Hi all. I finally had the time and decided to start updating my Ziti stack. I started with the controller, under the assumption that the controller would maintain compatibility to outdated ziti routers while ziti routers can hit a state where they're newer than what's supported by the ziti controller.
Anyway, the update ran and I am now on 2+. But, after the update, the ziti controller service fails to start with a 217/User exit code. I wasn't aware that the ziti controller service was running in any specific user context by default. Has anyone else run into this or an easy fix? (This was a non-docker install.)
Here's the output. I haven't gotten a chance to dig back into any of my notes from the installation, but I don't remember setting a user context on original install for the service.
The systemd services run now in a specific user. Unfortunately (at least) the packaged "rpm" does not create the required users when updating the packages.
But on RHEL-based distros you can "dnf reinstall" the packages and the groups will be created.
The package touches only files that are part of the package installation.
The configuraiton was built by the admin and not from the package (either from hand or via provided script). So the config files and database remain the same.
Checking in on this thread and noticed this comment. I do believe this will be fixed with the 2.0 release. I installed a RHEL 9 instance then installed the 1.6 controller, upgraded and during the upgrade 2.0 created the user:
@TheLumberjack I only use the "stable" channel of the RPM repos (Oracle Linux 9):
[root@zt001 ~]# LANG=C dnf history list openziti-controller
ID | Command line | Date and time | Action(s) | Altered
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
44 | reinstall openziti-controller | 2026-05-29 07:29 | R | 2 EE
43 | upgrade | 2026-05-29 07:13 | C, E, I, U | 12 E<
39 | upgrade | 2026-05-05 07:27 | C, E, I, U | 43 ><
37 | upgrade | 2026-04-02 07:25 | C, E, I, U | 63 ><
35 | upgrade | 2026-03-10 08:58 | C, E, I, U | 69 ><
29 | upgrade | 2025-12-22 11:48 | C, E, I, U | 214 ><
24 | upgrade | 2025-10-23 11:40 | C, E, I, U | 39 ><
21 | upgrade | 2025-09-26 11:19 | C, E, I, U | 27 ><
18 | upgrade | 2025-08-22 08:17 | C, E, I, U | 54 ><
16 | upgrade | 2025-06-23 15:21 | C, E, I, U | 38 ><
4 | install openziti-controller | 2025-04-22 14:19 | Install | 2 >E
[root@zt001 ~]# LANG=C dnf history info 43
Transaction ID : 43
Begin time : Fri May 29 07:13:12 2026
Begin rpmdb : f391f4d6f99e396000a3e08737c2002753abb0d206686f4896e42520c983f13b
End time : Fri May 29 07:14:20 2026 (68 seconds)
End rpmdb : 936962ac0eb65e35ef398df72764ffd9bf921557027601f7bb179af11407b4de
User : <frm>
Return-Code : Success
Releasever : 9
Command Line : upgrade
Persistence : Persist
Comment :
Packages Altered:
Install kernel-uek-5.15.0-320.202.8.5.el9uek.x86_64 @ol9_UEKR7
Install kernel-uek-core-5.15.0-320.202.8.5.el9uek.x86_64 @ol9_UEKR7
Install kernel-uek-modules-5.15.0-320.202.8.5.el9uek.x86_64 @ol9_UEKR7
Upgrade openziti-router-2.0.0-1.noarch @OpenZitiRelease
Upgraded openziti-router-1.6.15-1.x86_64 @@System
Upgrade openziti-controller-2.0.0-1.noarch @OpenZitiRelease
Upgraded openziti-controller-1.6.15-1.x86_64 @@System
Upgrade openziti-2.0.0-1.x86_64 @OpenZitiRelease
Upgraded openziti-1.6.15-1.x86_64 @@System
Reason Change kernel-uek-5.15.0-320.202.8.3.el9uek.x86_64 @ol9_UEKR7
Removed kernel-uek-5.15.0-319.201.4.4.el9uek.x86_64 @@System
Reason Change kernel-uek-core-5.15.0-320.202.8.3.el9uek.x86_64 @ol9_UEKR7
Removed kernel-uek-core-5.15.0-319.201.4.4.el9uek.x86_64 @@System
Reason Change kernel-uek-modules-5.15.0-320.202.8.3.el9uek.x86_64 @ol9_UEKR7
Removed kernel-uek-modules-5.15.0-319.201.4.4.el9uek.x86_64 @@System
Scriptlet output:
1 Warnung: /opt/openziti/etc/router/bootstrap.env created as /opt/openziti/etc/router/bootstrap.env.rpmnew
2 Warnung: /opt/openziti/etc/router/service.env created as /opt/openziti/etc/router/service.env.rpmnew
3 INFO: detected DynamicUser state layout for ziti-router; migrating...
4 chown: ungültiger Benutzer: „ziti-router:ziti-router“
5 WARN: failed to chown /var/lib/ziti-router to ziti-router:ziti-router
6 INFO: updated /var/lib/ziti-router/config.yml paths from /var/lib/private/ziti-router to /var/lib/ziti-router
7 INFO: DynamicUser migration complete for ziti-router
8 chown: ungültiger Benutzer: „ziti-router:ziti-router“
9 Warnung: %post(openziti-router-2.0.0-1.noarch) Scriptlet fehlgeschlagen, Beenden-Status 1
10 Warnung: /opt/openziti/etc/controller/service.env created as /opt/openziti/etc/controller/service.env.rpmnew
11 INFO: detected DynamicUser state layout for ziti-controller; migrating...
12 chown: ungültiger Benutzer: „ziti-controller:ziti-controller“
13 WARN: failed to chown /var/lib/ziti-controller to ziti-controller:ziti-controller
14 INFO: updated /var/lib/ziti-controller/config.yml paths from /var/lib/private/ziti-controller to /var/lib/ziti-controller
15 INFO: DynamicUser migration complete for ziti-controller
16 chown: ungültiger Benutzer: „ziti-controller:ziti-controller“
17 Warnung: %post(openziti-controller-2.0.0-1.noarch) Scriptlet fehlgeschlagen, Beenden-Status 1
18 /usr/lib/tmpfiles.d/openziti-controller.conf:4: Failed to resolve user 'ziti-controller': No such process
19 /usr/lib/tmpfiles.d/openziti-router.conf:4: Failed to resolve user 'ziti-router': No such process
Some parts of the output are still in german. The term "ungültiger Benutzer" means "invalid user".
And the "reinstall":
[root@zt001 ~]# LANG=C dnf history info 44
Transaction ID : 44
Begin time : Fri May 29 07:29:31 2026
Begin rpmdb : 936962ac0eb65e35ef398df72764ffd9bf921557027601f7bb179af11407b4de
End time : Fri May 29 07:29:33 2026 (2 seconds)
End rpmdb : 653f9c7244885380a77aa8a53271269abc99f337f4a8d5365f46363e40ab19d4
User : <frm>
Return-Code : Success
Releasever : 9
Command Line : reinstall openziti-controller
Persistence : Persist
Comment :
Packages Altered:
Reinstall openziti-controller-2.0.0-1.noarch @OpenZitiRelease
Reinstalled openziti-controller-2.0.0-1.noarch @@System
Scriptlet output:
1 Creating group 'ziti-controller' with GID 990.
2 Creating user 'ziti-controller' (OpenZiti Controller) with UID 990 and GID 990.
3 completed upgrade of openziti-controller
4 /usr/lib/tmpfiles.d/openziti-router.conf:4: Failed to resolve user 'ziti-router': No such process
Hi @frm, I think I might see the difference between how you upgraded and how I upgraded and I see why you eneded up with that error. in 1.x the services run as a systemd DynamicUser, so while a service is up systemd exposes a temporary ziti-controller/ziti-router user. If you upgrade to 2.0 with the old service still running and the postinstall sees that temporary user, assumes the account already exists, and skips creating the real one. If you stop the service first and then upgrade, the temporary user goes away and thus the postinstall will make the real user.
Do you know if you had stopped the service first and still had this problem? I was able to reproduce these when the services were running, but not when I'd stopped them first...
Yes, the services were running. I am just executing dnf upgrade. I was not aware that the "recommended approach" is to stop services manually and start them after the update manually again.
I wouldn't have thought that either, but it just was the way I had tested it. I would expect a regular package update to stop the service, do the update, then start the service back up for me. It just sounds like something we should fix, I just wanted to make sure that was how you were doing it. Thanks for confirming. I'll file a bug on the project and see if we can't get this sorted for those who come after. Thanks!
