auto-configure resolver fails on RedHat7,8,9

[qrkourier]

DEBUG

May 14 22:15:45 rocky9.localdomain ziti-edge-tunnel[3483]: (3483)[        0.010]    INFO ziti-edge-tunnel:resolvers.c:68 init_libsystemd() Initializing libsystemd                                                                                                                                                                                    
May 14 22:15:45 rocky9.localdomain ziti-edge-tunnel[3483]: (3483)[        0.010]   DEBUG ziti-edge-tunnel:resolvers.c:96 init_libsystemd() Dynamically loaded libsystemd                                                                                                                                                                              
May 14 22:15:45 rocky9.localdomain ziti-edge-tunnel[3483]: (3483)[        0.010]   DEBUG ziti-edge-tunnel:resolvers.c:342 try_libsystemd_resolver() Detected systemd is init system                     
May 14 22:15:45 rocky9.localdomain ziti-edge-tunnel[3483]: (3483)[        0.010]   DEBUG ziti-edge-tunnel:resolvers.c:349 try_libsystemd_resolver() Connected to system DBus
May 14 22:15:45 rocky9.localdomain ziti-edge-tunnel[3483]: (3483)[        0.011]   DEBUG ziti-edge-tunnel:resolvers.c:223 sd_bus_is_acquired_name() systemd-resolved DBus name is NOT acquired                                                                                                                       
May 14 22:15:45 rocky9.localdomain ziti-edge-tunnel[3483]: (3483)[        0.011]    WARN ziti-edge-tunnel:resolvers.c:352 try_libsystemd_resolver() libsystemd resolver unsuccessful. Falling back to legacy resolvers
May 14 22:15:45 rocky9.localdomain ziti-edge-tunnel[3483]: (3483)[        0.014]   DEBUG ziti-edge-tunnel:utils.c:33 run_command_va() system(/usr/bin/busctl status org.freedesktop.resolve1 > /dev/null 2>&1) returned 256
May 14 22:15:45 rocky9.localdomain ziti-edge-tunnel[3483]: (3483)[        0.014]    WARN ziti-edge-tunnel:tun.c:277 find_dns_updater() Adding ziti resolver to /etc/resolv.conf. Ziti DNS functionality may be impaired
May 14 22:15:45 rocky9.localdomain ziti-edge-tunnel[3483]: (3483)[        0.014]    INFO ziti-edge-tunnel:resolvers.c:425 make_copy() attempting copy of: /etc/resolv.conf                                                                                                                                                                            
May 14 22:15:45 rocky9.localdomain ziti-edge-tunnel[3483]: (3483)[        0.014]    WARN ziti-edge-tunnel:resolvers.c:433 make_copy() could not create copy[/etc/resolv.conf.bkp]: permission denied                                       
May 14 22:15:45 rocky9.localdomain ziti-edge-tunnel[3483]: (3483)[        0.014]   ERROR ziti-edge-tunnel:resolvers.c:478 dns_update_etc_resolv() cannot open /etc/resolv.conf: Permission denied                                                                                                                                                     May 14 22:15:45 rocky9.localdomain ziti-edge-tunnel[3483]: (3483)[        0.014]    WARN ziti-edge-tunnel:resolvers.c:479 dns_update_etc_resolv() run as 'root' or manually update your resolver configuration. Ziti DNS must be the first resolver: 100.64.0.2                                   
May 14 22:15:45 rocky9.localdomain ziti-edge-tunnel[3483]: (3483)[        0.014]   DEBUG ziti-edge-tunnel:tun.c:296 after_set_dns() DNS update: 0                                                                                                                                                                                                     May 14 22:15:45 rocky9.localdomain ziti-edge-tunnel[3483]: (3483)[        0.024]   DEBUG ziti-sdk:ziti_ctrl.c:330 ctrl_body_cb() ctrl[miniziti-controller.192.168.49.2.sslip.io] completed GET[/version] in 0.014 s                                                                                                                                   May 14 22:15:45 rocky9.localdomain ziti-edge-tunnel[3483]: (3483)[        0.024]    INFO ziti-sdk:ziti.c:1698 version_cb() ztx[0] connected to controller https://miniziti-controller.192.168.49.2.sslip.io:443 version v1.0.0(a3186132e5eb 2024-04-10T19:42:37Z)                                                                                     May 14 22:15:45 rocky9.localdomain ziti-edge-tunnel[3483]: (3483)[        0.029]   DEBUG ziti-sdk:ziti_ctrl.c:330 ctrl_body_cb() ctrl[miniziti-controller.192.168.49.2.sslip.io] completed POST[/authenticate?method=cert] in 0.019 s

---

Workarounds

It's necessary to add the Ziti resolver address to the NetworkManager connection.

• Ansible: https://github.com/openziti-test-kitchen/vagrant/blob/39f92ddfea0dc2ad09b9b71546a315f16d6e99c1/ziti-edge-tunnel/redhat9-ziti-edge-tunnel-rpm-repo/playbook.yaml#L51

• command line:

  CONN="eth0";
  nmcli connection modify "$CONN" \
    ipv4.ignore-auto-dns yes \
    ipv4.dns "100.64.0.2,1.1.1.1" \
  && nmcli connection up "$CONN"

[scareything]

685