-
Type:
Problem report
-
Resolution: Unresolved
-
Priority:
Major
-
Affects Version/s: 7.0.24rc1
-
Component/s: API (A)
-
Prev.Sprint, S26-W08/09, S26-W10/11
-
1
When attempting to use host.update for changing tls_psk attributes - either key or identity - for parent host and related hosts created from host prototypes under it (which share/inherit the TLS PSK configuration) an error is returned.
The host.massupdate method allows this, but is removed in the upcoming release, leaving a lack for the functionality above.
It should be also prohibited to include the discovered hosts with either method - the change should happen on the parent (containing the discovery) host only and be propagated to related discovered hosts by server.
Steps to reproduce, scenario 1
- Create a host with discovery of host prototypes.
- Execute discovery.
- Run host.massupdate on the parent host and related discovered hosts, changing TLS PSK details.
Result
Update succeeds.
Expected
Error telling it is prohibited to update read-only attribute for the discovered hosts.
Steps to reproduce, scenario 2
- Run host.update changing either the TLS key or identity on the parent host only.
Result:
Error "Invalid parameter "/1/tls_psk": another tls_psk value is already associated with given tls_psk_identity."
Expected
Success. Both parent host and related discovered hosts' TLS PSK details match after (re)discovery.
The error should be shown only if updating to a key+identity pair in use by another entity (host, proxy, ...).
- caused by
-
ZBX-24500 Zabbix agent PSK key change with minimal write privileges can bring down proxy connection
-
- Closed
-
- related to
-
ZBXNEXT-10387 Remove support of *.massupdate methods
-
- Doc. sign-off
-