Error accepting a client connection: error:0A00010B:SSL routines::wrong version number (addr=127.0.0.1:xxxxxx laddr=127.0.0.1:6379) #29616
Comments
bustersg
added
the
tech-issues
|
Hi @bustersg I was unable to reproduce the issue. These are the steps I followed:
$ helm install redis-cluster oci://registry-1.docker.io/bitnamicharts/redis-cluster --set tls.enabled=true,tls.autoGenerated=true
(...)
CHART NAME: redis-cluster
CHART VERSION: 11.0.5
APP VERSION: 7.4.0
(...)
$ kubectl get sts redis-cluster -o yaml
(...)
- name: REDIS_TLS_ENABLED
value: "yes"
- name: REDIS_TLS_PORT_NUMBER
value: "6379"
- name: REDIS_TLS_AUTH_CLIENTS
value: "yes"
- name: REDIS_TLS_CERT_FILE
value: /opt/bitnami/redis/certs/tls.crt
- name: REDIS_TLS_KEY_FILE
value: /opt/bitnami/redis/certs/tls.key
- name: REDIS_TLS_CA_FILE
value: /opt/bitnami/redis/certs/ca.crt
(...)
volumeMounts:
(...)
- mountPath: /opt/bitnami/redis/certs
name: redis-certificates
readOnly: true
(...)
volumes:
(...)
- name: redis-certificates
secret:
defaultMode: 256
secretName: redis-cluster-crt
(...)
$ kubectl get secret redis-cluster-crt -o json | jq .data
{
"ca.crt": "XXX",
"tls.crt": "YYY",
"tls.key": "ZZZ"
}
$ kubectl logs sts/redis-cluster | grep "Error accepting a client connection" |
|
Let me try your method of installing via |
|
Hi @juan131 ok so i started a new project in openshift. Looks good and normal but when I check the pod logs (below) - same issues. However, all pods encounter similar errors after 5 minutes from deployment. redis-cluster-4
|
|
Hi @bustersg I'm still unable to reproduce it. This time I also used Openshift as the target cluster (OCP 4.13.x - Kubernetes v.1.26.x, to be more precise) without reproducing it. Do you have any client attempting to connect to your Redis Cluster pods or does the error appears without any interaction and the logs are simply the result of the readiness/liveness probes? |
|
I'm openshift 4.12.x any clients? no, is a new namespace, only redis-cluster. no ingress, no routes and only redis services with pvc volume error logs appear without intreraction. result of readiness/liveness? well I tried the above and after 5 hours, the logs are still rotating, 10-20 thousands lines of WRONG VERSION log on some pods. |
|
lets just say some unknown is trying to communicate to laddr=127.0.0.1:6379 (port 6379 which is a well known Redis port) |
|
It's so weird.. Maybe it's some compilation issue related with the libcurl or libssl version, see: Could you please give a try with latest chart version? We did a release bumping redis-cluster version to |
|
Same error with latest chart version. 1 of the pod cluster-0 log. I tried to delete cluster-0 and these errors still pop up after the pod restarts itself. |
|
Hi @bustersg I'm pretty sure there must be a Redis client attempting to connect to your Redis server without using the corresponding TLS flags. Could you please try reproducing the issue on a different cluster? You may have some ServiceMesh or similar solution in this particular cluster that automatically perform some kind of health check based on the pods spec. |
|
I have a little hunch on that too but there is literally no routes, ingress, stateful, deployment, other pods or services in tha namespace. If there is such, it means it could be coming outside the namespace to probe the 6379 port. I'm now trying the redis v7.0.15 from https://quay.io/repository/opstree/redis?tab=tags through the operatorHub. got it up and running without TLS and gona try TLS=enabled next. |
|
This Issue has been automatically marked as "stale" because it has not had recent activity (for 15 days). It will be closed if no further activity occurs. Thanks for the feedback. |
|
Due to the lack of activity in the last 5 days since it was marked as "stale", we proceed to close this Issue. Do not hesitate to reopen it later if necessary. |
Name and Version
bitnami/redis-cluster 11.04
What architecture are you using?
amd64
What steps will reproduce the bug?
For Openshift deployment,
Update tls section in vanilla 11.03 or 11.04 values.yaml
helm install -f values.yaml redis-cluster ./ -n redis-dev3 masters and 3 slaves (6/6) but some pods logs keep generating
Error accepting a client connection: error:0A00010B:SSL routines::wrong version number (addr=127.0.0.1:xxxxxx laddr=127.0.0.1:6379)every 1 second.Tried 3 ways but still same outcomes:
opensslmethod to generate CA Certificate and KeyautoGenerated: truein values.yamlAll 3 methods got 6 pods up and running but always some pods got the SSL wrong version number every second.
Are you using any custom parameters or values?
What is the expected behavior?
You should not see this type of error (at least not on
autoGenerated: true)What do you see instead?
Additional information
I tried adding and playing with these TLS config in values.yaml but it still did not work.
The text was updated successfully, but these errors were encountered: