[Kea-users] kea-dhcp upgrade from 2.6.4 -> 3.0.3

Tue Apr 21 07:20:36 UTC 2026

I just had a clear moment 🙂
The problem was that there was still a CA Daemon on the stork. But ofcourse the CA was disabled on the machines.
So I removed the CA from both machines on Stork and the problem is gone!

Regards,

Ronald
________________________________
Van: Kea-users <kea-users-bounces at lists.isc.org> namens DDFR | Ronald Blaas <ronald.blaas at ddfr.nl>
Verzonden: maandag 20 april 2026 09:55
Aan: kea-users at lists.isc.org <kea-users at lists.isc.org>
Onderwerp: Re: [Kea-users] kea-dhcp upgrade from 2.6.4 -> 3.0.3

I have switch the control-socket to http (in kea-dhcp)
The control Agent is disabled

At first communication between stork and isc-kea-dhcp seems to be in order but I still cannot refresh .
I have no machine under the unauthorized tab

Regards,

Ronald
________________________________
Van: Kea-users <kea-users-bounces at lists.isc.org> namens Peter Davies <peterd at isc.org>
Verzonden: vrijdag 17 april 2026 11:01
Aan: kea-users at lists.isc.org <kea-users at lists.isc.org>
Onderwerp: Re: [Kea-users] kea-dhcp upgrade from 2.6.4 -> 3.0.3

Hi Ronald,
   Looking at the Stork ARMI, I see that on Stork 2.4 with Kea 3.0:
--PASTE--
The Stork agent uses the first control socket which it is able to connect to. It supports both UNIX domain and network sockets.
--PASTE--
So it looks as if your “control-socket” statement should be ok.

Are there any machines awaiting authorization on the Services -> Machines -> unauthorized tab?
If there are none, have you tried restarting Stork?
/Peter

On 17/04/2026 10.38, Peter Davies wrote:
Hi Ronald,
   Thanks for the update.
The Stork Agent communicates with Kea over http/https not over a unix socket, as the CA does.

You need to replace your "control-socket" statement with a "control-sockets" statement that includes a "socket-type": "https"

Perhaps you should restart the CA while you test this new configuration item.

/Peter
On 17/04/2026 10.16, DDFR | Ronald Blaas wrote:
Hi Peter,

Thanks for your reply.

I did see the Notes
The problem: I have now disabled the CA but stork is not good.

My 2 servers (HA) are reporting: Communication with the daemon on this machine is broken. The Stork Agent and Kea Control Agent appear to be working, but the daemon behind it is not responding or responds with errors. The last 3 attempt(s) to communicate with the daemon failed. Please make sure that the daemon is up and is reachable.

So I am confused.
Do I need to change anything in isc-kea-conf or stork-agent env ?

HA is also not reporting (status is Fetching)

Kind regards,

Ronald

________________________________
Van: Kea-users <kea-users-bounces at lists.isc.org><mailto:kea-users-bounces at lists.isc.org> namens Peter Davies <peterd at isc.org><mailto:peterd at isc.org>
Verzonden: vrijdag 17 april 2026 07:54
Aan: kea-users at lists.isc.org<mailto:kea-users at lists.isc.org> <kea-users at lists.isc.org><mailto:kea-users at lists.isc.org>
Onderwerp: Re: [Kea-users] kea-dhcp upgrade from 2.6.4 -> 3.0.3

Hi Ronald,

   The Kea 3.0.0 Release Notes contain the following information regarding the
deprication of the Kea Control Agent (CA).

—-PASTE—-
 1. **Native HTTP/TLS support**: The DHCPv4, DHCPv6, and DHCP-DDNS
daemons now have native support for API sockets over HTTP and TLS
(HTTP), without the need to use the Control Agent (CA). This greatly
simplifies the configuration as CA is no longer necessary [#3477, #1764,
#3490]. As a result, the CA is now deprecated.
—-PASTE—-

The Stork 2.4.0 Release notes contain the following information regarding the
deprication of the CA.

---PASTE---
1. **Direct API support for Kea**: The Kea Control Agent (CA) is
deprecated as of Kea 3.0; it is now possible to run Kea in a mode where
the DHCP daemons receive commands directly (without the CA). This caused
a major refactoring of Stork: the application concept was dropped and
Stork now operates on the daemon level [#1835, #2193]. We fixed a
problem where the Stork agent was not able to detect a Kea instance when
the control agent was bound to an IPv6 address [#2092]. System tests for
the direct API were implemented [#2133]. Commands to Kea are now sent
over other control sockets if the first one is unavailable [#2223]. The
daemons are no longer removed from the database if they are inactive; a
button can delete them manually [#2095]. The agent can now communicate
to UNIX control sockets if they are configured by name only in Kea
[#2166].
---PASTE---

See: https://downloads.isc.org/isc/kea/3.0.0/Kea-3.0.0-ReleaseNotes.txt and
     https://downloads.isc.org/isc/stork/2.4.0/Stork-2.4.0-ReleaseNotes.txt

If there are duplicate entries, you should stop and disable the CA.

When the CA is no longer running, you should be able to remove the daemon, which
communicates over the CA.

/Peter

On 16/04/2026 17.13, DDFR | Ronald Blaas wrote:
Hi all,

I just upgraded my test environment from v2.6.5 to v3.0.3
After adjusting some changes in the config it is all up and running. So far no problems.

The question I have is about the control agent and Stork.

When I look at stork (v2.4.0) I now see duplicated entries is this because of the control agent? I have not (yet) changed the control agent

The part which is unclear to me is that stork can now run without the use of the control agent. (as I understand it)
But it is unclear what I need to do to make this happen.

Any insights are welcome 🙂

Kind regards,

Ronald

--
Peter Davies
Support Engineer
Internet Systems Corporation

--
Peter Davies
Support Engineer
Internet Systems Corporation

--
Peter Davies
Support Engineer
Internet Systems Corporation
peterd at isc.org<mailto:peterd at isc.org>
001 650-423-1460
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.isc.org/pipermail/kea-users/attachments/20260421/2015bdb8/attachment-0001.htm>