[Kea-users] stork-agent 2.6.0 fails to start after upgrade: certificate files moved

[fbcadmin]

After upgrading isc-stork-agent from 2.4.1 (2.4.1.260508132628) to 2.6.0
(2.6.0.261009212745) on Debian, the agent no longer starts. systemd
reports exit status 1, and the log says:

     failed to set up the gRPC server: the agent cannot start due to
     missing certificates; consider running 'stork-agent register' to
     obtain certificates or specify the --server-url to do it automatically

The certificates were still present and valid. Stork 2.6.0 looks for
them under new names, directly in /var/lib/stork-agent/, and the package
upgrade does not move the old files. The agent then treats the store as
empty and refuses to start. Re-registration was not required.

Old location (2.4.1)    New location (2.6.0)
------------------------------------------- 
-----------------------------------------
/var/lib/stork-agent/certs/ca.pem /var/lib/stork-agent/root-cert.pem
/var/lib/stork-agent/certs/cert.pem /var/lib/stork-agent/server-cert.pem
/var/lib/stork-agent/certs/key.pem  /var/lib/stork-agent/server-key.pem
/var/lib/stork-agent/tokens/agent-token.txt /var/lib/stork-agent/token.txt
/var/lib/stork-agent/tokens/server-cert.sha256 
/var/lib/stork-agent/server-cert.sha256

Copying the existing files to those new names, with owner stork-agent
and mode 600, lets the agent start with the same registration:

     base=/var/lib/stork-agent
     install -o stork-agent -g stork-agent -m 600 \
         "$base/certs/ca.pem"            "$base/root-cert.pem"
     install -o stork-agent -g stork-agent -m 600 \
         "$base/certs/cert.pem"          "$base/server-cert.pem"
     install -o stork-agent -g stork-agent -m 600 \
         "$base/certs/key.pem"           "$base/server-key.pem"
     install -o stork-agent -g stork-agent -m 600 \
         "$base/tokens/agent-token.txt"  "$base/token.txt"
     install -o stork-agent -g stork-agent -m 600 \
         "$base/tokens/server-cert.sha256" "$base/server-cert.sha256"
     systemctl reset-failed isc-stork-agent
     systemctl start isc-stork-agent

The agent then logs "Started serving Stork Agent" on port 8080. The
original files can be left in place. This was confirmed on two Kea DHCP
HA servers that were already registered before the upgrade.

The new paths are set in backend/agent/certstore.go (newCertPaths).
It would help if the 2.6.0 packages migrated these files on upgrade, or
if the release notes called out the rename.