Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-45175

Baremetal IPI install fails to retrieve boot iso with SSLError - ssl service is not running on the 6180 port used for IPv6

XMLWordPrintable

    • Critical
    • None
    • 3
    • Metal Platform 263
    • 1
    • Approved
    • False
    • Hide

      None

      Show
      None
    • Release Note Not Required
    • In Progress

      Description of problem:

      Following error returns in IPI Baremetal install with recent 4.18 builds. In bootstrap vm, https is not configured on 6180 port used in boot iso url. 
      
      openshift-master-1: inspection error: Failed to inspect hardware. Reason: unable to start inspection: HTTP POST https://[2620:52:0:834::f1]:8000/redfish/v1/Managers/7fffdce9-ff4a-4e6a-b598-381c58564ca5/VirtualMedia/Cd/Actions/VirtualMedia.InsertMedia returned code 500. Base.1.0.GeneralError: Failed fetching image from URL https://[2620:52:0:834:f112:3cff:fe47:3a0a]:6180/redfish/boot-93d79ad0-0d56-4c8f-a299-6dc1b3f40e74.iso: HTTPSConnectionPool(host='2620:52:0:834:f112:3cff:fe47:3a0a', port=6180): Max retries exceeded with url: /redfish/boot-93d79ad0-0d56-4c8f-a299-6dc1b3f40e74.iso (Caused by SSLError(SSLError(1, '[SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:1131)'))) Extended information: [{'@odata.type': '/redfish/v1/$metadata#Message.1.0.0.Message', 'MessageId': 'Base.1.0.GeneralError'}]"
        

      Version-Release number of selected component (if applicable):

       4.18 ec.4, 4.18.0-0.nightly-2024-11-27-162407

      How reproducible:

          100%

      Steps to Reproduce:

          1. trigger ipi baremetal install with dual stack config using virtual media
          2. 
          3.
          

      Actual results:

          inspection fails at fetching boot iso 

      Expected results:

          

      Additional info:

      # port 6180 used in ironic ipv6 url is not configured for https. Instead, ssl service is running 
      # at https://[2620:52:0:834:f112:3cff:fe47:3a0a]:6183. 
      # May be introduced by OCPBUGS-39404.
      
      [root@api core]# cat /etc/metal3.env 
      AUTH_DIR=/opt/metal3/auth
      IRONIC_ENDPOINT="http://bootstrap-user:pJ0R9XXsxUfoYVK2@localhost:6385/v1"
      IRONIC_EXTERNAL_URL_V6="https://[2620:52:0:834:f112:3cff:fe47:3a0a]:6180/"
      METAL3_BAREMETAL_OPERATOR_IMAGE="quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:e142d5989415da3c1035d04f84fa765c127bf2cf3406c4612e36607bb03384d9"  
      
      
      [root@api core]# echo "" | openssl s_client -connect localhost:6180
      CONNECTED(00000003)
      405CE187787F0000:error:0A00010B:SSL routines:ssl3_get_record:wrong version number:ssl/record/ssl3_record.c:354:
      ---
      no peer certificate available
      ---
      No client certificate CA names sent
      ---
      SSL handshake has read 5 bytes and written 295 bytes
      Verification: OK
      ---
      New, (NONE), Cipher is (NONE)
      Secure Renegotiation IS NOT supported
      Compression: NONE
      Expansion: NONE
      No ALPN negotiated
      Early data was not sent
      Verify return code: 0 (ok)
      ---
      

              rpittau@redhat.com Riccardo Pittau
              rhn-support-yliu1 Yang Liu
              Jad Haj Yahya Jad Haj Yahya
              Votes:
              0 Vote for this issue
              Watchers:
              6 Start watching this issue

                Created:
                Updated: