<div dir="ltr">Taken from the ansible-playbook log of host-0:<div><br></div><div><pre style="color:rgb(0,0,0)">TASK [ovirt-host-deploy-firewalld : Enable firewalld rules] ********************
failed: [lago-basic-suite-master-host-0] (item={u'service': u'glusterfs'}) => </pre><pre style="color:rgb(0,0,0)">{"changed": false, "failed": true, "item": {"service": "glusterfs"}, "msg": </pre><pre style="color:rgb(0,0,0)">"ERROR: Exception caught: org.fedoraproject.FirewallD1.Exception: </pre><pre style="color:rgb(0,0,0)">INVALID_SERVICE: 'glusterfs' not among existing services Permanent and Non-Permanent(immediate) </pre><pre style="color:rgb(0,0,0)">operation, Services are defined by port/tcp relationship and named as they are in /etc/services </pre><pre style="color:rgb(0,0,0)">(on most systems)"}
</pre><pre style="color:rgb(0,0,0)"><font face="arial, helvetica, sans-serif"><br></font></pre><pre style="color:rgb(0,0,0)"><font face="arial, helvetica, sans-serif">Shouldn't we fail the the playbook on firewall configuration failure?</font></pre><pre style="color:rgb(0,0,0)"><br></pre></div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Oct 19, 2017 at 12:04 PM, Martin Perina <span dir="ltr"><<a href="mailto:mperina@redhat.com" target="_blank">mperina@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div class="gmail_default" style="font-family:arial,helvetica,sans-serif"><br></div><div class="gmail_extra"><br><div class="gmail_quote"><div><div class="h5">On Thu, Oct 19, 2017 at 10:58 AM, Dan Kenigsberg <span dir="ltr"><<a href="mailto:danken@redhat.com" target="_blank">danken@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">On Thu, Oct 19, 2017 at 10:29 AM, Martin Perina <<a href="mailto:mperina@redhat.com" target="_blank">mperina@redhat.com</a>> wrote:<br>
><br>
><br>
> On Thu, Oct 19, 2017 at 7:35 AM, Dan Kenigsberg <<a href="mailto:danken@redhat.com" target="_blank">danken@redhat.com</a>> wrote:<br>
>><br>
>> On Wed, Oct 18, 2017 at 2:40 PM, Daniel Belenky <<a href="mailto:dbelenky@redhat.com" target="_blank">dbelenky@redhat.com</a>><br>
>> wrote:<br>
>>><br>
>>> Hi all,<br>
>>><br>
>>> The following test is failing: 002_bootstrap.verify_add_hosts<br>
>>> All logs from failing job<br>
>>> Only 2 engine patches participated in the test, so the suspected patches<br>
>>> are:<br>
>>><br>
>>> <a href="https://gerrit.ovirt.org/#/c/82542/2" rel="noreferrer" target="_blank">https://gerrit.ovirt.org/#/c/8<wbr>2542/2</a><br>
>>> <a href="https://gerrit.ovirt.org/#/c/82545/3" rel="noreferrer" target="_blank">https://gerrit.ovirt.org/#/c/8<wbr>2545/3</a><br>
>>><br>
>>> Due to the fact that when this error first introduced we had another<br>
>>> error, the CI can't automatically detect the specific patch.<br>
>>><br>
>>> Error snippet from logs: ovirt-host-deploy-ansible log (Full log)<br>
>>><br>
>>> TASK [ovirt-host-deploy-firewalld : Enable firewalld rules]<br>
>>> ********************<br>
>>> failed: [lago-basic-suite-master-host-<wbr>0] (item={u'service':<br>
>>> u'glusterfs'}) => {"changed": false, "failed": true, "item": {"service":<br>
>>> "glusterfs"}, "msg": "ERROR: Exception caught:<br>
>>> org.fedoraproject.FirewallD1.E<wbr>xception: INVALID_SERVICE: 'glusterfs' not<br>
>>> among existing services Permanent and Non-Permanent(immediate) operation,<br>
>>> Services are defined by port/tcp relationship and named as they are in<br>
>>> /etc/services (on most systems)"}<br>
>>><br>
>>><br>
>>> Error from HOST 0 firewalld log:<br>
>>> lago-basic-suite-master-host-0<wbr>/_var_log/firewalld/ (Full log)<br>
>>><br>
>>> 2017-10-15 16:51:24 ERROR: INVALID_SERVICE: 'glusterfs' not among<br>
>>> existing services<br>
>><br>
>><br>
>> Ondra, would such an error propagate through the playbook to Engine and<br>
>> fail the add-host flow? (I think it should!)<br>
><br>
><br>
> We didn't do that so far, because of EL 7.3<br>
> . We need firewalld from 7.4 to have all available services in place (I<br>
> don't remember but I think imageio service was the one delivered only in<br>
> firewalld from 7.4). So up until now we ingore non-existent firewalld<br>
> service, but if needed we can turn this on and fail host deploy.<br>
<br>
Ok, so for now your "luckily" off the hook and not the reason of failure.<br>
<br>
>><br>
>><br>
>> Do you know which package provide the glusterfs firewalld service, and why<br>
>> it is missing from the host?<br>
><br>
><br>
> So we have used 'glusterfs' firewalld service per Sahina recommendation,<br>
> which is included in glusterfs-server package from version 3.7.6 [1]. But<br>
> this package is not installed when installing packages for cluster with<br>
> gluster capabilities enabled. So now I'm confused: don't we need<br>
> glusterfs-server package? If not and we need those ports open because they<br>
> are used by services from different already installed glusterfs packages,<br>
> shouldn't the firewalld configuration be moved from glusterfs-server to<br>
> glusterfs package?<br>
<br>
glusterfs-cli.rpm is required to consume gluster storage (virt use<br>
case), but I don't recall that it needs open ports.<br></blockquote></div></div><div><br><div style="font-family:arial,helvetica,sans-serif;display:inline" class="gmail_default">It was there even for IPTables, if gluster support is enabled on cluster, then gluster specific ports were enabled even with IPTables. FirewallD feature continues to use that.<br></div> </div><span class=""><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
glusterfs-server.rpm is required to provide gluster storage (gluster use case).<br>
If I recall correctly, firewalld feature has differentiated between<br>
the two; opening needed ports only when relevant.<br></blockquote></span><div><br><div style="font-family:arial,helvetica,sans-serif;display:inline" class="gmail_default">Right, but if gluster services are configured for firewalld it means that the host has been added to the cluster with gluster feature enabled and not only virt<br></div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
><br>
><br>
> [1] <a href="https://bugzilla.redhat.com/show_bug.cgi?id=1057295" rel="noreferrer" target="_blank">https://bugzilla.redhat.com/sh<wbr>ow_bug.cgi?id=1057295</a><br>
><br>
><br>
</blockquote></div><br></div></div>
<br>______________________________<wbr>_________________<br>
Devel mailing list<br>
<a href="mailto:Devel@ovirt.org">Devel@ovirt.org</a><br>
<a href="http://lists.ovirt.org/mailman/listinfo/devel" rel="noreferrer" target="_blank">http://lists.ovirt.org/<wbr>mailman/listinfo/devel</a><br></blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><font face="overpass, sans-serif" color="#000000" size="2"><span style="text-transform:uppercase"><b>GAL bEN HAIM</b></span></font><div><span style="color:rgb(0,0,0);font-family:overpass,sans-serif;text-transform:uppercase"><font size="2">RHV DEVOPS</font></span><br></div></div></div>
</div>