Resolving "Blocking unauthorized gRPC request" Error After Upgrading GPCC to Version 6.17.1 and Afterward
search cancel

Resolving "Blocking unauthorized gRPC request" Error After Upgrading GPCC to Version 6.17.1 and Afterward

book

Article ID: 445625

calendar_today

Updated On:

Products

VMware Tanzu Data Intelligence

Issue/Introduction

Symptoms

After upgrading Greenplum Command Center (GPCC) from version to 6.17.1 (and afterward), the GPCC service fails to start properly or continuously logs errors in webserver.log.

The specific error message appears as follows:

[ERROR] Blocking unauthorized gRPC request from <IP_ADDRESS>

When analyzing the log files (e.g., running cat webserver.log | grep 'Blocking unauthorized' | cut -d ' ' -f 3- | sort | uniq -c), you will see multiple recurring blocking errors associated with cluster host IP addresses, such as:

145000 [ERROR] Blocking unauthorized gRPC request from ##.##.##.##
145488 [ERROR] Blocking unauthorized gRPC request from ##.##.##.##
144162 [ERROR] Blocking unauthorized gRPC request from ##.##.##.##
145456 [ERROR] Blocking unauthorized gRPC request from ##.##.##.##
406352 [ERROR] Blocking unauthorized gRPC request from ##.##.##.##
145536 [ERROR] Blocking unauthorized gRPC request from ##.##.##.##

 

Cause

Root Cause:

GPCC version 6.17.1 introduces a new security mechanism that strictly regulates and restricts communication between hosts. By default, it only allows gRPC communication between authenticated hosts.

This behavior is controlled by the parameter enable_grpc_ip_auth in the app.conf file, which is set to enabled by default. If a host uses multiple IPs as segment targets, then the extra IPs will not be listed in the allowed list, causing the webserver to block their incoming gRPC requests.

Resolution

Resolution:

To resolve this issue, you need to use the new gRPC IP allowlist feature introduced in version 6.17.1 to explicitly grant permission to the relevant host IP addresses. Follow the steps below:

Step 1: Locate the Configuration File

Log in to the host where your GPCC master instance is located (typically the Greenplum Master node) and locate the configuration file at:

$GPCC_HOME/conf/app.conf

Step 2: Edit the Configuration

  1. Back up the app.conf file before making any changes.

  2. Open app.conf in a text editor.

  3. Add the grpc_ip_allowlist parameter and append the list of affected IP addresses (separated by commas). Based on your logs, add the following line:

grpc_ip_allowlist='<IP1>, <IP2>, <IP3>....'

Step 3: Restart GPCC Service

Save the file and restart your GPCC services for the changes to take effect:

gpcc stop
gpcc start

Step 4: Verify the Results

After the service restarts, check the webserver.log again to verify that the "Blocking unauthorized gRPC request" error messages have ceased.

 

Additional Information

Refer to the document for details: https://techdocs.broadcom.com/us/en/vmware-tanzu/data-solutions/tanzu-greenplum-command-center/6-17/gp-command-center/topics-configref-console.html

Powered by Wolken Software