#9634 Nightly test failure (@pki/master) in test_ipahealthcheck.py::TestIpaHealthCheck::test_ipa_healthcheck_revocation
Closed: fixed by frenaud. Opened by frenaud.

The nightly test test_ipahealthcheck.py::TestIpaHealthCheck::test_ipa_healthcheck_revocation is failing with pki packages taken from the copr repo @pki/master.

Seen in PR 3834 with the following logs and report:

self = <ipatests.test_integration.test_ipahealthcheck.TestIpaHealthCheck object at 0x7f0177370ef0>
    def test_ipa_healthcheck_revocation(self):
        """
        Ensure that healthcheck reports when IPA certs are revoked.
        """
        error_msg = (
            "Certificate tracked by {key} is revoked {revocation_reason}"
        )
        error_msg_0_4 = (
            "Certificate is revoked, unspecified"
        )
        result = self.master.run_command(
            ["getcert", "list", "-f", paths.HTTPD_CERT_FILE]
        )
        request_id = get_certmonger_fs_id(result.stdout_text)
        # Revoke the web cert
        certfile = self.master.get_file_contents(paths.HTTPD_CERT_FILE)
        cert = x509.load_certificate_list(certfile)
        serial = cert[0].serial_number
>       self.master.run_command(["ipa", "cert-revoke", str(serial)])
test_integration/test_ipahealthcheck.py:923: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <ipatests.pytest_ipa.integration.host.Host master.ipa.test (master)>
argv = ['ipa', 'cert-revoke', '9'], set_env = True, stdin_text = None
log_stdout = True, raiseonerr = True, cwd = None, bg = False, encoding = 'utf-8'
ok_returncode = 0
    def run_command(self, argv, set_env=True, stdin_text=None,
                    log_stdout=True, raiseonerr=True,
                    cwd=None, bg=False, encoding='utf-8', ok_returncode=0):
        """Wrapper around run_command to log stderr on raiseonerr=True
        :param ok_returncode: return code considered to be correct,
                              you can pass an integer or sequence of integers
        """
        result = super().run_command(
            argv, set_env=set_env, stdin_text=stdin_text,
            log_stdout=log_stdout, raiseonerr=False, cwd=cwd, bg=bg,
            encoding=encoding
        )
        # in FIPS mode SSH may print noise to stderr, remove the string
        # "FIPS mode initialized" + optional newline.
        result.stderr_bytes = FIPS_NOISE_RE.sub(b'', result.stderr_bytes)
        try:
            result_ok = result.returncode in ok_returncode
        except TypeError:
            result_ok = result.returncode == ok_returncode
        if not result_ok and raiseonerr:
            result.log.error('stderr: %s', result.stderr_text)
>           raise subprocess.CalledProcessError(
                result.returncode, argv,
                result.stdout_text, result.stderr_text
            )
E           subprocess.CalledProcessError: Command '['ipa', 'cert-revoke', '9']' returned non-zero exit status 1.
pytest_ipa/integration/host.py:202: CalledProcessError
----------------------------- Captured stderr call -----------------------------
ipa: ERROR: stderr: ipa: ERROR: Request failed with status 404: Non-2xx response from CA REST API: 404. 

The call to ipa cert-revoke is failing. Internally, the code tries to find which PKI version is installed using a call to PKI endpoint /pki/rest/info (https://pagure.io/freeipa/blob/5d3c6b761b9d59ce6640d1141848eb66585795f7/f/ipaserver/plugins/dogtag.py#_1165-1173) but this endpoint has been removed with the pki commit https://github.com/dogtagpki/pki/commit/74e5f89343d55c6a555dc65d4591a02fb70675c8 Move current REST APIs to v1 package .

The endpoint is now available in pki/v1/info.

IPA should be able to handle the exception and fallback to the other endpoint.


Metadata Update from @frenaud:
- Issue tagged with: test-failure

Fixed with commit https://github.com/dogtagpki/pki/commit/cd070b882e47bdb92cc17ce01f81bd4f97e80efb that adds a rewriterule from pki/rest/info to pki/v1/info

Green run in PR#3947: details

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

Metadata