Recent backport breaks with many certificates (mplement cert cache for vault units (v2))
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
vault-charm |
Triaged
|
High
|
Unassigned |
Bug Description
A recent backport to vault breaks when vault manages many certificates for charm clients:
2022-07-30 01:23:36 DEBUG unit.vault/
2022-07-30 01:23:36 ERROR unit.vault/
Traceback (most recent call last):
File "/var/lib/
return f(*args, **kwargs)
File "/var/lib/
subprocess.
File "/usr/lib/
retcode = call(*popenargs, **kwargs)
File "/usr/lib/
with Popen(*popenargs, **kwargs) as p:
File "/usr/lib/
self.
File "/usr/lib/
raise child_exception
OSError: [Errno 7] Argument list too long: 'leader-set'
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "/var/lib/
bus.
File "/var/lib/
_invoke(
File "/var/lib/
handler.
File "/var/lib/
self.
File "/var/lib/
vault_
File "/var/lib/
hookenv.
File "/var/lib/
raise to_exc
NotImplementedError
Key part:
OSError: [Errno 7] Argument list too long: 'leader-set'
This occurred due to this code:
hookenv.
pki_
hookenv.
i.e. with each new certificate, pki_cache[] gets bigger, and thus the CLI leader-set command gets bigger than the CLI command line can handle (e.g. Argument list too long).
Suggested solution:
have a key for each unit with PKI_CACHE_KEY as a prefix, and mangle the unit_name so that it is an acceptable key.
Changed in vault-charm: | |
status: | New → Triaged |
importance: | Undecided → High |
See: https:/ /review. opendev. org/q/topic: bug%252F1970888
Affects master, 1.7, 1.6 (which hasn't yet merged at the time of submitting this report).
Will do reverts and then the functionality will need to be reverted.