"fatal error: could not open autotrust file for writing" in unbound-anchor.service after upgrade to 4.12

[bo0ts]

After upgrading a bare metal cluster from 4.9 to 4.12 (taking all necessary intermediate steps) we see the following log message every day at 00:00:00:

Jun 26 00:00:00 my-worker.node.net systemd[1]: Starting unbound-anchor.service - update of the root trust anchor for DNSSEC validation in unbound...
Jun 26 00:00:00 my-worker.node.net bash[487866]: [1687737600] libunbound[487866:0] fatal error: could not open autotrust file for writing, /var/lib/unbound/root.key.487866-0-55d456c52c80: Permission denied
Jun 26 00:00:00 my-worker.node.net systemd[1]: unbound-anchor.service: Deactivated successfully.
Jun 26 00:00:00 my-worker.node.net systemd[1]: Finished unbound-anchor.service - update of the root trust anchor for DNSSEC validation in unbound.

Looking at the directory the user is now dnsmasq:

ls -la /var/lib/unbound/
total 8
drwxr-xr-x.  2 clevis  clevis    22 May 14 00:00 .
drwxr-xr-x. 36 root    root    4096 May 15 07:32 ..
-rw-r--r--.  1 dnsmasq dnsmasq  758 May 14 00:00 root.key

In a 4.9 node this filder belongs to the user unbound (which is the user the service runs under):

ls -la /var/lib/unbound/
total 8
drwxr-xr-x.  2 clevis  clevis    22 May 14 00:00 .
drwxr-xr-x. 36 root    root    4096 May 15 07:32 ..
-rw-r--r--.  1 dnsmasq dnsmasq  757 May 14 00:00 root.key

What is the correct user and how to fix this?

[vrutkovs]

Does resetting SELinux permissions via restorecon -Rav /var/lib/unbound fixes it?

[bo0ts]

@vrutkovs I assume you meant restorecon -Rv, because there is no -a option.

It did not fix the problem:

[root~]# restorecon -Rv /var/lib/unbound
[root~]# ls -la /var/lib/unbound/
total 8
drwxr-xr-x.  2 clevis  clevis    22 Apr 14 00:00 .
drwxr-xr-x. 36 root    root    4096 May 15 07:21 ..
-rw-r--r--.  1 dnsmasq dnsmasq  758 Apr 14 00:00 root.key

[bo0ts]

@vrutkovs Sorry for ping. Any update on this?

[JaimeMagiera]

Hi,

We are not working on FCOS builds of OKD any more. Please see these documents...

https://okd.io/blog/2024/06/01/okd-future-statement
https://okd.io/blog/2024/07/30/okd-pre-release-testing

We will be providing documentation on upgrading clusters from 4.15 FCOS to 4.16 SCOS. In terms of clusters that are older, you may be able to get help from community members. I'll convert this to a discussion to facilitate that.

Many thanks,

Jaime