HSM problems and IoT Hub connectivity test problems #5893
Assignees
Labels
Comments
|
Hi, I don't have a CentOs Stream 8, but does it have a TPM resource manager? One possibility is an out of date fw: Azure/azure-utpm-c#9... but let us know if this version of centos has a kernel manager for TPM. I will try to get an image and use a local machine (Azure doesn't seem to have a VM image I can use) and repro. Will update here as I make progress. |
|
Could you from HOST OS of Centos, run this: |
|
@nyanzebra thank you When I list all tpm* devices I get following result: JFI, my kernel release and version is: After a restart of the runtime everything was working fine again. Saw this errors the first time after updating to version |
|
@Suizi11 I take it everything is working correctly then for you? Does this issue need to remain open? |
|
@nyanzebra of course this issue has to remain open, because it must be solved ... or what is the solution of MS if this issue happens on 1000 devices? However, issue occurs again now. Restarted on 03-12 and saw it in the logs on 07-12 again (oldest available log, probably problem happened already before). I'll check it daily when it happens again and come back here as soon it happens again. Nevertheless, the problem is not a big deal at one device, but not acceptable on 1000 devices. |
|
@nyanzebra as posted above, a restart seems to solve the issue, however, the restart now seems to work, after 4-5 minutes following errors occured (no sensitive data because it's a staging device): The error block (a few times Plain text is not trustworthy.) occurred 3 times in total, then everything is working again, for now (waiting for original problem). |
|
@Suizi11 so to clear, the issue regarding TPM still occurs? Just happens after a while post-restart? |
|
@Suizi11 from speaking with my team the HSM failures should be benign as this could be caused by a redeploy making the module enc key different. But this can be safely ignored. |
|
@nyanzebra yes there's still an error - just happening after a while after restarting iotedged I've updated now to iotedged 1.1.8, and also edgeAgent and edgeHub have latest tag 1.1. Only edgeAgent and edgeHub modules are running but not connected to the cloud, all custom modules cannot connect anymore to the edgeHub. I've about 8 devices where this happens (= every gateway where I've updated to 1.1.8). Logs of iotedged: Logs of edgeAgent: |
|
@nyanzebra if I log |
|
Just to convey here what is being conveyed in a separate channel:
|
|
It' happens with every version of iotedged. I've found a workaround for the problem. In the documentation it's mentioned that also iotedge user must be owner of the /dev/tpmrm0 device. If I skip this, everything works as expected. I don't know why the iotede user even needs access to the resource manager of the TPM module. Maybe the documentation is wrong with regards to CentOS. |
|
@Suizi11 We are working on an update to documentation for getting iotedge working alongside TPM, will post that updated docs here as soon as they are available :) |
|
This issue is being marked as stale because it has been open for 30 days with no activity. |
|
Hi, has there been any update on this? EDIT: I tried Suizi11's workaround and the runtime is working as expected. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Expected Behavior
No error logs in the security daemon and successful connection check in the edgeAgent module.
Current Behavior
Error log in the security daemon and problem during connection check in the edgeAgent module.
Steps to Reproduce
Provide a detailed set of steps to reproduce the bug.
Context (Environment)
Output of
iotedge checkClick here
Device Information
Runtime Versions
iotedge version]: iotedge 1.1.8docker version]:Note: when using Windows containers on Windows, run
docker -H npipe:////./pipe/iotedge_moby_engine versioninsteadLogs
aziot-edged logs
edge-agent logs
edge-hub logs
Additional Information
Please provide any additional information that may be helpful in understanding the issue.
The text was updated successfully, but these errors were encountered: