<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>Hi Didi,<br>I can confirm that using both an ovhe-answers.conf directive:<br>OVEHOSTED_NETWORK/firewallManager=str:nonexistent<br><br>and an /etc/ovirt-host-deploy.conf.d/99-prevent-iptables.conf with:<br>[environment:enforce]<br>NETWORK/iptablesEnable=bool:False<br><br>results in "ovirt-hosted-engine-setup --config-append=ovhe-answers.conf" leaving iptables rules untouched while adding the second hypervisor host to an already deployed self-hosted-engine with one physical host.<br><br>Many thanks again,<br>Giuseppe<br><br>PS: is there any difference in using "ovirt-hosted-engine-setup" vs. "hosted-engine --deploy" ?<br><br><div><hr id="stopSpelling">From: giuseppe.ragusa@hotmail.com<br>To: didi@redhat.com<br>Date: Tue, 25 Mar 2014 22:49:36 +0100<br>CC: users@ovirt.org<br>Subject: Re: [Users] Otopi pre-seeded answers and firewall settings<br><br>
<style><!--
.ExternalClass .ecxhmmessage P {
padding:0px;
}
.ExternalClass body.ecxhmmessage {
font-size:12pt;
font-family:Calibri;
}
--></style>
<div dir="ltr">Hi Didi,<br>many thanks for your invaluable help!<br><br>I'll try your suggestion (/etc/ovirt-host-deploy.conf.d/99-prevent-iptables.conf) asap and then I will report back.<br><br>By the way: I have a really custom iptables setup (multiple separated networks on hypervisor hosts), so I suppose it's best to hand tune firewall rules and then leave them alone (I pre-configure them, so the setup procedure won't be impeded in its communication needs anyway AND I will always guarantee the most stringent filtering possible with default deny ecc.).<br><br>Many thanks again,<br>Giuseppe<br><br><div><hr id="ecxstopSpelling">Date: Tue, 25 Mar 2014 04:05:33 -0400<br>From: didi@redhat.com<br>To: giuseppe.ragusa@hotmail.com<br>CC: users@ovirt.org<br>Subject: Re: [Users] Otopi pre-seeded answers and firewall settings<br><br><div style="font-family:times new roman, new york, times, serif;font-size:12pt;color:#000000;"><div></div><blockquote style="border-left:2px solid #1010FF;padding-left:5px;color:#000;font-weight:normal;font-style:normal;text-decoration:none;font-family:Helvetica,Arial,sans-serif;font-size:12pt;" data-mce-style="border-left: 2px solid #1010FF; margin-left: 5px; padding-left: 5px; color: #000; font-weight: normal; font-style: normal; text-decoration: none; font-family: Helvetica,Arial,sans-serif; font-size: 12pt;"><b>From: </b>"Giuseppe Ragusa" <giuseppe.ragusa@hotmail.com><br><b>To: </b>"Yedidyah Bar David" <didi@redhat.com><br><b>Cc: </b>"Users@ovirt.org" <users@ovirt.org><br><b>Sent: </b>Tuesday, March 25, 2014 1:53:20 AM<br><b>Subject: </b>RE: [Users] Otopi pre-seeded answers and firewall settings<br><div><br></div><style><!--
.ExternalClass .ecxhmmessage P {
padding:0px;
}
.ExternalClass body.ecxhmmessage {
font-size:12pt;
font-family:Calibri;
}
--></style><div dir="ltr">Hi Didi,<br>I found the references to NETWORK/iptablesEnable in my engine logs (/var/log/ovirt-engine/host-deploy/ovirt-*.log), but it didn't seem to work after all.<br><div><br></div>Full logs attached.<br><div><br></div>I resurrected my Engine by rebooting the (still only) host, then restarting ovirt-ha-agent (at startup the agent failed while trying to launch vdsm, but I found vdsm running and so tried manually...).</div></blockquote><div><br></div><div>OK, so it's host-deploy that's doing that.</div><div>But it's not host-deploy itself - it's the engine that is talking to it, asking it to configure iptables.</div><div>I don't know how to make the agent don't do that. I searched a bit the sources (which I don't know)</div><div>and didn't find a simple way.</div><div><br></div><div>You can, however, try to override this by:</div><div># mkdir -p /etc/ovirt-host-deploy.conf.d</div><div># echo '[environment:enforce]' > /etc/ovirt-host-deploy.conf.d/99-prevent-iptables.conf</div><div># echo 'NETWORK/iptablesEnable=bool:False' >> /etc/ovirt-host-deploy.conf.d/99-prevent-iptables.conf</div><div><br></div><div>Never tried that, and not sure it's recommended - if it does work, it means that host-deploy will not</div><div>update iptables, but the engine will think it did. So it's better to find a way to make the engine not do</div><div>that. Or, better yet, that you'll explain why you need this and somehow make the engine do what you want...</div><div><span style="font-size:12pt;">-- </span></div><div>Didi</div><div><br></div></div></div> </div>
<br>_______________________________________________
Users mailing list
Users@ovirt.org
http://lists.ovirt.org/mailman/listinfo/users</div> </div></body>
</html>