Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-84891

Error in using the RHEL system role for nbde client

Linking RHIVOS CVEs to...Migration: Automation ...RHELPRIO AssignedTeam ...SWIFT: POC ConversionSync from "Extern...XMLWordPrintable

    • rhel-system-roles
    • 2
    • Dev ack
    • False
    • False
    • Hide

      None

      Show
      None
    • Yes
    • Red Hat Enterprise Linux
    • SECENGSP Cycle 17
    • Unspecified Release Note Type - Unknown
    • Hide


      Enhancement:

      Fix idempotence issue when binding fails to be added

      Reason:

      Sometimes, the role will not be able to add the required bindings, in which case it is expected to rollback and undo any change it has done.

      In certain cases, the rollback was not performed correctly, and caused idempotence issues. We fix that by performing a backup of the LUKS header before doing the operations, so that we can properly restore it in the case the operation cannot be completed successfully.

      Result:

      The role now performs correctly and maintains the idempotence property in the cases where the binding failed to be added.

      Issue Tracker Tickets (Jira or BZ if any): https://issues.redhat.com/browse/RHEL-84891
      Show
      Enhancement: Fix idempotence issue when binding fails to be added Reason: Sometimes, the role will not be able to add the required bindings, in which case it is expected to rollback and undo any change it has done. In certain cases, the rollback was not performed correctly, and caused idempotence issues. We fix that by performing a backup of the LUKS header before doing the operations, so that we can properly restore it in the case the operation cannot be completed successfully. Result: The role now performs correctly and maintains the idempotence property in the cases where the binding failed to be added. Issue Tracker Tickets (Jira or BZ if any): https://issues.redhat.com/browse/RHEL-84891
    • Proposed
    • Unspecified
    • Unspecified
    • Unspecified
    • None

      The customer is using RHEL system role to bind nbde client to tang server. Below is the playbook used by them.

      - hosts: "{{ _target | d('all') }}"
  gather_facts: "{{ _gather_facts | d('yes') }}"
  become: "{{ _become | d('yes') }}"
  serial: "{{ _serial | d(omit) }}"
  roles:
    - role: redhat.rhel_system_roles.nbde_client

       

      nbde_client_bindings:
  - device: /dev/sda2
    encryption_password: "luks-password"
    servers:
      - http://tang1.nbde-001.prod.iad2.dc.redhat.com
      - http://tang2.nbde-001.prod.iad2.dc.redhat.com
      - http://tang1-rhel9.nbde-001.prod.us-east-1.aws.redhat.com
      - http://tang2-rhel9.nbde-001.prod.us-east-1.aws.redhat.com

       
      When there are multiple tang servers configured in playbook, the playbook shows following error:
       

       msg: |-
    Error importing token: Failed to import token from file.

       
      If we keep only one tang server in above playbook then it succeeds first time. But running it again results in following error:
       

      Unknown macro: {  "msg"}
,
    "_ansible_no_log": true,
    "changed": false
  },
  "_ansible_no_log": false,
  "changed": false
}

       So, there are two issues with above playbook 
      1) Having more than one tang server in playbook results in following error: 

       msg: |- Error importing token: Failed to import token from file.

       
      2) If we keep only one tang server entry in playbook, then it succeeds.
         However, running the same playbook again results in below error: 

      msg": "slot already used, but not bound by clevis. cannot use it

       

      • Environment:

                  – RHEL 9.5

                  – nbde_client module version 1.88.9

        1. 0010-sosreport-domain-monitor-04090891-2025-03-19-vtqrrve.tar.xz
          13.60 MB

              scorreia@redhat.com Sergio Correia
              rhn-support-mgandhi Milan Gandhi
              Richard Megginson Richard Megginson
              David Jez David Jez
              Jan Fiala Jan Fiala
              Votes:
              1 Vote for this issue
              Watchers:
              11 Start watching this issue

                Created:
                Updated: