1
0
-1

Have you encountered that before ?

After I deployed ONAP, the health test for AAF SMS failed. For AAF all pod are in the running state

dev-aaf-aaf-cm-858d9bbd58-d56th 1/1 Running 0 41m 10.42.240.188 sb4-k8s-7 <none>
dev-aaf-aaf-cs-db78f4b6-h2j2c 1/1 Running 0 41m 10.42.235.199 sb4-k8s-4 <none>
dev-aaf-aaf-fs-cc68f85f7-lsq8r 1/1 Running 0 41m 10.42.240.25 sb4-k8s-6 <none>
dev-aaf-aaf-gui-8f979c4d9-pb5z5 1/1 Running 0 41m 10.42.255.184 sb4-k8s-5 <none>
dev-aaf-aaf-hello-84df87c74b-qx57n 1/1 Running 0 41m 10.42.64.59 sb4-k8s-14 <none>
dev-aaf-aaf-locate-74466c9857-fhkww 1/1 Running 0 41m 10.42.153.111 sb4-k8s-11 <none>
dev-aaf-aaf-oauth-65db47977f-5dpcz 1/1 Running 0 41m 10.42.37.94 sb4-k8s-10 <none>
dev-aaf-aaf-service-949959576-mlqr5 1/1 Running 0 41m 10.42.86.63 sb4-k8s-8 <none>
dev-aaf-aaf-sms-654b5554dd-s98hp 1/1 Running 0 41m 10.42.180.179 sb4-k8s-1 <none>
dev-aaf-aaf-sms-preload-xn57f 1/1 Running 0 41m 10.42.111.218 sb4-k8s-5 <none>
dev-aaf-aaf-sms-quorumclient-0 1/1 Running 0 41m 10.42.80.65 sb4-k8s-6 <none>
dev-aaf-aaf-sms-quorumclient-1 1/1 Running 0 40m 10.42.235.122 sb4-k8s-11 <none>
dev-aaf-aaf-sms-quorumclient-2 1/1 Running 0 38m 10.42.238.25 sb4-k8s-1 <none>
dev-aaf-aaf-sms-vault-0 2/2 Running 1 41m 10.42.91.159 sb4-k8s-10 <none>
dev-aaf-aaf-sshsm-distcenter-brbrq 0/1 Completed 0 41m 10.42.170.176 sb4-k8s-10 <none>
dev-aaf-aaf-sshsm-testca-wpbf8 0/1 Completed 0 41m 10.42.137.125 sb4-k8s-11

But there is something not working with the AAF SMS and I suspected that for the Health check failed of AAF SMS. I also suspect that OOF pods are waiting in init state for an available AAF SMS.

When I logged in dev-aaf-aaf-sms-654b5554dd-s98hp , I get the following result :

_URL: PUT http://aaf-sms-db:8200/v1/sys/policy/smsvaultpolicy_
Code: 503. Errors:

* Vault is sealed
ERROR: 2019/06/02 19:41:45 vault.go:483: Unable to create policy for approle creation
ERROR: 2019/06/02 19:41:45 vault.go:175: Token Check: Unable to initRole in checkToken
ERROR: 2019/06/02 19:41:45 handler.go:124: ListSecretHandler: Token check failed
WARNING: 2019/06/02 19:41:45 vault.go:389: Unable to find RoleID. Generating...
ERROR: 2019/06/02 19:41:45 auth.go:226: Read from file: open auth/role: no such file or directory
ERROR: 2019/06/02 19:41:45 vault.go:405: Creating Policy: Error making API request.

_URL: PUT http://aaf-sms-db:8200/v1/sys/policy/smsvaultpolicy_
Code: 503. Errors:

* Vault is sealed
ERROR: 2019/06/02 19:41:45 vault.go:483: Unable to create policy for approle creation
ERROR: 2019/06/02 19:41:45 vault.go:175: Token Check: Unable to initRole in checkToken
ERROR: 2019/06/02 19:41:45 handler.go:124: ListSecretHandler: Token check failed
2019/06/02 19:41:46 http: TLS handshake error from 10.42.111.218:56436: remote error: tls: bad certificate


Thanks for you help,

    CommentAdd your comment...

    3 answers

    1.  
      1
      0
      -1

      I met the same isssue in casabulanca release, could anyone help me out?@Kiran Kamineni

        CommentAdd your comment...
      1.  
        1
        0
        -1

        Thanks for your fast reply.

        As I understand, this is an internal x509 certificate ? I mean this is not related to an organizationnal unit outside ONAP ? (  in contrary or a web site for example). Is there a way the recreate a valid certifacate ( e.g using OpenSSL).

        Or is there any ways to solve that problem ? 

        Thank you!

          CommentAdd your comment...
        1.  
          1
          0
          -1

          Hi,


          It seems that certificate for aaf-sms expired on May 31st.

          onap-aaf-aaf-sms-preload is not finalizing

          Waiting for SMS to accept requests...
          Get https://aaf-sms.onap:10443/v1/sms/quorum/status: x509: certificate has expired or is not yet valid


          Certificate details:

          SN# 07

          Issuer:

          CN = intermediateCA_1
          OU = OSAAF
          O = ONAP
          C = US

          Valid to: ‎Friday, ‎31 ‎May ‎2019 

          Submitted to:

          CN = aaf-sms
          OU = OSAAF
          OU = aaf-sms@aaf-sms.onap.org
          O = ONAP
          C = US


          1. Frédéric Larocque

            Thanks for your fast reply.

            As I understand, this is an internal x509 certificate ? I mean this is not related to an organizationnal unit outside ONAP ? (  in contrary or a web site for example). Is there a way the recreate a valid certifacate ( e.g using OpenSSL).

            Or is there any ways to solve that problem ? 

            Thank you!

          2. Kiran Kamineni

            This certificate was created by AAF (Jonathan) and we used it at the time. Looks like the year expired for that one. I will file a request for a new certificate.

          3. Frédéric Larocque

            Thanks for your fast reply

            I made the required change to get the new image https://gerrit.onap.org/r/#/c/oom/+/89190/ 

            Now AAF works on my environnement.


          4. wutianwei

            I met the same isssue in casabulanca release, could anyone help me out?Frédéric Faucheux Kiran Kamineni

          CommentAdd your comment...