<div dir="ltr"><div class="gmail_default" style="font-family:arial,helvetica,sans-serif"><br></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Oct 19, 2017 at 10:58 AM, Dan Kenigsberg <span dir="ltr"><<a href="mailto:danken@redhat.com" target="_blank">danken@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">On Thu, Oct 19, 2017 at 10:29 AM, Martin Perina <<a href="mailto:mperina@redhat.com">mperina@redhat.com</a>> wrote:<br>
><br>
><br>
> On Thu, Oct 19, 2017 at 7:35 AM, Dan Kenigsberg <<a href="mailto:danken@redhat.com">danken@redhat.com</a>> wrote:<br>
>><br>
>> On Wed, Oct 18, 2017 at 2:40 PM, Daniel Belenky <<a href="mailto:dbelenky@redhat.com">dbelenky@redhat.com</a>><br>
>> wrote:<br>
>>><br>
>>> Hi all,<br>
>>><br>
>>> The following test is failing: 002_bootstrap.verify_add_hosts<br>
>>> All logs from failing job<br>
>>> Only 2 engine patches participated in the test, so the suspected patches<br>
>>> are:<br>
>>><br>
>>> <a href="https://gerrit.ovirt.org/#/c/82542/2" rel="noreferrer" target="_blank">https://gerrit.ovirt.org/#/c/<wbr>82542/2</a><br>
>>> <a href="https://gerrit.ovirt.org/#/c/82545/3" rel="noreferrer" target="_blank">https://gerrit.ovirt.org/#/c/<wbr>82545/3</a><br>
>>><br>
>>> Due to the fact that when this error first introduced we had another<br>
>>> error, the CI can't automatically detect the specific patch.<br>
>>><br>
>>> Error snippet from logs: ovirt-host-deploy-ansible log (Full log)<br>
>>><br>
>>> TASK [ovirt-host-deploy-firewalld : Enable firewalld rules]<br>
>>> ********************<br>
>>> failed: [lago-basic-suite-master-host-<wbr>0] (item={u'service':<br>
>>> u'glusterfs'}) => {"changed": false, "failed": true, "item": {"service":<br>
>>> "glusterfs"}, "msg": "ERROR: Exception caught:<br>
>>> org.fedoraproject.FirewallD1.<wbr>Exception: INVALID_SERVICE: 'glusterfs' not<br>
>>> among existing services Permanent and Non-Permanent(immediate) operation,<br>
>>> Services are defined by port/tcp relationship and named as they are in<br>
>>> /etc/services (on most systems)"}<br>
>>><br>
>>><br>
>>> Error from HOST 0 firewalld log:<br>
>>> lago-basic-suite-master-host-<wbr>0/_var_log/firewalld/ (Full log)<br>
>>><br>
>>> 2017-10-15 16:51:24 ERROR: INVALID_SERVICE: 'glusterfs' not among<br>
>>> existing services<br>
>><br>
>><br>
>> Ondra, would such an error propagate through the playbook to Engine and<br>
>> fail the add-host flow? (I think it should!)<br>
><br>
><br>
> We didn't do that so far, because of EL 7.3<br>
> . We need firewalld from 7.4 to have all available services in place (I<br>
> don't remember but I think imageio service was the one delivered only in<br>
> firewalld from 7.4). So up until now we ingore non-existent firewalld<br>
> service, but if needed we can turn this on and fail host deploy.<br>
<br>
Ok, so for now your "luckily" off the hook and not the reason of failure.<br>
<br>
>><br>
>><br>
>> Do you know which package provide the glusterfs firewalld service, and why<br>
>> it is missing from the host?<br>
><br>
><br>
> So we have used 'glusterfs' firewalld service per Sahina recommendation,<br>
> which is included in glusterfs-server package from version 3.7.6 [1]. But<br>
> this package is not installed when installing packages for cluster with<br>
> gluster capabilities enabled. So now I'm confused: don't we need<br>
> glusterfs-server package? If not and we need those ports open because they<br>
> are used by services from different already installed glusterfs packages,<br>
> shouldn't the firewalld configuration be moved from glusterfs-server to<br>
> glusterfs package?<br>
<br>
glusterfs-cli.rpm is required to consume gluster storage (virt use<br>
case), but I don't recall that it needs open ports.<br></blockquote><div><br><div style="font-family:arial,helvetica,sans-serif;display:inline" class="gmail_default">It was there even for IPTables, if gluster support is enabled on cluster, then gluster specific ports were enabled even with IPTables. FirewallD feature continues to use that.<br></div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
glusterfs-server.rpm is required to provide gluster storage (gluster use case).<br>
If I recall correctly, firewalld feature has differentiated between<br>
the two; opening needed ports only when relevant.<br></blockquote><div><br><div style="font-family:arial,helvetica,sans-serif;display:inline" class="gmail_default">Right, but if gluster services are configured for firewalld it means that the host has been added to the cluster with gluster feature enabled and not only virt<br></div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
><br>
><br>
> [1] <a href="https://bugzilla.redhat.com/show_bug.cgi?id=1057295" rel="noreferrer" target="_blank">https://bugzilla.redhat.com/<wbr>show_bug.cgi?id=1057295</a><br>
><br>
><br>
</blockquote></div><br></div></div>