Azure / Azure/aksArc

[BUG] Token Expiry during Upgrade-AksHci

Open
#169 0 comments 0 reactions 0 assignees View on GitHub
Bug known-issue
Dominant language
PowerShell
Stars
118
Forks
63
PR merge metrics
No merged PRs in 30d

Description

**Describe the bug**
Kvactl is a utility that interacts with the cluster to perfrm Day0 and Day2 operations. Kvactl token validity is 60 days and if the upgrade is not performed for 60 days kvactl token would have expired. Even if the kvactl token has expired the kvactl certificate may still be valid if kvactl related operations was performed during the 60 days as kvactl auto renews certificate as it nears expiry. If the certificate is valid, we may not hit this issue.

**To Reproduce**
Steps to reproduce the behavior:
1. Install AksHci and do not run commands involving kvactl for 60 days.
2. Perform any action involving Kvactl

**Expected behavior**
Running any operation involving Kvactl would return an invalid token error
`C:\Program Files\AksHci\kvactl.exe cluster get --clustername=*******************
--kubeconfig="C:\kubeconfig-mgmt"
System.Collections.Hashtable.generic_non_zero 1 [Error: failed to get new provider: failed to create azurestackhci
session: rpc error: code = Unauthenticated desc = Valid Token Required.]`

**Solution**
The kvactl token needs to be rotated before attempting to upgrade again. Execute the following command in Powershell to rotate tokens.
`Repair-AksHciCerts`

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.