Azure / Azure/iotedge

In offline environments, when restarting after a power outage, containers with “dead” status are not recreated again.

Open
#7,406 12 comments 1 reaction 1 assignee Claimed by @gauravIoTEdge View on GitHub
Dominant language
C#
Stars
1.5k
Forks
473
Avg merge
2d 17h
Merged PRs (30d)
7

Description

## Expected Behavior

After a restart of the server (this one without internet connectivity), the edgeAgent (via aziot-edged) should destroy the modules with “dead” status and create it from scratch based on the docker image.

## Current Behavior

After a restart of the server (this one without internet connectivity), the edgeAgent (via aziot-edged) destroys the modules with “dead” status but does not create them from scratch based on the docker image.

## Steps to Reproduce

_On a properly deployed device with iotedge and no internet connection._

1. Bring a container or several containers to the dead status
1. Reboot the device.

## Context (Environment)

* No internet connectivity (offline).
* Containers in “dead” status (after a power outage).

### Output of `iotedge check`

Click here

```
Configuration checks (aziot-identity-service)
---------------------------------------------
√ keyd configuration is well-formed - OK
√ certd configuration is well-formed - OK
√ tpmd configuration is well-formed - OK
√ identityd configuration is well-formed - OK
√ daemon configurations up-to-date with config.toml - OK
√ identityd config toml file specifies a valid hostname - OK
× aziot-identity-service package is up-to-date - Error
could not query https://aka.ms/azure-iotedge-latest-versions for latest available version
caused by: could not query https://aka.ms/azure-iotedge-latest-versions for latest available version
caused by: error trying to connect: unsuccessful tunnel (HTTP/1.1 403 For)
caused by: unsuccessful tunnel (HTTP/1.1 403 For)
‼ host time is close to reference time - Warning
Could not query NTP server
caused by: Could not query NTP server
caused by: could not receive NTP server response: Resource temporarily unavailable (os error 11)
caused by: Resource temporarily unavailable (os error 11)
√ production readiness: identity certificates expiry - OK
√ preloaded certificates are valid - OK
√ keyd is running - OK
√ certd is running - OK
√ identityd is running - OK
√ read all preloaded certificates from the Certificates Service - OK
√ read all preloaded key pairs from the Keys Service - OK
√ check all EST server URLs utilize HTTPS - OK
√ ensure all preloaded certificates match preloaded private keys with the same ID - OK

Connectivity checks (aziot-identity-service)
--------------------------------------------
× host can connect to and perform TLS handshake with iothub AMQP port - Error
Failed to do TLS Handshake, Connection Attempt Timed out in 70 Seconds
caused by: Failed to do TLS Handshake, Connection Attempt Timed out in 70 Seconds
caused by: deadline has elapsed
× host can connect to and perform TLS handshake with iothub HTTPS / WebSockets port - Error
Could not connect to ... : could not complete TLS handshake
caused by: Could not connect to ... : could not complete TLS handshake
caused by: unsuccessful tunnel (HTTP/1.1 403 For)
× host can connect to and perform TLS handshake with iothub MQTT port - Error
Failed to do TLS Handshake, Connection Attempt Timed out in 70 Seconds
caused by: Failed to do TLS Handshake, Connection Attempt Timed out in 70 Seconds
caused by: deadline has elapsed
× host can connect to and perform TLS handshake with DPS endpoint - Error
Could not connect to global.azure-devices-provisioning.net : could not complete TLS handshake
caused by: Could not connect to global.azure-devices-provisioning.net : could not complete TLS handshake
caused by: unsuccessful tunnel (HTTP/1.1 403 For)

Configuration checks
--------------------
√ aziot-edged configuration is well-formed - OK
√ configuration up-to-date with config.toml - OK
√ container engine is installed and functional - OK
√ configuration has correct URIs for daemon mgmt endpoint - OK
× aziot-edge package is up-to-date - Error
Error while fetching latest versions of edge components: could not send HTTP request
caused by: Error while fetching latest versions of edge components: could not send HTTP request
caused by: error trying to connect: unsuccessful tunnel (HTTP/1.1 403 For)
caused by: unsuccessful tunnel (HTTP/1.1 403 For)
√ container time is close to host time - OK
√ DNS server - OK
√ production readiness: logs policy - OK
√ production readiness: Edge Agent's storage directory is persisted on the host filesystem - OK
√ production readiness: Edge Hub's storage directory is persisted on the host filesystem - OK
× Agent image is valid and can be pulled from upstream - Error
Failed to get edge Agent image
caused by: Failed to get edge Agent image
caused by: docker returned exit status: 1, stderr = Error response from daemon: Get "https://xxx/v2/": net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers)
‼ proxy settings are consistent in aziot-edged, aziot-identityd, moby daemon and config.toml - Warning
The proxy setting for IoT Edge Agent "http://x.x.x.x:3128", IoT Edge Daemon "http://127.0.0.1:3128", IoT Identity Daemon "http://127.0.0.1:3128", and Moby "http://127.0.0.1:3128" may need to be identical.
caused by: The proxy setting for IoT Edge Agent "http://x.x.x.x:3128", IoT Edge Daemon "http://127.0.0.1:3128", IoT Identity Daemon "http://127.0.0.1:3128", and Moby "http://127.0.0.1:3128" may need to be identical.

Connectivity checks
-------------------
× container on the default network can connect to upstream AMQP port - Error
Container on the default network could not connect to ...:5671
caused by: Container on the default network could not connect to ...:5671
caused by: docker returned exit status: 1, stderr = One or more errors occurred. (Operation timed out)
× container on the default network can connect to upstream HTTPS / WebSockets port - Error
Container on the default network could not connect to ...:443
caused by: Container on the default network could not connect to ...:443
caused by: docker returned exit status: 1, stderr = One or more errors occurred. (The proxy tunnel request to proxy 'http://x.x.x.x:3128/' failed with status code '403'.")
× container on the default network can connect to upstream MQTT port - Error
Container on the default network could not connect to ...:8883
caused by: Container on the default network could not connect to ...:8883
caused by: docker returned exit status: 1, stderr = One or more errors occurred. (Operation timed out)
× container on the IoT Edge module network can connect to upstream AMQP port - Error
Container on the azure-iot-edge network could not connect to ...:5671
caused by: Container on the azure-iot-edge network could not connect to ...:5671
caused by: docker returned exit status: 1, stderr = One or more errors occurred. (Operation timed out)
× container on the IoT Edge module network can connect to upstream HTTPS / WebSockets port - Error
Container on the azure-iot-edge network could not connect to ...:443
caused by: Container on the azure-iot-edge network could not connect to ...:443
caused by: docker returned exit status: 1, stderr = One or more errors occurred. (The proxy tunnel request to proxy 'http://x.x.x.x:3128/' failed with status code '503'.")
× container on the IoT Edge module network can connect to upstream MQTT port - Error
Container on the azure-iot-edge network could not connect to ...:8883
caused by: Container on the azure-iot-edge network could not connect to ...:8883
caused by: docker returned exit status: 1, stderr = One or more errors occurred. (Operation timed out)
24 check(s) succeeded.
2 check(s) raised warnings.
13 check(s) raised errors.
```

### Device Information
* Host OS: Ubuntu 22.04
* Architecture: amd64
* Container OS: Linux (Alpine & Debian)

### Runtime Versions
* aziot-edged: 1.5.13
* Edge Agent: 1.4.43
* Edge Hub: 1.4.43
* Docker/Moby: 27.0.3-1, build 7d4bcd863a4c863e650eed02a550dfeb98560b83

## Logs

Important, in these logs, the module called **moduleZ** is the one that has a **“dead” status**.

Note that in the aziot-edged logs at 19:15:58 it appears as edgeAgent requests to delete **moduleZ**.

```
2024-12-11T19:15:58Z [INFO] - <-- DELETE /modules/moduleZ?api-version=2022-08-03 {"host": "mgmt.sock:80", "connection": "close"}
2024-12-11T19:15:58Z [INFO] - Removing module moduleZ...
2024-12-11T19:15:58Z [INFO] - --> 204 {}
2024-12-11T19:15:58Z [INFO] - Removing listener for module moduleZ
2024-12-11T19:15:58Z [INFO] - Stopping listener for module moduleZ
```

After aziot-edged destroys the container, the moduleZ is not recreated (its docker image still exists).

We note that it appears continuously in the logs:

```
2024-12-11T19:16:08Z [INFO] - <-- PUT /identities/moduleZ?api-version=2022-08-03 {"accept": "application/json", "host": "mgmt.sock:80", "connection": "close", "content-type": "application/json", "content-length": "59"}
2024-12-11T19:18:11Z [INFO] - --> 500 {"content-type": "application/json"}
```

And in the edgeAgent logs it appears:

```
19:24:36.060 +00:00 [INF] - Unable to process module moduleZ add or update as the module identity could not be obtained
```

aziot-edged logs

[aziot-edged.txt](https://github.com/user-attachments/files/18102908/aziot-edged.txt)

aziot-identityd logs

[aziot-identityd.txt](https://github.com/user-attachments/files/18102910/aziot-identityd.txt)

edge-agent logs

[edgeAgent_log.txt](https://github.com/user-attachments/files/18102909/edgeAgent_log.txt)

edge-hub logs

[edgeHub_log.txt](https://github.com/user-attachments/files/18102911/edgeHub_log.txt)

## Additional Information

It is important to us that you work in a non-internet environment, even if these devices are connected once a year.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.