Describe what you would like us to do:

I'd like to create an update on bodhi.stg. However, the page for creating a new update can't be loaded, returns HTTP 504 Gateway Time-out:
https://bodhi.stg.fedoraproject.org/updates/new

When do you need this to be done by? (YYYY/MM/DD)

Not critical, but blocks my testing.

Metadata Update from @mohanboddu:
- Issue priority set to: Waiting on Assignee (was: Needs Review)
- Issue tagged with: medium-gain, medium-trouble, ops

3 years ago

kevin commented 3 years ago

Seems like a keytab issue? bodhi can't talk to koji...

2021-05-25 18:34:29,181 [ERROR] koji: (gssapi auth failed: requests.exceptions.HTTPError: 401 Client Error: Unauthorized for url: https://koji.stg.fedoraproject.org/kojihub/ssllogin)

I tried to delete the keytab secret and re-run the playbook, but it didn't seem to help.

kevin commented 3 years ago

@pingou you have messed with keytabs in openshift... any ideas here?

kparal commented 3 years ago

I'd be very grateful if somebody could fix this... :-)

pingou commented 3 years ago

I see two keytabs in the web pod: /etc/keytabs/koji-keytab and /etc/krb5.bodhi_bodhi.stg.fedoraproject.org.keytab not quite sure which is being used.

The pod doesn't kinit or klist so I've not been able to check which principal they refer to.
On os-master01.stg I see a koji-keytab.kt which seems to have the right principal.

I'm not seeing anything in krb5.conf specifying a default keytab to use. Could this be it?

pingou commented 3 years ago

I see two keytabs in the web pod: /etc/keytabs/koji-keytab and /etc/krb5.bodhi_bodhi.stg.fedoraproject.org.keytab not quite sure which is being used.

Found the answer to that one:

# Set up krb5
RUN rm -f /etc/krb5.conf && \
    ln -sf /etc/bodhi/krb5.conf /etc/krb5.conf && \
    ln -sf /etc/keytabs/koji-keytab /etc/krb5.bodhi_bodhi{{ env_suffix }}.fedoraproject.org.keytab

Source: https://pagure.io/fedora-infra/ansible/blob/main/f/roles/openshift-apps/bodhi/templates/dockerfile-base

pingou commented 3 years ago

ah!

https://pagure.io/fedora-infra/ansible/blob/main/f/roles/bodhi2/base/templates/production.ini.j2#_432 vs /etc/krb5.bodhi_bodhi.stg.fedoraproject.org.keytab looks like it's missing the .stg