-
Notifications
You must be signed in to change notification settings - Fork 71
Description
Describe the bug
In Keylime Rust agent v0.2.8, the agent continues running even when it fails to connect to and register with the Registrar during startup.
This allows the keylime agent to continue running without registration on Registrar.
In previous versions (e.g., v0.2.7), the agent would exit with a non-zero return code under the same conditions after 'Failed to register agent' Error
Observed log excerpt:
ERROR keylime_agent > Failed to register agent: RegistrarClientBuilder(Reqwest(reqwest::Error { kind: Request, url: "http://10.10.1.1:8890/version", source: hyper_util::client::legacy::Error(Connect, ConnectError("tcp connect error", Os { code: 111, kind: ConnectionRefused, message: "Connection refused" })) }))
INFO keylime_agent > Listening on https://0.0.0.0:9002
DEBUG keylime_agent::revocation > Starting revocation worker
DEBUG keylime_agent::payloads > Starting payloads worker
DEBUG keylime_agent::keys_handler > Starting keys worker
Expected behaviour:
If the agent cannot register with the Registrar at startup, it should:
- Exit immediately with a non-zero exit code.
- Clearly indicate in the logs that failure to register is fatal.
- Avoid starting to listen on service ports until registration is successful, unless explicitly instructed to run in degraded mode via a CLI flag.
Steps to reproduce the bug
- Run the Keylime Rust agent v0.2.8 with a Registrar IP/port configured to an inactive service or incorrect endpoint.
- Observe that the agent logs a registration failure but continues running.
- Check the agent process exit code — it remains RC=0.
- Compare the same test with v0.2.7, where it exits immediately.
Anything else?
Enhancement: Add a --fail-on-registrar-error or similar flag to keylime_agent.
Environment details
Kubernetes version: v1.34.1
Cloud-provider/provisioner: bare-metal
keylime version: v7.13.0
rust-keylime version: v0.2.8
/kind bug