search

NLnetLabs / krill

RPKI Certificate Authority and Publication Server written in Rust
https://nlnetlabs.nl/projects/routing/krill/
Mozilla Public License 2.0
295 stars 42 forks source link

Krill continues to try to synchronize old parents after their removal #1230

Open TheEnbyperor opened 2 months ago

TheEnbyperor commented 2 months ago

I'm seeing a lot of errors like this in my Krill logs:

2024-08-23 09:38:33 [INFO] Synchronize CA 'as207960-rpki-ca' with its parent 'ORG-QM6-RIPE'
2024-08-23 09:38:33 [ERROR] Failed to synchronize CA 'as207960-rpki-ca' with its parent 'ORG-QM6-RIPE'. Will reschedule to: '2024-08-23T08:43:33+00:00'. Error: CA 'as207960-rpki-ca' does not have a parent named 'ORG-QM6-RIPE'

This parent used to exist, and I'm presuming the resync was scheduled when it still existed, but was first actioned after it was deleted. I think in this case Krill should not try and reschedule the sync as it will be rescheduling the task forever.

timbru commented 2 months ago

Did you also remove that parent 'ORG-QM6-RIPE' from 'as207960-rpki-ca'? If you only removed 'ORG-QM6-RIPE' from your Krill instance, then despite (presumably) being co-hosted your 'as207960-rpki-ca' will continue to believe that the parent exists somewhere and keep trying. At least, if memory serves me well that is how it works...

The following CLI options may help: https://krill.docs.nlnetlabs.nl/en/stable/cli.html#krillc-parents-statuses https://krill.docs.nlnetlabs.nl/en/stable/cli.html#krillc-parents-remove

TheEnbyperor commented 2 months ago

The parent ORG-QM6-RIPE is a RIPE CA. I removed the parent relationship from the as207960-rpki-ca in Krill.