[stork-users] stork-agent 2.6.0 fails to start after upgrade: certificate files moved

[fbcadmin]

this was  Diagnosed and fixed with Grok Build (grok 1.0.52, Grok 4.7)

On 10/15/26 10:31, fbcadmin wrote:
> After upgrading isc-stork-agent from 2.4.1 (2.4.1.260508132628) to 2.6.0
> (2.6.0.261009212745) on Debian, the agent no longer starts. systemd
> reports exit status 1, and the log says:
>
>     failed to set up the gRPC server: the agent cannot start due to
>     missing certificates; consider running 'stork-agent register' to
>     obtain certificates or specify the --server-url to do it 
> automatically
>
> The certificates were still present and valid. Stork 2.6.0 looks for
> them under new names, directly in /var/lib/stork-agent/, and the package
> upgrade does not move the old files. The agent then treats the store as
> empty and refuses to start. Re-registration was not required.
>
> Old location (2.4.1)    New location (2.6.0)
> ------------------------------------------- 
> -----------------------------------------
> /var/lib/stork-agent/certs/ca.pem /var/lib/stork-agent/root-cert.pem
> /var/lib/stork-agent/certs/cert.pem /var/lib/stork-agent/server-cert.pem
> /var/lib/stork-agent/certs/key.pem  /var/lib/stork-agent/server-key.pem
> /var/lib/stork-agent/tokens/agent-token.txt 
> /var/lib/stork-agent/token.txt
> /var/lib/stork-agent/tokens/server-cert.sha256 
> /var/lib/stork-agent/server-cert.sha256
>
> Copying the existing files to those new names, with owner stork-agent
> and mode 600, lets the agent start with the same registration:
>
>     base=/var/lib/stork-agent
>     install -o stork-agent -g stork-agent -m 600 \
>         "$base/certs/ca.pem"            "$base/root-cert.pem"
>     install -o stork-agent -g stork-agent -m 600 \
>         "$base/certs/cert.pem"          "$base/server-cert.pem"
>     install -o stork-agent -g stork-agent -m 600 \
>         "$base/certs/key.pem"           "$base/server-key.pem"
>     install -o stork-agent -g stork-agent -m 600 \
>         "$base/tokens/agent-token.txt"  "$base/token.txt"
>     install -o stork-agent -g stork-agent -m 600 \
>         "$base/tokens/server-cert.sha256" "$base/server-cert.sha256"
>     systemctl reset-failed isc-stork-agent
>     systemctl start isc-stork-agent
>
> The agent then logs "Started serving Stork Agent" on port 8080. The
> original files can be left in place. This was confirmed on two Kea DHCP
> HA servers that were already registered before the upgrade.
>
> The new paths are set in backend/agent/certstore.go (newCertPaths).
> It would help if the 2.6.0 packages migrated these files on upgrade, or
> if the release notes called out the rename.
>