- Devel - oVirt List Archives

OVF_STORE volumes are not updated
by Christopher Pereira 14 Oct '15

14 Oct '15

Hi, I noticed that OVF_STORE volumes are not generated periodically as expected [1]. It seems like the OVF_STORE volumes are only generated when the Storage Domain is detached from Engine, which is not feasible if we want to keep the VMs running. 1) Is there any way to force the OVF_STORE volume creation without detaching the Storage Domain? This would be very usefull for disaster recovery, since Storage Domains can be backed up and VM can be reimported. But if the OVF_STORE volumes are not updated, critical information like the ID of the VM active snapshot will get lost. If the VM is restored with a previous snapshot (not the last one), all information written after the last snapshot known by the OVF_STORE will get lost. 2) On the other hand, the only way I know to re-read the OVF_STORE content with the VM information contained in a Storage Domain, is by detaching and re-attaching it. I wonder if there is also any way to re-read the OVF_STORE? [1] : This is can be verified very easily by changing a running VM properties (change its name or create a snapshot), copying the whole storage domain and importing it into another Engine (POOL_UID and CHECKSUM must be removed from metadata in order to be able to attach to another Datacenter). PS: I'm on 3.6 RC. 1.

3 4

Where should the answer file for the improved HE flow be located?
by Fabian Deutsch 12 Oct '15

12 Oct '15

Hey, lately we had the issue that the answer file for the engine in the HE flow changed (it required an additional answer). Currently the answerfile is maintained by node in the engine appliance. I wonder if it wouldn't make more sense to keep the answer file (which is solely used for the HE flow) could be maintained inside the hosted-engine-setup repository, and be packaged in a subpackage (i.e. hosted-engine-setup-answers[-3.6]). Another thought is that the HE-setup cloud-init is already referencing the engine answerfile, if it was matained in the same package, then it should also be easier to ensure that the assumed and real paths of the answerfile match. So, if the answerfile was in that subpackage of HE-setup, we could just install that specific package inside the appliance, and the rest is left to the HE-setup logic. Thoughts? - fabian

4 4

Termin gestrichen: oVirt Node weekly meeting - Mo 12. Okt. 2015 16:00 - 16:30 (fdeutsch@redhat.com)
by fdeutsch＠redhat.com 11 Oct '15

11 Oct '15

Dieser Termin wurde gestrichen und aus Ihrem Kalender entfernt. Titel: oVirt Node weekly meeting Hey, this is an invitation to the weekly oVirt Node devel meetings. Anyone interested or related to Node development is welcome. Wann: Mo 12. Okt. 2015 16:00 - 16:30 Berlin Wo: irc://irc.oftc.net#ovirt Kalender: fdeutsch(a)redhat.com Wer * Fabian Deutsch - Organisator * wdaniel(a)redhat.com * tlitovsk(a)redhat.com * devel(a)ovirt.org Einladung von Google Kalender: https://www.google.com/calendar/ Sie erhalten diese E-Mail unter devel(a)ovirt.org, da Sie ein Gast bei diesem Termin sind. Lehnen Sie diesen Termin ab, um keine weiteren Informationen zu diesem Termin zu erhalten. Sie können auch unter https://www.google.com/calendar/ ein Google-Konto erstellen und Ihre Benachrichtigungseinstellungen für Ihren gesamten Kalender steuern. Wenn Sie diese Einladung weiterleiten, kann jeder Empfänger Ihre Antwort auf die Einladung ändern. Weitere Informationen finden Sie unter https://support.google.com/calendar/answer/37135#forwarding

1 0

Extended import of Virtual Machines
by Christopher Pereira 11 Oct '15

11 Oct '15

This is a multi-part message in MIME format. --------------030100010708070503020900 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Hi Arik, Shahar, Richard, We would like to test and contribute to the "Extended import of Virtual Machines" project [1]. Our particular interest is in importing VMs (from libvirt domains or other existing oVirt storage domains) into oVirt ideally avoiding image conversions. This would be achieved by moving existing raw/qcow2 images into a given oVirt storage domain (using 'mv' instead of 'qemu-img') and dealing with the OVF_STORE files. A problem we faced is that importing VMs using virt-v2v is currently broken in 3.6-rc1 as Richard W.M. Jones reported some weeks ago [2]. [1] : http://www.ovirt.org/Features/virt-v2v_Integration [2] : https://bugzilla.redhat.com/show_bug.cgi?id=1266930 -- *J. Christopher Pereira* IMATRONIX S.A. www.imatronix.com --------------030100010708070503020900 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 7bit <html> <head> <meta http-equiv="content-type" content="text/html; charset=utf-8"> </head> <body bgcolor="#FFFFFF" text="#000000"> Hi Arik, Shahar, Richard, We would like to test and contribute to the "Extended import of Virtual Machines" project [1]. Our particular interest is in importing VMs (from libvirt domains or other existing oVirt storage domains) into oVirt ideally avoiding image conversions. This would be achieved by moving existing raw/qcow2 images into a given oVirt storage domain (using 'mv' instead of 'qemu-img') and dealing with the OVF_STORE files. A problem we faced is that importing VMs using virt-v2v is currently broken in 3.6-rc1 as Richard W.M. Jones reported some weeks ago [2]. [1] : <a class="moz-txt-link-freetext" href="http://www.ovirt.org/Features/virt-v2v_Integration">http://www.ovirt.org/Features/virt-v2v_Integration</a> [2] : <a class="moz-txt-link-freetext" href="https://bugzilla.redhat.com/show_bug.cgi?id=1266930">https://bugzilla.redhat.com/show_bug.cgi?id=1266930</a> <div class="moz-signature">-- <style> .signature, .small-signature { font-family:"Calibri","sans-serif";mso-fareast-font-family:"Times New Roman"; color:#7F7F7F; } .signature { font-size:10pt; } .small-signature { font-size:8pt; } </style> J. Christopher Pereira IMATRONIX S.A. <a class="moz-txt-link-abbreviated" href="http://www.imatronix.com">www.imatronix.com</a> </div> </body> </html> --------------030100010708070503020900--

2 1

Get Involved in oVirt Project! October edition
by Sandro Bonazzola 09 Oct '15

09 Oct '15

Hi, Have you got some free time and do you want to get involved in oVirt project? Do you like the idea of having fresh disk images of recent distribution in oVirt Glance repository? You can help us by testing existing online images ensuring they works with cloud-init or creating one yourself and report your success to devel(a)ovirt.org. We'll be happy to upload the images once these are ready. Do you like Debian and do you have some programming skill? Help us getting VDSM running on it! We started releasing highly experimental packages and it's a good time for giving them a try. You can follow the progress here: http://www.ovirt.org/VDSM_on_Debian Here are some bugs you can try to help with: Bug ID Status Whiteboard Target Milestone Summary 1120588 NEW docs ovirt-3.6.0-rc update log collector documentation 1120585 NEW docs ovirt-3.6.0-rc update image uploader documentation 1120586 NEW docs ovirt-3.6.0-rc update iso uploader documentation 1159784 NEW docs --- [RFE] Document when and where new features are available when upgrading cluster / datacenters 1174285 NEW i18n ovirt-3.6.0-rc [de-DE] "Live Snapshot Support" reads "Live Snapsnot Support" 1074301 NEW infra ovirt-4.0.0 [RFE] ovirt-shell has no man page 1227019 NEW integration ovirt-3.6.1 Require sos >= 3.3 when available - ovirt sosreport plugin doesn't obfuscate password used in aaa extensions 1237132 NEW integration ovirt-3.6.1 [TEXT] New package listing of engine-setup when upgrading packages is not user friendly 1156060 NEW integration ovirt-3.6.1 [text] engine admin password prompt consistency 1251965 NEW integration ovirt-3.6.1 Appliance based setup should default to using /var/tmp for unpacking the image 1065350 POST integration ovirt-3.6.1 hosted-engine should prompt a question at the user when the host was already a host in the engine 1083104 NEW integration ovirt-4.0.0 engine-setup --offline does not update versionlock 1269182 POST integration ovirt-3.6.1 hosted-engine accepts FQDNs with underscore while the engine correctly fails on that 1234257 NEW integration ovirt-3.5.6 Test engine upgrade path from EL6 with oVirt 3.5.z to EL7 1059952 POST integration ovirt-3.6.1 hosted-engine --deploy (additional host) will fail if the engine is not using the default self-signed CA 1247068 POST integration ovirt-3.6.1 [TEXT] Warn the administrator that CD/DVD passthrough is disabled for RHEL7 1115059 ASSIGNED network ovirt-3.6.0-ga Incomplete error message when adding VNIC profile to running VM 772931 NEW reports --- [RFE] Reports should include the name of the oVirt engine Are you great at packaging software? Do you prefer a distribution which is currently unsupported by oVirt? Do you want to have packages included in your preferred distribution? Help getting oVirt ported there! Fedora: http://lists.ovirt.org/pipermail/devel/2015-September/011426.html CentOS: https://wiki.centos.org/SpecialInterestGroup/Virtualization Gentoo: https://wiki.gentoo.org/wiki/OVirt Debian Jessie: http://www.ovirt.org/Features/Debian_support_for_hosts Archlinux: http://www.ovirt.org/OVirt_on_Arch_Linux OpenSUSE: https://build.opensuse.org/project/show/Virtualization:oVirt Do you love "DevOps?", you count stable builds in jenkins ci while trying to fall a sleep? Then oVirt infra team is looking for you!, join the infra team and dive in to do the newest and coolest devops tools today! Here are some of our open tasks you can help with: https://ovirt-jira.atlassian.net/secure/RapidBoard.jspa?rapidView=1&project… You don't have programming skills, not enough time for DevOps but you want still to contribute? Here are some bugs you can take care of, also without writing a line of code: https://bugzilla.redhat.com/buglist.cgi?quicksearch= <https://bugzilla.redhat.com/buglist.cgi?quicksearch=classification%3Aovirt%…> classification <https://bugzilla.redhat.com/buglist.cgi?quicksearch=classification%3Aovirt%…> %3Aovirt%20whiteboard%3Adocs <https://bugzilla.redhat.com/buglist.cgi?quicksearch=classification%3Aovirt%…> Do you prefer to test things? We have some test cases[5] you can try using nightly snapshots[6]. Do you want to contribute test cases? Most of the features[7] included in oVirt are missing a test case, you're welcome to contribute one! Do you want to contribute artworks? oVirt Live backgrounds and covers, release banners, stickers, .... Take a look at Fedora Artworks[9] as an example of what you can do Is this the first time you try to contribute to oVirt project? You can start from here [1][2]! You don't know gerrit very well? You can find some more docs here [3]. Any other question about development? Feel free to ask on devel(a)ovirt.org or on irc channel[4]. You don't really have time / skills for any development / documentation / testing related task? Spread the word[8]! Let us know you're getting involved, present yourself and tell us what you're going to do, you'll be welcome! [1] http://www.ovirt.org/Develop [2] http://www.ovirt.org/Working_with_oVirt_Gerrit [3] https://gerrit-review.googlesource.com/Documentation [4] http://www.ovirt.org/Community [5] http://www.ovirt.org/Category:TestCase [6] http://www.ovirt.org/Install_nightly_snapshot [7] http://www.ovirt.org/Category:Feature [8] http://www.zdnet.com/article/how-much-longer-can-red-hats-ovirt-remain-cove… [9] https://fedoraproject.org/wiki/Artwork#Resources -- Sandro Bonazzola Better technology. Faster innovation. Powered by community collaboration. See how it works at redhat.com

1 0

[ANN] qemu-kvm-ev-2.3.0-29.1.el7 landing in nightly repos
by Sandro Bonazzola 08 Oct '15

08 Oct '15

Hi, qemu-kvm-ev-2.3.0-29.1.el7 <http://cbs.centos.org/koji/buildinfo?buildID=7003> is now landing in nightly static repos for 3.5.z, 3.6.z and master. Please report regressions if found. Thanks, -- Sandro Bonazzola Better technology. Faster innovation. Powered by community collaboration. See how it works at redhat.com

1 0

Reminder: ovirt-engine 3.6 branches
by Sandro Bonazzola 08 Oct '15

08 Oct '15

Hi, just a quick reminder that for 3.6.0 GA we branched ovirt-engine-3.6 to its own stabilization branch: ovirt-engine-3.6.0. patches landing in ovirt-engine-3.6.0 should have a Bug-Url pointing to an approved blocker (blocker+ flag set). any other patch landing to ovirt-engine-3.6 branch is going into 3.6.1. 31 Patches in origin/ovirt-engine-3.6 and not in origin/ovirt-engine-3.6.0 branch according to Change-Id 18745 patches on origin/ovirt-engine-3.6 18716 patches on origin/ovirt-engine-3.6.0 commit 4dc45fbab0fa10367dd00a34eb1e65654a389eec Author: Maor Lipchuk <mlipchuk(a)redhat.com> Date: Tue Oct 6 15:51:34 2015 +0300 core: Surround vds command with try catch. Change-Id: Ife176c6db31382053d6f96747b1bc6011a630582 commit 91136e2575a25d7d0e79035d188df855c40caefb Author: Martin Betak <mbetak(a)redhat.com> Date: Tue Sep 22 16:18:32 2015 +0200 core: Disable sound card for ppc64 Change-Id: I848686fb88e9a2128c9308546f1e26711b48654d commit e0073e5ccfa856d945065eea8a86f5e44e09b3e2 Author: Tomas Jelinek <tjelinek(a)redhat.com> Date: Tue Sep 15 14:38:04 2015 +0200 restapi: instance types need to have only the subset of template fields Change-Id: Ice3af5199d8f31aa175719743479c0aba89b4f2a commit 9073b79b1de0a5553451d6baff9050e2148dd8da Author: Marek Libra <mlibra(a)redhat.com> Date: Wed Sep 23 12:14:51 2015 +0200 core: The default display type conforms the architecture Change-Id: Idaa30b05447c426b8740c68306d8ecf2ac8e2ef9 commit eec6d3aea12991f85e7bc0ab4541fa190d9dafad Author: Greg Sheremeta <gshereme(a)redhat.com> Date: Tue Oct 6 22:00:05 2015 -0400 userportal, webadmin: fixed login form validation Change-Id: I5bf7a3ea682a8e769d84aa590820c441d4fa178f commit f602215408d84f34f0c2098fc36dd7c11bfc7f74 Author: pkliczewski <piotr.kliczewski(a)gmail.com> Date: Mon Sep 14 11:20:04 2015 +0200 jsonrpc: set the protocol as default Change-Id: I34dbd73ea5d79a002ac5714f41b910f7e171daf0 commit 1f412af6ffc8188401e6e0a765b89e1c54fdeb39 Author: Vojtech Szocs <vszocs(a)redhat.com> Date: Fri Sep 11 19:25:56 2015 +0200 webadmin,userportal: Contextual alert messages Change-Id: Ic0928ea873305bf7246f6b7c6ec255fa785ca1b3 commit 0d185838f9ee559136db8d70b1802351fe6c1de9 Author: Tomas Jelinek <tjelinek(a)redhat.com> Date: Thu Sep 10 14:13:20 2015 +0200 core: balloon always reset when editing VM from REST Change-Id: I16adef671bc77e26f56657add59621a1aa9b1c4a commit 3ed2096ff88d4426765bb9847cadc9cb0022bfcc Author: Tal Nisan <tnisan(a)redhat.com> Date: Mon Oct 5 23:12:07 2015 +0300 webadmin: Indent disk notes upon disk removal Change-Id: I38f0758e313aaeb01a2381ee5a6daa1efe96103f commit 55f04e8e3fcad4d67c2e1a436f0287b7befc7a97 Author: Daniel Erez <derez(a)redhat.com> Date: Sun Sep 20 13:29:13 2015 +0300 webadmin: disks main-tab - warning on live migrate disks Change-Id: I7726f9b5e3de80e08a1d65d8c04ab3b5260cd392 commit 9181a6caaf6d69ecfb95c00573db6485760700e9 Author: Alexander Wels <awels(a)redhat.com> Date: Wed Sep 23 11:30:39 2015 -0400 webadmin: new host provider error message Change-Id: Id39034fbed4753ed50a22fd1816af269a5f4729f commit c5eb91d30741d67dfa2eba25e80f99a9b4982c0f Author: Vojtech Szocs <vszocs(a)redhat.com> Date: Tue Sep 22 19:40:14 2015 +0200 webadmin,userportal: DOM flag to guard user interaction Change-Id: I214493322774cf7727433c3a63d6ebfa7d3177cc commit 2a34ce3dfbed6ea6c8c1884fd30d016cd77f31c1 Author: Fred Rolland <frolland(a)redhat.com> Date: Wed Sep 2 18:33:11 2015 +0300 engine: GetDeviceList without check status Change-Id: Ib4484307e3d4ac66a4370bcef3ac015ad0f2d084 commit 6b0f326486d51ec89cc562f5a3aab701483844f6 Author: Tal Nisan <tnisan(a)redhat.com> Date: Tue Oct 6 16:50:38 2015 +0300 webadmin: Fix "Activate disk" checkbox position on attach disks popup Change-Id: I160a1fd8192696c9849914fbd5609d61274605e1 commit fbe7cdee1eef94e7900bb4d01089788e468bfa5f Author: Tal Nisan <tnisan(a)redhat.com> Date: Mon Oct 5 23:12:28 2015 +0300 webadmin: Show correct error message on image export Change-Id: I9ba2a8a0b2f009ffb81671345e5b36275ce6e338 commit bbcad5b4d05911cb117f2f95460543d1502d3bf4 Author: Maor Lipchuk <mlipchuk(a)redhat.com> Date: Thu Oct 8 09:00:57 2015 +0300 core: Catch SC_NOT_FOUND status on cinder disk remove Change-Id: Id576359151e7e617d926e4d2dd83f32baa91625a commit b1271403683ad0e9410a92a28cc92267ad164c3b Author: Vojtech Szocs <vszocs(a)redhat.com> Date: Fri Sep 18 21:07:26 2015 +0200 webadmin,userportal: Fix IE image size quirk Change-Id: Ia17eb684cb08c0cb2cd610e38974bc9992e48285 commit 89a742a7ea0c177edb214e1a294af2c87c381306 Author: Moti Asayag <masayag(a)redhat.com> Date: Wed Oct 7 10:08:40 2015 +0300 webadmin: Prevent auto-refresh engine's errata Change-Id: I74d9ee14bc21c2b561ed651f7e5649b8c8ce9311 commit 0f82a8fe922494eba89dd5fa3ab66364100c4298 Author: Tomas Jelinek <tjelinek(a)redhat.com> Date: Thu Sep 10 14:15:41 2015 +0200 restapi: added memory_policy to tempalte and instance type Change-Id: Ia7f1f6950d1433a1634c27d4cd933c8734bcb504 commit 80eedd066465053f4dffe76bd94df01269b0a668 Author: Tal Nisan <tnisan(a)redhat.com> Date: Wed Oct 7 17:21:37 2015 +0300 webadmin: Fix scrolling in attach disk panel Change-Id: Iea9505bbe95b3f160fed4c554aa677717d4762ee commit ea9e3b54e640ff414484f7b01527bed6589ee7c7 Author: Greg Sheremeta <gshereme(a)redhat.com> Date: Tue Oct 6 22:31:44 2015 -0400 userportal, webadmin: fixed login form column widths Change-Id: I929f05509547e37fce5c99c4274f8577b390ec45 commit 60a9d21f087a34278e4854c2202f1b5594b2e994 Author: Martin Sivak <msivak(a)redhat.com> Date: Thu Sep 24 10:50:01 2015 +0200 Select the first CPU profile when multiple are available Change-Id: I462579ff12c8c4f97c72c08e12637cfedd766f10 commit fb3274f19a5471f5107ea87cc4116c6a86ba50cc Author: Sandro Bonazzola <sbonazzo(a)redhat.com> Date: Thu Sep 24 16:16:59 2015 +0200 build: post ovirt-engine-3.6.0 branching Change-Id: I68469dd773370cd390f126a2f009607abdbc9b36 commit 145854f99180990e89b6e22eb81fabea1f191806 Author: Tal Nisan <tnisan(a)redhat.com> Date: Tue Oct 6 19:59:33 2015 +0300 webadmin: Add tooltips to alias and source domain in move disk dialog Change-Id: Iabdd221d8f317f1e37a1c4cd836b9ac1722e9040 commit df5013900eb52fb055f08b0fa8975b7aa9479cea Author: Moti Asayag <masayag(a)redhat.com> Date: Tue Oct 6 10:17:59 2015 +0300 webadmin: Clarify host low free memory message Change-Id: Ia890a059116e9ebce6f33fe4e3ccda78211caea3 commit 7e06577b60cb4b99a8725a4437f6fa3e9a21a8eb Author: Greg Sheremeta <gshereme(a)redhat.com> Date: Tue Sep 29 21:39:13 2015 -0400 webadmin: set Firefox 38 as the supported browser. Change-Id: Ifea9d5b055a7a012672725cd6134ece85afe4fe5 commit 852d7d7656fb9b142abf0c18c25c07f267503188 Author: Ravi Nori <rnori(a)redhat.com> Date: Mon Sep 14 09:49:45 2015 -0400 engine : CoCo infrastructure should provide a timeout for each command Change-Id: I984f06d05f1ac43985cb9a8bda6dad7cfa5ed3ef commit cd437b56d75d7d57d9a7b2fe11590642f252641d Author: Ravi Nori <rnori(a)redhat.com> Date: Wed Sep 16 12:34:45 2015 -0400 engine, webadmin: Clear all option in RHEV admin portal does not clear any alerts Change-Id: If98e235beb4283da359782c79fc5e1598a9f0579 commit 40f887fb8c45faecb8d9e4cdbd25dd6e2b93d9dc Author: Marcin Mirecki <mmirecki(a)redhat.com> Date: Tue Jul 21 12:27:39 2015 +0200 core: Network utilisation is not shown for the VM Change-Id: I81100cc8369abe1ff8929478e1556c4e1ab81c2a commit ce9d968bcd4beddc96b50f251078ad9367c809ef Author: Fred Rolland <frolland(a)redhat.com> Date: Sun Sep 6 17:08:20 2015 +0300 engine: Add disk check specific LUN visibility Change-Id: I39d0267fffd7e96c0d5297ac4792f632201ecdf1 commit 61ac94c6dbc40ca2468ad48b76e41248610b359b Author: Jakub Niedermertl <jniederm(a)redhat.com> Date: Wed Sep 30 19:07:39 2015 +0200 webadmin: Re-selection of the same icon works in IE and Chrome Change-Id: I8455c45c5126409d37d3469d0b67a1c752c94f40 -- Sandro Bonazzola Better technology. Faster innovation. Powered by community collaboration. See how it works at redhat.com

1 0

VDSM (Python JSON) API
by Sandro Bonazzola 07 Oct '15

07 Oct '15

Hi, I'm looking at Bug 1228641 <https://bugzilla.redhat.com/show_bug.cgi?id=1228641> - [RFE] Switch from XML-RPC to JSON-RPC API and I'm searching google about "vdsm json rpc API documentation" without success. I've seen /usr/share/doc/vdsm-jsonrpc/vdsm-api.html shipped within vdsm-jsonrpc rpm but it doesn't explain how to use the api. /usr/lib/python2.7/site-packages/vdsmapi.py looks useless /usr/share/vdsm/rpc/ are not public API but something only vdsm process should use. The feature pages http://www.ovirt.org/Features/Design/JsonRpc3.5 and http://www.ovirt.org/Features/Design/JsonRpc are incomplete or outdated and miss proper testing section specifying how to test the API. VDSM API pages are outdated or incomplete: http://www.ovirt.org/Vdsm_API http://www.ovirt.org/VDSM_Stable_API_Plan http://www.ovirt.org/Vdsm_API_Schema Any hint on how to use VDSM JSON RPC API anywhere? Can someone please write a clear VDSM API reference documentation? Piotr, as a kickstart, can you give me a code sample for connecting to vdsm and call getVdsCaps using jsonrpc? Thanks, -- Sandro Bonazzola Better technology. Faster innovation. Powered by community collaboration. See how it works at redhat.com

3 7

Re: [ovirt-devel] ovirt-guest-agent behavior on disconnect
by Barak Azulay 07 Oct '15

07 Oct '15

Barak On Sep 30, 2015, at 10:04, Michal Skrivanek <michal.skrivanek(a)redhat.com> wrote: On Sep 25, 2015, at 19:40 , David Mansfield <ovirt(a)dm.cobite.com> wrote: [cross-posted to devel(a)ovirt.org and spice-devel(a)lists.freedesktop.org] Hi oVirt Devs, I'm here from the spice-devel list where we were discussing some changes to the behavior of the spice guest agent reacting to a user disconnect (of the spice console). Hi David, great, any enhancement is good! Vinzenz, please add more details to my guesses below:) Some information about how the ovirt-guest-agent works would be informative if you can spare a minute. The functionality being discussed is locking the user session in the VM when the user disconnects from spice (either intentionally or unintentionally). What OSs are we talking about (the behavior is significantly different and each pose different challenges. Also, peripherally, how does oVirt ensure secure access by authorized users of a VM and prevent "over-the-shoulder" snooping (spice graphics session stealing) or other forms of information leak from a VM shared by multiple users. We have several mechanisms to ensure that: 1 - ticketing system managed by the engine, so permissions are checked on the ovirt-engine, if a user has permissions to connect to the vm than the engines sends vdsm the ticket (and it sets the ticket to the spice server ... Through libvirt), and than the client receives this ticket to present to the spice server on connect (of course this ticket has time expiration) 2 - every time the client disconnects we receive an event and immediately send lock desktop command to the guest (through the ovirt-guest-agent). This is implemented both for win and Linux but for a Linux guest for that to work one must work on run level 5. 3 - anyway since this is racy , in order to avoid session theft we do not allow a second user to connect to a vm when the first user disconnected, the second user will be able to login only after the cm was rebooted. So here are some questions: Can a VM be "shared" by multiple users in oVirt at all? Are there known security issues that would make this a non-recommended or fundamentally un-securable setup? normally no, there is a semi-supported hook to allow that with VNC (and even that is slightly broken IIRC at the moment), but in general we do want so support that for specific usecases The question is not clear enough, In case you mean simultaneously (2 users) than the above answer is relevant. In case you mean sequential ... Than the answer is explained above , and yes we allow a vm to be shared among several users or groups. Does the oVirt agent lock the session on disconnect? Always / unconditionally? IIRC It will always try to lock, but we can not guarantee that the operation actually succeeded (long story ...) If it's configurable, where does the configuration reside - in the vm guest, on the vm host (/engine) or on the client? it's oVirt management UI configuration, it changes the host's behavior on spice disconnect per VM Does the oVirt agent lock all sessions or the current active session? just the active AFAIK On windows its implemented only for desktop OSs (... Xp ...win7 ...) we lock only the interactive session, for win server this is not supported , in fact we do not install the SSO mechanism at all because it works differently for those OSs (w2k3 , 2008, 2010) On Linux it's a bit more complicated , but we find the session of the user we know connected to the vm ... And send the lock command. As explained above since there is no guarantee for that to succeed than we do not allow other users to connect till the cm is rebooted. How does it lock the sessions? I've looked at the code and it appears '/usr/bin/loginctl lock-sessions' is being used on machines it's provided on and something more complicated on older boxes. Does the user have a way to customize this behavior? and if so, is it VM guest, VM host or client configuration? AFAIR this is not configurable ... But Vinzenz should be able to give an accurate answer Does the agent lock linux consoles (VC1, VC2) "sessions" (e.g. with vlock?) AFAIU no, Vinzenz ? As I understand it, console access in ovirt is managed by setting a temporary graphics password and then generating an .ini file which is launched by remote-viewer. This password expires after a short period of time. So is there a mechanism where access is denied if a user is already connected or is this allowed? The mechanism is explained above , it's the ticketing system (or temporary password as you referee to it above) t. The second user will not get a ticket from the ovirt-engine connection is not allowed unless "strict user checking" disabled in UI if it is disable or you use the same pwd then the previous session is terminated and replaced (unless using that hook I mentioned). But we try to treat the .vv file as a one time thing, there's delete_this_file=1 which instructs virt-viewer to remove the file upon startup, so even when browser place them on a shared drive they shouldn't be there for too long What kind of changes do you have in mind on the SPICE side? It would certainly make it easier for us as currently we kind of guess when to lockï¿½we receive multiple disconnecst(per channel) and don't really know what's going onï¿½having a direct support for this inside the spice server would be better. But it needs to allow the flexibility of different actions except desktop lock (we have "nothing", "shutdown", "logoff" I think). Perhaps a way how to signal relevant information to vdsm is enough Thanks, michal Enough questions for now, sorry for the battering. Feel free to ask ;-) -- Thanks, David Mansfield Cobite, INC. _______________________________________________ Devel mailing list Devel(a)ovirt.org http://lists.ovirt.org/mailman/listinfo/devel _______________________________________________ Devel mailing list Devel(a)ovirt.org http://lists.ovirt.org/mailman/listinfo/devel

3 3

[ACTION REQUIRED] vdsm versioning on master
by Sandro Bonazzola 07 Oct '15

07 Oct '15

Hi, I already asked 4 times in the last 4 weeks, please bump vdsm version on master to something higher than what we have in 3.6 branch. ovirt-hosted-engine-setup is requiring vdsm >= 4.17.8 which is satisfied in 3.6 branch and not on master, being master on 4.17.2. If no action will be taken, on Monday I'll pull VDSM from 3.6 to master snapshot to satisfy dependencies, meaning vdsm from master won't ever be installed on nightly master. Thanks, -- Sandro Bonazzola Better technology. Faster innovation. Powered by community collaboration. See how it works at redhat.com

2 2