Error: 16 UNAUTHENTICATED

[agiguere]

we started to have this error recently, everything was good before, maybe I will have to create a support ticket

any ideay?

{"stack":"Error: 16 UNAUTHENTICATED: mTLS client certificate not presented\n at callErrorFromStatus (/home/vcap/app/node_modules/@grpc/grpc-js/build/src/call.js:32:19)\n at Object.onReceiveStatus (/home/vcap/app/node_modules/@grpc/grpc-js/build/src/client.js:193:76)\n at Object.onReceiveStatus (/home/vcap/app/node_modules/@grpc/grpc-js/build/src/client-interceptors.js:367:141)\n at Object.onReceiveStatus (/home/vcap/app/node_modules/@grpc/grpc-js/build/src/client-interceptors.js:327:181)\n at /home/vcap/app/node_modules/@grpc/grpc-js/build/src/resolving-call.js:135:78\n at process.processTicksAndRejections (node:internal/process/task_queues:85:11)\nfor call at\n at ServiceClientImpl.makeUnaryRequest (/home/vcap/app/node_modules/@grpc/grpc-js/build/src/client.js:161:32)\n at ServiceClientImpl.export (/home/vcap/app/node_modules/@grpc/grpc-js/build/src/make-client.js:105:19)\n at /home/vcap/app/node_modules/@opentelemetry/otlp-grpc-exporter-base/build/src/grpc-exporter-transport.js:98:32\n at new Promise ()\n at GrpcExporterTransport.send (/home/vcap/app/node_modules/@opentelemetry/otlp-grpc-exporter-base/build/src/grpc-exporter-transport.js:87:16)\n at OTLPExportDelegate.export (/home/vcap/app/node_modules/@opentelemetry/otlp-exporter-base/build/src/otlp-export-delegate.js:52:56)\n at OTLPLogExporter.export (/home/vcap/app/node_modules/@opentelemetry/otlp-exporter-base/build/src/OTLPExporterBase.js:29:30)\n at /home/vcap/app/node_modules/@opentelemetry/core/build/src/internal/exporter.js:29:28\n at AsyncLocalStorage.run (node:internal/async_local_storage/async_hooks:91:14)\n at AsyncLocalStorageContextManager.with (/home/vcap/app/node_modules/@opentelemetry/context-async-hooks/build/src/AsyncLocalStorageContextManager.js:33:40)","message":"16 UNAUTHENTICATED: mTLS client certificate not presented","code":"16","details":"mTLS client certificate not presented","metadata":"[object Object]","name":"Error"}"

[yevgentrukhin]

Sounds like an expired certificate, perform steps here: #282 (comment) and it should help. since validity of certificate is set to certain timeperiod, you might need to start looking at options to automate this. one option is to create a periodically executed job to refresh certificate.

[tsteckenborn]

Might be valuable to have a guide around doing that somewhere, especially if it's simply a bound service within an mta akin to

  - name: somename
    type: org.cloudfoundry.existing-service
    parameters:
      service: cloud-logging
      service-plan: standard

[agiguere]

@yevgentrukhin my certificate on IAS is valid for 5 years

I just did these 3 commands and it looks like the error is gone, strange

cf unbind-service app-name service-instance
cf bind-service app-name service-instance
cf restage app-name

[yevgentrukhin]

it is the certificate that you receive via cloud logging binding (just open one in the cockpit) that you should refresh periodically. Those commands perform that operation.
documentation link: https://help.sap.com/docs/cloud-logging/cloud-logging/ingest-via-opentelemetry-api-endpoint?locale=en-US
also: https://help.sap.com/docs/btp/sap-btp-security-recommendations-c8a9bb59fe624f0981efa0eff2497d7d/sap-btp-security-recommendations?seclist-index=BTP-CLS-0003&locale=en-US

[agiguere]

@yevgentrukhin what is the recommandation to rotate the certificate, from a CAP app deployment perspective, there is nothing we can do (MTA parameters)

I have to do those commands here and there for every deploy apps

cf unbind-service app-name service-instance
cf bind-service app-name service-instance -c '{"ingest":{"certValidityDays":90}}'
cf restage app-name

very annoying