Hi, I've experienced a problem with host deploy and oVirt master last week in an environment with TLS disabled. When I install/reinstall a 4.4 host, it removes the following options from /etc/libvirt/libvirtd.conf: ca_file="/etc/pki/vdsm/certs/cacert.pem" cert_file="/etc/pki/vdsm/certs/vdsmcert.pem" key_file="/etc/pki/vdsm/keys/vdsmkey.pem" As a result, libvirt refuses to start, complaining about missing certificates and keys in their default locations.

Does anybody who uses a non-TLS environment experience the same problem? Can it be related to the fact that we require libvirtd-tls service from the split libvirtd services now? (Yes, I know TLS should always be used, but that is a shared development environment where TLS is disabled for whatever reason.) Thanks, Milan

Marcin Sobczyk <msobczyk(a)redhat.com&gt; writes: > Hi, > > On 3/24/20 10:28 AM, Milan Zamazal wrote: >> Hi, I've experienced a problem with host deploy and oVirt master last >> week in an environment with TLS disabled. When I install/reinstall a >> 4.4 host, it removes the following options from >> /etc/libvirt/libvirtd.conf: >> >> ca_file="/etc/pki/vdsm/certs/cacert.pem" >> cert_file="/etc/pki/vdsm/certs/vdsmcert.pem" >> key_file="/etc/pki/vdsm/keys/vdsmkey.pem" >> >> As a result, libvirt refuses to start, complaining about missing >> certificates and keys in their default locations. > And this is where things start to get blurry... > Since you're trying out a non-TLS environment I guess that vdsm-tool > added to 'libvirtd.conf': > > auth_tcp: "none" > listen_tcp: 1 > listen_tls: 0 > > right? Yes. > But supervdsmd's service definition still requires libvirtd-tls.socket > and that might cause libvirtd to complain. > Could you please try manually removing the libvirtd-tls.socket > dependency, disabling this unit and see if libvirtd still complains? If I disable the dependency, libvirt/Vdsm starts happily. >> Does anybody who uses a non-TLS environment experience the same problem? >> Can it be related to the fact that we require libvirtd-tls service from >> the split libvirtd services now? >> >> (Yes, I know TLS should always be used, but that is a shared development >> environment where TLS is disabled for whatever reason.) >> >> Thanks, >> Milan >>

On 24 Mar 2020, at 13:47, Nir Soffer <nsoffer(a)redhat.com&gt; wrote: On Tue, Mar 24, 2020 at 11:29 AM Milan Zamazal <mzamazal(a)redhat.com&gt; wrote: > > Hi, I've experienced a problem with host deploy and oVirt master last > week in an environment with TLS disabled. When I install/reinstall a > 4.4 host, it removes the following options from > /etc/libvirt/libvirtd.conf: > > ca_file="/etc/pki/vdsm/certs/cacert.pem" > cert_file="/etc/pki/vdsm/certs/vdsmcert.pem" > key_file="/etc/pki/vdsm/keys/vdsmkey.pem" > > As a result, libvirt refuses to start, complaining about missing > certificates and keys in their default locations. > > Does anybody who uses a non-TLS environment experience the same problem? > Can it be related to the fact that we require libvirtd-tls service from > the split libvirtd services now? > > (Yes, I know TLS should always be used, but that is a shared development > environment where TLS is disabled for whatever reason.) TLS-less setup is not supported and likely to break. I would not spend too much time on trying to fix it.

_______________________________________________ Devel mailing list -- devel(a)ovirt.org To unsubscribe send an email to devel-leave(a)ovirt.org Privacy Statement: https://www.ovirt.org/privacy-policy.html oVirt Code of Conduct: https://www.ovirt.org/community/about/community-guidelines/ List Archives: https://lists.ovirt.org/archives/list/devel@ovirt.org/message/QK6Y6TNSIKJ...