NLnetLabs / rpki-deploy

RPKI deployment related tooling developed for/by NLnet Labs.
https://nlnetlabs.nl/rpki
3 stars 2 forks source link

Flapping RIPE NCC RPKI Validator 3 test result #12

Closed ximon18 closed 4 years ago

ximon18 commented 4 years ago

Sometimes the NCC test succeeds very quickly, other times even after 24 retries 10 seconds apart it still fails. An initial improvement could be to check some property of the REST API output of the NCC validator to see if it is even "ready" and to not fail the test if it was not ready, only if it was ready and the ROAs are not equal to those of Krill.

ximon18 commented 4 years ago

A couple of candidate REST API output prorperties that could be checked which seem to transition from false to true when our E2E test passes from fail to succeed:

  1. http://<FQDN>:8080/api/healthcheck

    {
    "data" : {
    "overalStatus" : "OK",
    "trustAnchorReady" : {
      "ta.tal" : false  <-----------
    },
  2. http://<FQDN>:8080/api/trust-anchors/1

    {
    "data" : {
    "type" : "trust-anchor",
    "id" : 1,
    "name" : "ta.tal",
    "locations" : [ "rsync://<FQDN>/repo/ta/ta.cer" ],
    "subjectPublicKeyInfo" : "MIIB..AQAB",
    "preconfigured" : true,
    "initialCertificateTreeValidationRunCompleted" : true,   <-----------
ximon18 commented 4 years ago

Fixed by 1396c5a9202625ba7914126b4f7c1359c1c00434.