Newer versions of Linux open-iSCSI initiator for environments like OpenShift might not work
Applies to
- Supported versions of Linux open-iSCSI initiator
- Element software
- RedHat OpenShift
Issue
Newer versions of Linux open-iSCSI initiator versions 2.1.1 or higher might not establish iSCSI sessions with Element software without applying a workaround.
RedHat OpenShift particular issue:
After upgrading OpenShift from version 4.4.12 to 4.4.13 and then to 4.5, pods are not able to be provisioned utilizing the NetApp Trident PVC. The pods get stuck in the 'containerCreating' state due to the k8s/OpenShift worker nodes being unable to establish an iSCSI session with Element.
Problems with iSCSI session logins are observed after upgrading the open-iSCSI initiator to version 2.1.1 or higher, or upgrading OpenShift to version 4.4.13 or higher. Linux hosts and OpenShift worker nodes are unable to establish an iSCSI session.
iSCSI session issues are observed with the following signature:
In sf-slice.info of the node owning the slice:
slice123[13361]: [ISCSI] 27742 TSSocket-122 iscsitarget/ISCSISession.cpp:
391:~ISCSISession|srcid=1355 reqid=0 LOGIN Failed: Unexpected CHAP_A Type, Expect 5 Got 8,7,6,5 { sessionID=123abc cid=0 sessionMSec=4500 loginMSec=0 initiatorName=iqn.1994-05.com.redhat:abcdef12345 initiatorPortal=1.2.3.4:44376 isid=0123456789 sessionType=Normal targetName=iqn.2010-01.com.solidfire:xxxx.uuid-xxxxxxxxx-xxxx-xx targetPortal=4.3.2.1:3260 initiatorAccess=NotAllowed receivedCommands=0 shutdownReason=IscsiLoginFailed shutdownInfo=LOGIN Failed: Unexpected CHAP_A Type, Expect 5 Got 8,7,6,5 isShutdown=true redirect=false virtualNetworkID=0 loginStage=0 volumeID=133 socketError=xSocketClosed }
In the client that's trying to initiate the connection:
[root@node-1 ~]# iscsiadm -m session
iscsiadm: No active sessions.
In /var/log/messages on the worker node:
Jul 30 04:12:36 node-1 iscsid[1372]: iscsid: Login authentication failed with target iqn.2010-01.com.solidfire:3x71.pvc-7489898e-087b-4db0-b211-e5b254074d56.1
Jul 30 04:12:36 node-1 iscsid[1372]: iscsid: Kernel reported iSCSI connection 207:0 error (1020 - ISCSI_ERR_TCP_CONN_CLOSE: TCP connection closed) state (1)
Jul 30 04:12:41 node-1 iscsid[1372]: iscsid: Login failed to authenticate with target iqn.2010-01.com.solidfire:3x71.pvc-7489898e-087b-4db0-b211-e5b254074d56.1
Jul 30 04:12:41 node-1 iscsid[1372]: iscsid: session 207 login rejected: Initiator failed authentication with target
Jul 30 04:12:41 node-1 iscsid[1372]: iscsid: Connection207:0 to [target: iqn.2010-01.com.solidfire:3x71.pvc-7489898e-087b-4db0-b211-e5b254074d56.1, portal: 192.168.1.50,3260] through [iface: default] is shutdown.
During investigation, in the /etc/iscsi/iscsid.conf file in the worker nodes, the following line was observed:
node.session.auth.chap_algs = SHA3-256,SHA256,SHA1,MD5