Andrew Cathrow píše v Po 03. 09. 2012 v 17:21 -0400:
----- Original Message -----
> From: "Alon Bar-Lev" <alonbl(a)redhat.com>
> To: "Andrew Cathrow" <acathrow(a)redhat.com>
> Cc: engine-devel(a)ovirt.org, "Shireesh Anjal" <sanjal(a)redhat.com>,
"Mike Burns" <mburns(a)redhat.com>
> Sent: Monday, September 3, 2012 5:09:34 PM
> Subject: Re: [Engine-devel] Gluster IPTable configuration
> ----- Original Message -----
> > From: "Andrew Cathrow" <acathrow(a)redhat.com>
> > To: "Alon Bar-Lev" <alonbl(a)redhat.com>
> > Cc: engine-devel(a)ovirt.org, "Shireesh Anjal"
> > "Mike Burns" <mburns(a)redhat.com>
> > Sent: Monday, September 3, 2012 11:57:57 PM
> > Subject: Re: [Engine-devel] Gluster IPTable configuration
> > Right now we just overwrite the existing iptables configuration
> > with
> > our own, so if a user already added a rule to their host - eg. for
> > a
> > monitoring agent the we stomp over it.
> > Adding our rules as a custom chain means that we don't need to
> Here I lost you... :)
> I thought ovirt-engine is the master and ovirt-hypervisor is a slave.
> This derives that all management activities of slave is done by
Let's say I use nagios for my host monitoring.
I setup a rhel/fedora/*EL host using my standard corporate and include port 5667/5666 for
ovirt engine connects to it and blocks nagios.
While it would be great to have all firewall rules (and other settings) managed from
ovirt-engine we are a long way away from that.
Adding rules rather than overwriting iptables config would allow us not to stomp on the
user's existing settings.
This sounds like you want precise feature set of firewalld, just faster.
> There should be no setting at slave that master is not aware of.
> This also enables you to duplicate hipervisor, recover configuration
> or push mass configuration change.
> In your above case, this rule for monitoring agent may be added at
> master repository and pushed to slaves belongs to specific group,
> just like the gluster case.
yes, but in the 24 months between now and when we get to implement that feature ......
> The template mechanism is what enable you to create a custom
> configuration per environment.
> Using push and not re-integrate derives much simpler and
> deterministic implementation.
> But maybe I did not understand some of the fundamental concepts of
> the architecture.
Engine-devel mailing list
David Jaša, RHCE
SPICE QE based in Brno
GPG Key: 22C33E24
Fingerprint: 513A 060B D1B4 2A72 7F0D 0278 B125 CD00 22C3 3E24