decides use the same cert as telemtry. it should still looking for its own location. |
Not aware of this enhancement.. We can make similar changes in mgmt-framework startup script also. hi @nazariig -- if you have pulled the commit a0d213c, please move certificate configurations from DEVICE_METADATA['x509'] to TELEMETRY['certs']. It should resolve the error in mgmt-framework for now. |
Guohan, I'm not sure about this change you made. Following reasons: -
Thanks, Ben |
|
mgmt fw should not use certs in TELEMETRY. it should use its own certs in config db, for example, MGMT_FRAMEWORK['certs'].
I do not know how this can be achieved. I think the right way is to have
Yes. MGMG_FW and TELEMTRY have different users, we would like authenticate the differently. |
[Ben]: It isn't - each docker has it's own certs file
[Ben]: The path reference is local to the respective docker
[Ben]: As I said, they were already using different certs files - the use case in question is whether they should different paths in configuration. Anyway, no big deal - we can go with your change and have separate path configuration for the 2 dockers. |
|
What do we have to do to close this one? Is there an associated PR that makes Guohan's requested change? |
|
@ben, schema change was discussed as part of Mgmt framework phase2 HLD. Was waiting for that approval. Now we have it and I will open a PR shortly. |
REST and telemetry servers were using "DEVICE_METADATA|x509" table for server certificate configurations. This table has been deprecated now. Enhanced REST server startup script to read server certificate file path configurations from REST_SERVER table. Three more attributes - server_crt, server_key and ca_crt are introduced as described in sonic-net/SONiC#550. For backard compatibility, certificate configurations are read from old "DEVICE_METADATA|x509" table if they (server_crt, server_key and ca_crt) are not present in REST_SERVER table. Fixes bug sonic-net#4291 Signed-off-by: Sachin Holla <sachin.holla@broadcom.com>
REST and telemetry servers were using "DEVICE_METADATA|x509" table for server certificate configurations. This table has been deprecated now. Enhanced REST server startup script to read server certificate file path configurations from REST_SERVER table. Three more attributes - server_crt, server_key and ca_crt are introduced as described in sonic-net/SONiC#550. For backard compatibility, certificate configurations are read from old "DEVICE_METADATA|x509" table if they (server_crt, server_key and ca_crt) are not present in REST_SERVER table. Fixes bug #4291 Signed-off-by: Sachin Holla <sachin.holla@broadcom.com>
Description
Mgmt-framework service fails to start:
Steps to reproduce the issue:
Describe the results you received:
mgmt-framework fails to start
Describe the results you expected:
mgmt-framework service should be operational or disabled
Additional information you deem important (e.g. issue happens only occasionally):
The issue is observed with Removing explicit libyang plugin path settings #4144 cherry-picked
The text was updated successfully, but these errors were encountered: