-
Type:
Problem report
-
Resolution: Unresolved
-
Priority:
Major
-
Affects Version/s: 7.0.24rc1
-
Component/s: API (A)
-
Prev.Sprint, S26-W08/09
-
1
When attempting to use host.update for changing tls_psk attributes - either key or identity - for parent host and related hosts created from host prototypes under it (which share/inherit the TLS PSK configuration) an error is returned.
The host.massupdate method allows this, but is removed in the upcoming release, leaving a lack for the functionality above.
It should be also prohibited to include the discovered hosts with either method - the change should happen on the parent (containing the discovery) host and be propagated to related discovered hosts right away, without awaiting next discovery cycle.
Steps to reproduce, scenario 1
- Create a host with discovery of host prototypes.
- Execute discovery.
- Run host.massupdate on the parent host and related discovered hosts, changing TLS PSK details.
Result
Update succeeds.
Expected
Error telling it is prohibited to update read-only attribute for the discovered hosts.
Steps to reproduce, scenario 2
- Add TLS PSK details for parent host.
- Execute discovery, wait to succeed.
- Verify via database that the related discovered hosts have tls_psk_identity and tls_psk updated to the same values.
- Run host.massupdate changing TLS PSK details on the parent host only.
Result
Update succeeds, parent host details updated, but discovered hosts' details contain old TLS PSK details and only get updated on the next discovery cycle.
Expected
Both parent host and related discovered hosts' TLS PSK details match.
Steps to reproduce, scenario 3
- Run host.update changing either the TLS key or identity on the parent host only.
Result:
Error "Invalid parameter "/1/tls_psk": another tls_psk value is already associated with given tls_psk_identity."
Expected
Success. Both parent host and related discovered hosts' TLS PSK details match.
The error should be shown only if updating to a key+identity pair in use by another entity (host, proxy, ...).
- caused by
-
ZBX-24500 Zabbix agent PSK key change with minimal write privileges can bring down proxy connection
-
- Closed
-
- related to
-
ZBXNEXT-10387 Remove support of *.massupdate methods
-
- Sign off by Support
-