libvirt can't start in a non-TLS environment after host install
Hi, I've experienced a problem with host deploy and oVirt master last week in an environment with TLS disabled. When I install/reinstall a 4.4 host, it removes the following options from /etc/libvirt/libvirtd.conf: ca_file="/etc/pki/vdsm/certs/cacert.pem" cert_file="/etc/pki/vdsm/certs/vdsmcert.pem" key_file="/etc/pki/vdsm/keys/vdsmkey.pem" As a result, libvirt refuses to start, complaining about missing certificates and keys in their default locations. Does anybody who uses a non-TLS environment experience the same problem? Can it be related to the fact that we require libvirtd-tls service from the split libvirtd services now? (Yes, I know TLS should always be used, but that is a shared development environment where TLS is disabled for whatever reason.) Thanks, Milan
Hi, On 3/24/20 10:28 AM, Milan Zamazal wrote:
Hi, I've experienced a problem with host deploy and oVirt master last week in an environment with TLS disabled. When I install/reinstall a 4.4 host, it removes the following options from /etc/libvirt/libvirtd.conf:
ca_file="/etc/pki/vdsm/certs/cacert.pem" cert_file="/etc/pki/vdsm/certs/vdsmcert.pem" key_file="/etc/pki/vdsm/keys/vdsmkey.pem"
As a result, libvirt refuses to start, complaining about missing certificates and keys in their default locations. And this is where things start to get blurry... Since you're trying out a non-TLS environment I guess that vdsm-tool added to 'libvirtd.conf':
auth_tcp: "none" listen_tcp: 1 listen_tls: 0 right? But supervdsmd's service definition still requires libvirtd-tls.socket and that might cause libvirtd to complain. Could you please try manually removing the libvirtd-tls.socket dependency, disabling this unit and see if libvirtd still complains?
Does anybody who uses a non-TLS environment experience the same problem? Can it be related to the fact that we require libvirtd-tls service from the split libvirtd services now?
(Yes, I know TLS should always be used, but that is a shared development environment where TLS is disabled for whatever reason.)
Thanks, Milan
Marcin Sobczyk <msobczyk@redhat.com> writes:
Hi,
On 3/24/20 10:28 AM, Milan Zamazal wrote:
Hi, I've experienced a problem with host deploy and oVirt master last week in an environment with TLS disabled. When I install/reinstall a 4.4 host, it removes the following options from /etc/libvirt/libvirtd.conf:
ca_file="/etc/pki/vdsm/certs/cacert.pem" cert_file="/etc/pki/vdsm/certs/vdsmcert.pem" key_file="/etc/pki/vdsm/keys/vdsmkey.pem"
As a result, libvirt refuses to start, complaining about missing certificates and keys in their default locations. And this is where things start to get blurry... Since you're trying out a non-TLS environment I guess that vdsm-tool added to 'libvirtd.conf':
auth_tcp: "none" listen_tcp: 1 listen_tls: 0
right?
Yes.
But supervdsmd's service definition still requires libvirtd-tls.socket and that might cause libvirtd to complain. Could you please try manually removing the libvirtd-tls.socket dependency, disabling this unit and see if libvirtd still complains?
If I disable the dependency, libvirt/Vdsm starts happily.
Does anybody who uses a non-TLS environment experience the same problem? Can it be related to the fact that we require libvirtd-tls service from the split libvirtd services now?
(Yes, I know TLS should always be used, but that is a shared development environment where TLS is disabled for whatever reason.)
Thanks, Milan
Hi, this issue should be fixed by: https://gerrit.ovirt.org/#/q/topic:remove-non-socket-activation-libvirt-supp...) if you could provide any feedback whether it works for you, that would be great. Thanks, Marcin On 3/24/20 2:34 PM, Milan Zamazal wrote:
Marcin Sobczyk <msobczyk@redhat.com> writes:
Hi,
On 3/24/20 10:28 AM, Milan Zamazal wrote:
Hi, I've experienced a problem with host deploy and oVirt master last week in an environment with TLS disabled. When I install/reinstall a 4.4 host, it removes the following options from /etc/libvirt/libvirtd.conf:
ca_file="/etc/pki/vdsm/certs/cacert.pem" cert_file="/etc/pki/vdsm/certs/vdsmcert.pem" key_file="/etc/pki/vdsm/keys/vdsmkey.pem"
As a result, libvirt refuses to start, complaining about missing certificates and keys in their default locations. And this is where things start to get blurry... Since you're trying out a non-TLS environment I guess that vdsm-tool added to 'libvirtd.conf':
auth_tcp: "none" listen_tcp: 1 listen_tls: 0
right? Yes.
But supervdsmd's service definition still requires libvirtd-tls.socket and that might cause libvirtd to complain. Could you please try manually removing the libvirtd-tls.socket dependency, disabling this unit and see if libvirtd still complains? If I disable the dependency, libvirt/Vdsm starts happily.
Does anybody who uses a non-TLS environment experience the same problem? Can it be related to the fact that we require libvirtd-tls service from the split libvirtd services now?
(Yes, I know TLS should always be used, but that is a shared development environment where TLS is disabled for whatever reason.)
Thanks, Milan
On Tue, Mar 24, 2020 at 11:29 AM Milan Zamazal <mzamazal@redhat.com> wrote:
Hi, I've experienced a problem with host deploy and oVirt master last week in an environment with TLS disabled. When I install/reinstall a 4.4 host, it removes the following options from /etc/libvirt/libvirtd.conf:
ca_file="/etc/pki/vdsm/certs/cacert.pem" cert_file="/etc/pki/vdsm/certs/vdsmcert.pem" key_file="/etc/pki/vdsm/keys/vdsmkey.pem"
As a result, libvirt refuses to start, complaining about missing certificates and keys in their default locations.
Does anybody who uses a non-TLS environment experience the same problem? Can it be related to the fact that we require libvirtd-tls service from the split libvirtd services now?
(Yes, I know TLS should always be used, but that is a shared development environment where TLS is disabled for whatever reason.)
TLS-less setup is not supported and likely to break. I would not spend too much time on trying to fix it.
On 24 Mar 2020, at 13:47, Nir Soffer <nsoffer@redhat.com> wrote:
On Tue, Mar 24, 2020 at 11:29 AM Milan Zamazal <mzamazal@redhat.com> wrote:
Hi, I've experienced a problem with host deploy and oVirt master last week in an environment with TLS disabled. When I install/reinstall a 4.4 host, it removes the following options from /etc/libvirt/libvirtd.conf:
ca_file="/etc/pki/vdsm/certs/cacert.pem" cert_file="/etc/pki/vdsm/certs/vdsmcert.pem" key_file="/etc/pki/vdsm/keys/vdsmkey.pem"
As a result, libvirt refuses to start, complaining about missing certificates and keys in their default locations.
Does anybody who uses a non-TLS environment experience the same problem? Can it be related to the fact that we require libvirtd-tls service from the split libvirtd services now?
(Yes, I know TLS should always be used, but that is a shared development environment where TLS is disabled for whatever reason.)
TLS-less setup is not supported and likely to break. I would not spend too much time on trying to fix it.
It’s a debugging-friendly environment. If you ever tried to “deploy” all teh certificates to the right places manually…. of course it’s not supported
_______________________________________________ Devel mailing list -- devel@ovirt.org To unsubscribe send an email to devel-leave@ovirt.org Privacy Statement: https://www.ovirt.org/privacy-policy.html oVirt Code of Conduct: https://www.ovirt.org/community/about/community-guidelines/ List Archives: https://lists.ovirt.org/archives/list/devel@ovirt.org/message/QK6Y6TNSIKJSMJ...
participants (4)
-
Marcin Sobczyk -
Michal Skrivanek -
Milan Zamazal -
Nir Soffer