Matias V's questions

I've installed Rudder-server on a debian buster container, the software works fine : every services rudder-* have active status without error and I can access the web interface. The debug rudder script show no error. The problem is my Rudder-server never receive pending Nodes request. I've installed Rudder-agent on a different container, the service works fine but every time I try to update this agent I have the folowing messages :

root@test-pour-rudder:~# rudder agent info
Hostname: test-pour-rudder.domain.lan
UUID: 2faXXXXXXXXXXXXXXXXXXXXXXXX
Key hash:
Certificate creation: May 19 12:51:30 2021 GMT
Certificate expiration: May 17 12:51:30 2031 GMT
Certificate fingerprint: XX:XX:XX:XX:XX:XX:XX:XX
Policy server: 192.168.0.35
Roles: rudder-agent
Run interval: 5 min
Agent is enabled
Agent is not forced in audit mode
Policy updated: Not yet updated
Inventory sent: Not yet sent
Version: Rudder agent 6.2.7-debian10
root@test-pour-rudder:~# rudder agent update
   error: There is no readable input file at '/var/rudder/cfengine-community/inputs/failsafe.cf'. (stat: No such file or directory)
   error: Error reading CFEngine policy. Exiting...

error: Rudder agent policies could not be updated.

Also, the rudder-agent of the rudder-server works fine, I receive its report and it is visible in the "Nodes" Section. There isn't firewall rules on this server, every port is open.

I did a lot of research for this error and it seems to appear when your agent is not yet accepted by the rudder-server, which is normal. But absolutely no server appears in my "pending node" page in the web interface, I can't accept any Nodes. Also, the following folders are empty :

/var/rudder/inventories/failed/
/var/rudder/inventories/incoming/
/var/rudder/inventories/debug/

which confirm the fact that the rudder-server doesn't receive any information from other rudder-agent.

My configuration :

• Debian 10 Proxmox Server 6.3-3
• 192.168.0.35 : Rudder-Server-root in a container : Debian 10, priviledge container and nesting option enable
• 192.168.2.88 : Rudder-agent in another container : Debian 10, priviledge container

The allowed subnets in rudder web interface (general configuration) :

• 192.168.0.42/23
• 192.168.2.0/24
• 192.168.1.0/24
• 192.168.0.0/24

I've already tried to change the subnet or ip adress of the instance with rudder-agent, still not working.

Also, this proxmox server is a test server we often use at work, there is several containers on it for other purpose and they work fine.

Any idea to what could cause this problem ? Or do you know other tests I could do to find the problem ?

I'm trying to use rudder-server on a Debian buster at work, the webapp works fine but one of the rudder services does'nt work and I can't receive reports from other nodes :

● rudder-relayd.service - Rudder Relay Daemon
   Loaded: loaded (/usr/lib/systemd/system/rudder-relayd.service; enabled; vendor preset: enabled)
   Active: failed (Result: exit-code) since Wed 2021-05-19 09:21:32 CEST; 1min 28s ago
  Process: 32493 ExecStart=/opt/rudder/bin/rudder-relayd (code=exited, status=226/NAMESPACE)
 Main PID: 32493 (code=exited, status=226/NAMESPACE)

May 19 09:21:32 rudder-v3 systemd[1]: Started Rudder Relay Daemon.
May 19 09:21:32 rudder-v3 systemd[32493]: rudder-relayd.service: Failed to set up mount namespacing: Permission denied
May 19 09:21:32 rudder-v3 systemd[32493]: rudder-relayd.service: Failed at step NAMESPACE spawning /opt/rudder/bin/rudder-relayd: Permission denied
May 19 09:21:32 rudder-v3 systemd[1]: rudder-relayd.service: Main process exited, code=exited, status=226/NAMESPACE
May 19 09:21:32 rudder-v3 systemd[1]: rudder-relayd.service: Failed with result 'exit-code'.

My Debian buster is a container (Not Unpriviledged Container) on a Proxmox Server, everything is up to date and I've changed the service's configuration without success :

# vi /usr/lib/systemd/system/rudder-relayd.service
[Unit]
Description=Rudder Relay Daemon
After=network-online.target

[Service]
PrivateTmp=false
NoNewPrivileges=yes
PrivateDevices=false
ProtectControlGroups=false
ProtectKernelModules=false
ProtectSystem=false
ReadWritePaths=/var/rudder/reports /var/rudder/inventories /var/rudder/shared-files /var/rudder/cfengine-community/state
ExecStart=/opt/rudder/bin/rudder-relayd
ExecReload=/opt/rudder/bin/rudder relay reload
# Do not restart on known errors, which won't get fixed by themselves
RestartPreventExitStatus=2 3
User=rudder-relayd
Group=rudder

[Install]
RequiredBy=rudder-server.service
WantedBy=multi-user.target

When I execute "/opt/rudder/bin/rudder-relayd" I do not have any errors :

 INFO relayd: Starting rudder-relayd 6.2.7
 INFO relayd: Read configuration from "/opt/rudder/etc/relayd/"
 INFO relayd::data::node: Parsing nodes list from "/var/rudder/lib/relay/nodeslist.json"
 INFO relayd::api: Starting API on 127.0.0.1:3030
 INFO relayd::input::watch: Starting file watcher on "/var/rudder/reports/incoming"
 INFO relayd: Skipping inventory as it is disabled
 INFO relayd: Server started

And the directory's rights are :

# ls -al /opt/rudder/bin/
[..]
-rwxr-xr-x  1 root root 8429816 Nov 22  2017 rudder-relayd
[..]

All of the other rudder services work fine and I can even access the rudder interface with my admin account. I've been able to accept pending nodes but it seems that if rudder-relayd service is off, I can't receive the compliance reports and this message appears :

Error occured when contacting internal remote-run API to apply classes on Node 'root': (HTTP code 503)

Brief summary of my tests :

• Change rudder-relayd.service configuration with only the lines "PrivateTmp=false\NoNewPrivileges=yes" added ;
• Not changing the service file configuration directly but override it with systemctl edit rudder-relayd.service
• After every changes of this file I reload the daemon with "systemctl daemon-reload";
• Install Rudder on another container with same options (still the same error), install rudder on a unprivileged container (this error stops but other appears and I don't want this to be the solution);

Thank you