Ziti-edge-tunnel 1.9.x against controller 1.6.9

1

Hi, should the ziti-edge-tunnel 1.9.x to be compatible with controller version 1.6.9?

I have experienced problems with ziti-edge-tunnel 1.9.x version, 1.7.12 works.
When I upgrade ziti-edge-tunnel to 1.9.x version on “source” side of tunnel, its works some times like 12-13hours (I don’t have exact time) and after it doesn’t pass traffic anymore and on log it repeat following. This happened on both 1.9.3 and 1.9.5 version on couple of servers. When I downgraded back to 1.7.12 then no problems. Also 1.9.x version works on “receiver” side.

I have only 1 controller and 4 routers, all on version 1.6.9.

Nov 23 07:33:16 rproxy ziti-edge-tunnel[792]: (792)[    81104.949]   ERROR ziti-sdk:ziti.c:1568 update_identity_data() ztx[1] failed to get identity_data: no api session token set for ziti_controller[UNAUTHORIZED]
Nov 23 07:33:16 rproxy ziti-edge-tunnel[792]: (792)[    81104.949]    WARN ziti-sdk:ziti.c:1570 update_identity_data() ztx[1] api session is no longer valid. Trying to re-auth
Nov 23 07:33:16 rproxy ziti-edge-tunnel[792]: (792)[    81104.949]    WARN ziti-sdk:ziti.c:224 ziti_set_unauthenticated() ztx[1] auth error: no api session token set for ziti_controller
Nov 23 07:33:16 rproxy ziti-edge-tunnel[792]: (792)[    81104.949]    WARN tunnel-cbs:ziti_tunnel_ctrl.c:1018 on_ziti_event() ziti_ctx controller connections failed: failed to authenticate
Nov 23 07:33:16 rproxy ziti-edge-tunnel[792]: (792)[    81104.949]    INFO ziti-edge-tunnel:ziti-edge-tunnel.c:460 on_event() ztx[/opt/openziti/etc/identities/rproxy.json] context event : status is failed to authenticate
Nov 23 07:33:16 rproxy ziti-edge-tunnel[792]: (792)[    81104.949]   ERROR ziti-edge-tunnel:ziti-edge-tunnel.c:514 on_event() ztx[/opt/openziti/etc/identities/rproxy.json] failed to connect to controller due to failed to authenticate
Nov 23 07:33:16 rproxy ziti-edge-tunnel[792]: (792)[    81104.949]    WARN ziti-sdk:ziti_ctrl.c:817 verify_api_session() ctrl[https://ozc1.domain.com:443] no API session
Nov 23 07:33:16 rproxy ziti-edge-tunnel[792]: (792)[    81104.949]   ERROR ziti-sdk:ziti.c:1491 edge_routers_cb() ztx[1] failed to get current edge routers: code[0] UNAUTHORIZED/no api session token set for ziti_controller
Nov 23 07:33:16 rproxy ziti-edge-tunnel[792]: (792)[    81104.949]    WARN ziti-sdk:ziti_ctrl.c:817 verify_api_session() ctrl[https://ozc1.domain.com:443] no API session
Nov 23 07:33:16 rproxy ziti-edge-tunnel[792]: (792)[    81104.949]    WARN ziti-sdk:ziti.c:1439 check_service_update() ztx[1] failed to poll service updates: code[0] err[-14/no api session token set for ziti_controller]
Nov 23 07:33:16 rproxy ziti-edge-tunnel[792]: (792)[    81104.949]   ERROR tlsuv:http.c:354 http[ozc1.domain.com:443/edge/client/v1]: connection failed: unknown node or service
Nov 23 07:33:16 rproxy ziti-edge-tunnel[792]: (792)[    81104.949]    WARN ziti-sdk:ziti_ctrl.c:177 ctrl_resp_cb() ctrl[https://ozc1.domain.com:443] request[/authenticate?method=cert] failed: -3008(unknown node or service)
Nov 23 07:33:16 rproxy ziti-edge-tunnel[792]: (792)[    81104.949]    INFO ziti-sdk:ziti_ctrl.c:180 ctrl_resp_cb() ctrl[https://ozc1.domain.com:443] attempting to switch endpoint
Nov 23 07:33:16 rproxy ziti-edge-tunnel[792]: (792)[    81104.949]    WARN ziti-sdk:ziti_ctrl.c:604 ctrl_next_ep() ctrl[https://ozc1.domain.com:443] no controllers are online
Nov 23 07:33:16 rproxy ziti-edge-tunnel[792]: (792)[    81104.949]   ERROR ziti-sdk:ziti_ctrl.c:389 ctrl_login_cb() ctrl[https://ozc1.domain.com:443] CONTROLLER_UNAVAILABLE(unknown node or service)
Nov 23 07:33:16 rproxy ziti-edge-tunnel[792]: (792)[    81104.949]    WARN ziti-sdk:legacy_auth.c:183 login_cb() failed to login to ctrl[https://ozc1.domain.com:443] CONTROLLER_UNAVAILABLE[-16] unknown node or service
2

Bonjour comment allez-vous ?? J'ai besoin d'aide pour sécuriser trois sites web hébergé sur nginx avec openziti ( déploiement Quickstart tout en un avec docker_compose) dans le cadre de mon mémoire de fin de cycle

3

Bonjour @guenne, did you intend to reply on this post? If you would like help from the community, you probably should make your own, separate post

4

I would expect it to be, yes. It sounds like something is happening that shouldn't be. There have been a few issues around oidc lately, I don't konw exact what but it might be worthwhile to try the latest controller if you can. I'll mention this to other colleagues to see if there's anthing obvious in that log snippet.

5

Thanks @TheLumberjack. This is production, so I think I wait new release :smiley:
I have test environment also but haven’t noticed this problem there.