Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-82694

[RHEL-9] Cannot download kickstart file from remote server when using encrypted DNS signed by trusted CA

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Normal Normal
    • rhel-9.7
    • rhel-9.6
    • anaconda
    • No
    • Moderate
    • rhel-sst-installer
    • 5
    • False
    • Hide

      None

      Show
      None
    • No
    • None
    • Unspecified Release Note Type - Unknown
    • Unspecified
    • Unspecified
    • Unspecified
    • None

      What were you trying to do that didn't work?

      I wanted to use a kickstart file from a remote server (HTTP/HTTPS) while using an encrypted DNS server signed by a trusted CA. For example using the following boot arguments:

      ip=192.168.122.10::192.168.122.1:24:client:enp1s0:none
      rd.net.dns=dns+tls://1.1.1.1#one.one.one.one
      rd.net.dns-backend=dnsconfd
      rd.net.dns-resolve-mode=exclusive
      inst.ks=https://raw.githubusercontent.com/rhinstaller/kickstart-tests/refs/heads/main/authconfig.ks.in
      

      Since the eDNS server is signed by a trusted CA, it's not necessary to provide any custom certificates and hostname resolving should just work. But the installer doesn't start dnsconfd:

      ...
      [    5.544520] dracut-cmdline[302]: //lib/anaconda-lib.sh@482(start_dnsconfd): echo 'Attempting to start dnsconfd. Not starting because certificates can be imported via kickstart later.'
      ...
      

      Please provide the package NVR for which the bug is seen:

      anaconda-34.25.5.17-1.el9_6

      How reproducible is this bug?:

      Always

      Steps to reproduce

      1. Boot the installation ISO with the following additional boot arguments:
        ip=192.168.122.10::192.168.122.1:24:client:enp1s0:none rd.net.dns=dns+tls://1.1.1.1#one.one.one.one rd.net.dns-backend=dnsconfd rd.net.dns-resolve-mode=exclusive inst.ks=https://raw.githubusercontent.com/rhinstaller/kickstart-tests/refs/heads/main/authconfig.ks.in
        

      Expected results

      The kickstart file is successfully downloaded. (The installation is expected to fail after downloading and parsing the kickstart file, since the kickstart file is not valid/complete)

      Actual results

      The installer is unable to resolve the host name.

              anaconda-maint-list anaconda-maint-list
              jstodola@redhat.com Jan Stodola
              anaconda-maint-list anaconda-maint-list
              Release Test Team Release Test Team
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated: