<div dir="ltr"><br><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Oct 22, 2015 at 2:29 PM, Gianluca Cecchi <span dir="ltr"><<a href="mailto:gianluca.cecchi@gmail.com" target="_blank">gianluca.cecchi@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><span class="">On Thu, Oct 22, 2015 at 2:15 PM, Simone Tiraboschi <span dir="ltr"><<a href="mailto:stirabos@redhat.com" target="_blank">stirabos@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><div><div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><div><br></div><div>2015-10-21 17:36:33 DEBUG otopi.plugins.otopi.dialog.machine dialog.__logString:219 DIALOG:SEND ### Please input VDSM certificate chain that matches certificate request, top is issuer</div><div>2015-10-21 17:36:33 DEBUG otopi.plugins.otopi.dialog.machine dialog.__logString:219 DIALOG:SEND ###</div><div>2015-10-21 17:36:33 DEBUG otopi.plugins.otopi.dialog.machine dialog.__logString:219 DIALOG:SEND ### type '--=451b80dc-996f-432e-9e4f-2b29ef6d1141=--' in own line to mark end, '--=451b80dc-996f-ABORT-9e4f-2b29ef6d1141=--' aborts</div><div>2015-10-21 17:36:33 DEBUG otopi.context context._executeMethod:156 method exception</div><div>Traceback (most recent call last):</div><div> File "/tmp/ovirt-xP0lq4KMou/pythonlib/otopi/context.py", line 146, in _executeMethod</div><div> method['method']()</div><div> File "/tmp/ovirt-xP0lq4KMou/otopi-plugins/ovirt-host-common/vdsm/pki.py", line 319, in _misc</div><div> '\n\nPlease input VDSM certificate chain that '</div><div> File "/tmp/ovirt-xP0lq4KMou/otopi-plugins/otopi/dialog/machine.py", line 207, in queryMultiString</div><div> v = self._readline()</div><div> File "/tmp/ovirt-xP0lq4KMou/pythonlib/otopi/dialog.py", line 263, in _readline</div><div> raise IOError(_('End of file'))</div><div>IOError: End of file</div><div>2015-10-21 17:36:33 ERROR otopi.context context._executeMethod:165 Failed to execute stage 'Misc configuration': End of file</div><div>2015-10-21 17:36:33 DEBUG otopi.transaction transaction.abort:134 aborting 'Yum Transaction'</div><div>2015-10-21 17:36:33 INFO otopi.plugins.otopi.packagers.yumpackager <a href="http://yumpackager.info:95" target="_blank">yumpackager.info:95</a> Yum Performing yum transaction rollback</div><div>Loaded plugins: fastestmirror, langpacks</div></div></div></div></blockquote><div><br></div></div></div><div>The issue seams to be there:</div><div>we have an input request on host-deploy to have somebody explicitly trusting the VDSM cert chain but of course, being an automated process, nobody will respond and so it failed.</div><div>Did you manually changed the engine cert or some others CA cert?</div><div><div><div><br></div></div></div></div></div></div></blockquote></span><div>No.</div><div>The only thing is that I first ran</div><div> hosted-engine --deploy</div><div>without putting the hostname of engine inside /etc/hosts of hypervisor and it failed (see my first mail of the thread), I think without doing anything (at least at engine VM level, I don't know if it created a cert...), but generating an answer file.</div><div><br></div><div>And then I ran, as you suggested (with the warning you noted) </div><div>hosted-engine --deploy --config-append=answer_file<br></div><div><br></div><div>Inside log of first run (ovirt-hosted-engine-setup-20151021151938-j4hy5g.log) I see</div><div><br></div><div><div>2015-10-21 15:20:13 DEBUG otopi.plugins.ovirt_hosted_engine_setup.pki.vdsmpki plugin.execute:936 execut</div><div>e-output: ('/bin/openssl', 'x509', '-noout', '-text', '-in', '/etc/pki/vdsm/libvirt-spice/server-cert.p</div><div>em') stdout:</div><div>Certificate:</div><div> Data:</div><div> Version: 1 (0x0)</div><div> Serial Number: 1 (0x1)</div><div> Signature Algorithm: sha1WithRSAEncryption</div><div> Issuer: C=EN, L=Test, O=Test, CN=TestCA</div><div> Validity</div><div> Not Before: Oct 21 13:20:13 2015 GMT</div><div> Not After : Oct 20 13:20:13 2018 GMT</div><div> Subject: C=EN, L=Test, O=Test, CN=Test</div><div> Subject Public Key Info:</div><div> Public Key Algorithm: rsaEncryption</div><div> Public-Key: (1024 bit)</div><div> Modulus:</div><div> 00:bd:f8:d4:a0:87:9e:20:7f:71:12:8d:8e:90:e0:</div></div><div>...</div><div><br></div><div>Inside the run with answer file (ovirt-hosted-engine-setup-20151021170822-p1iv3y.log) I see</div><div><div>2015-10-21 17:08:22 DEBUG otopi.plugins.ovirt_hosted_engine_setup.pki.vdsmpki plugin.execute:936 execute-output: ('/bin/openssl', 'x509', '-noout', '-text', '-in', '/etc/pki/vdsm/libvirt-spice/server-cert.pem') stdout:</div><div>Certificate:</div><div> Data:</div><div> Version: 1 (0x0)</div><div> Serial Number: 1 (0x1)</div><div> Signature Algorithm: sha1WithRSAEncryption</div><div> Issuer: C=EN, L=Test, O=Test, CN=TestCA</div><div> Validity</div><div> Not Before: Oct 21 13:20:13 2015 GMT</div><div> Not After : Oct 20 13:20:13 2018 GMT</div><div> Subject: C=EN, L=Test, O=Test, CN=Test</div><div> Subject Public Key Info:</div><div> Public Key Algorithm: rsaEncryption</div><div> Public-Key: (1024 bit)</div><div> Modulus:</div><div> 00:bd:f8:d4:a0:87:9e:20:7f:71:12:8d:8e:90:e0:</div></div><div><br></div><div><br></div><div>Any particular file or section in log files to cross check?</div><div>I can also start from scratch in case.... just to be sure that I don't get into same problem, so that it can be useful to find it before...</div><div><br></div></div></div></div></blockquote><div><br></div><div>I suspect that that host-deploy fails cause you have in place a leftover VDSM cert from the previous attempt which is still signed by your previous attempt engine and so it fails to match this new engine: on the second attempt hosted-engine-setup deployed again the engine appliance creating a new instance with different certs.</div><div><br></div><div>You could try to run on the host:</div><div><span style="color:rgb(0,0,0);white-space:pre-wrap"><br></span></div><font face="monospace, monospace">/bin/rm /etc/vdsm/vdsm.conf<br>/bin/rm /etc/pki/vdsm/*/*.pem<br>/bin/rm /etc/pki/CA/cacert.pem<br>/bin/rm /etc/pki/libvirt/*.pem<br>/bin/rm /etc/pki/libvirt/private/*.pem</font></div><div class="gmail_quote"><font face="monospace, monospace">vdsm-tool configure --force</font></div><div class="gmail_quote"><font face="monospace, monospace">systemctl restart vdsmd</font></div><div class="gmail_quote"><br></div><div class="gmail_quote">than try to redeploy the host from the web-ui.</div><div class="gmail_quote">Hosted-engine configuration should be keep so it should work. To be sure simply reboot the host: if everything is fine the HA agent should restart your engine VM.</div><div class="gmail_quote"><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><div></div><div>Thanks,</div><div>Gianluca</div></div></div></div>
</blockquote></div><br></div></div>