[Bug 1818680] Re: booting should succeed even if vault is unavailable

[Corey Bryant]

This bug was fixed in the package vaultlocker - 1.0.4-0ubuntu0.19.04.1~ubuntu18.04.1~cloud0
---------------

 vaultlocker (1.0.4-0ubuntu0.19.04.1~ubuntu18.04.1~cloud0) xenial-queens; urgency=medium
 .
   * New upstream release for the Ubuntu Cloud Archive.
 .
 vaultlocker (1.0.4-0ubuntu0.19.04.1~ubuntu18.04.1) bionic-backports; urgency=medium
 .
   * No-change backport to bionic
 .
 vaultlocker (1.0.4-0ubuntu0.19.04.1) disco; urgency=medium
 .
   * New upstream point release including fix for an issue when
     vaultlocker blocks boot if interfaces are in a down or no-carrier
     state (LP: #1838607):
     - d/p/*: Drop, all included in new point release.
 .
 vaultlocker (1.0.3-0ubuntu2) disco; urgency=medium
 .
   * d/p/unblock-network.online.target.patch: Cherry pick fix to ensure
     that vaultlocker-decrypt@ systemd units don't block the network-online
     target which blocks server boot in the event that the Vault deployment
     being used is not accessible (LP: #1818680).
 .
 vaultlocker (1.0.3-0ubuntu1) cosmic; urgency=medium
 .
   * Initial release.


** Changed in: cloud-archive/queens
       Status: Fix Committed => Fix Released

-- 
You received this bug notification because you are a member of Ubuntu
OpenStack, which is subscribed to Ubuntu Cloud Archive.
https://bugs.launchpad.net/bugs/1818680

Title:
  booting should succeed even if vault is unavailable

Status in Bionic Backports:
  Fix Released
Status in OpenStack ceph-osd charm:
  Invalid
Status in Ubuntu Cloud Archive:
  Invalid
Status in Ubuntu Cloud Archive queens series:
  Fix Released
Status in vaultlocker:
  Fix Released
Status in vaultlocker package in Ubuntu:
  Fix Released
Status in vaultlocker source package in Cosmic:
  Fix Released
Status in vaultlocker source package in Disco:
  Fix Released

Bug description:
  [Impact]
  decrypt of vaultlocker encrypted block devices blocks the network-online.target; this means that if vault is hosted on the same hardware which is using vaultlocker for encryption at rest, the server will fail to boot fully in the event that all servers are rebooted at the same time.

  [Test Case]
  Deploy ceph+vaultlocker+vault
  Power cycle all servers
  Servers never get to multiuser.target as vaultlocker-decrypt services block network-online.target so LXD containers never get started.

  [Regression Potential]
  The proposed fix drops the Before=network-online.target stanza from the vaultlocker-decrypt systemd unit so minimal impact.

  [Original bug report]
  If ceph is using vault secrets to encrypt its volumes and vault is not available, booting is not possible without manual intervention, as the ceph-volume and vaultlocker-decrypt services will hang forever.
  In case of a full cloud outage, bootstrapping the mysql and vault nodes will require quite a bit of manual intervention, as all required nodes will have to be booted in single user mode to bypass the volume decryption services.

  Decryption of the ceph volumes should instead timeout, and allow the
  rest of the machine to complete the boot sequence.

To manage notifications about this bug go to:
https://bugs.launchpad.net/bionic-backports/+bug/1818680/+subscriptions