March 2022 - Users - oVirt List Archives

ovirt-engine manager, certificate issue
by david 02 Aug '22

02 Aug '22

hello I have a problem to log in to ovirt-engine manager in my browser the warning message in the browser display me this text: PKIX path validation failed: java.security.cert.CertPathValidatorException: validity check failed to solve this problem I am offered to run engine-setup and here is a question: the engine-setup will have no impact to the hosts(hypervisors) working? ovirt version 4.4.4.7-1.el8 thanks

7 7

Problems with selinux after updating an ovirt node
by Giorgio Biacchi 06 Jul '22

06 Jul '22

Hi folks, today I got a problem with vdsm and selinux after updating a host: [root@host04 ~]# nodectl check Status: WARN Bootloader ... OK Layer boot entries ... OK Valid boot entries ... OK Mount points ... OK Separate /var ... OK Discard is used ... OK Basic storage ... OK Initialized VG ... OK Initialized Thin Pool ... OK Initialized LVs ... OK Thin storage ... OK Checking available space in thinpool ... OK Checking thinpool auto-extend ... OK vdsmd ... BAD So I run: [root@host04 ~]# /usr/libexec/vdsm/vdsmd_init_common.sh --pre-start vdsm: Running mkdirs vdsm: Running configure_vdsm_logs vdsm: Running run_init_hooks vdsm: Running check_is_configured lvm is configured for vdsm Current revision of multipath.conf detected, preserving Managed volume database is already configured abrt is already configured for vdsm libvirt is already configured for vdsm sanlock is configured for vdsm Modules sebool are not configured Error: One of the modules is not configured to work with VDSM. To configure the module use the following: 'vdsm-tool configure [--module module-name]'. If all modules are not configured try to use: 'vdsm-tool configure --force' (The force flag will stop the module's service and start it afterwards automatically to load the new configuration.) vdsm: stopped during execute check_is_configured task (task returned with error code 1). But also runnining this gave me an error: [root@host04 ~]# vdsm-tool configure --module sebool Checking configuration status... Running configure... libsepol.context_from_record: type cloud_what_var_cache_t is not defined libsepol.context_from_record: could not create context structure libsepol.context_from_string: could not create context structure libsepol.sepol_context_to_sid: could not convert system_u:object_r:cloud_what_var_cache_t:s0 to sid invalid context system_u:object_r:cloud_what_var_cache_t:s0 libsemanage.semanage_validate_and_compile_fcontexts: setfiles returned error code 255. Traceback (most recent call last): File "/usr/bin/vdsm-tool", line 209, in main return tool_command[cmd]["command"](*args) File "/usr/lib/python3.6/site-packages/vdsm/tool/__init__.py", line 40, in wrapper func(*args, **kwargs) File "/usr/lib/python3.6/site-packages/vdsm/tool/configurator.py", line 145, in configure _configure(c) File "/usr/lib/python3.6/site-packages/vdsm/tool/configurator.py", line 92, in _configure getattr(module, 'configure', lambda: None)() File "/usr/lib/python3.6/site-packages/vdsm/tool/configurators/sebool.py", line 88, in configure _setup_booleans(True) File "/usr/lib/python3.6/site-packages/vdsm/tool/configurators/sebool.py", line 60, in _setup_booleans sebool_obj.finish() File "/usr/lib/python3.6/site-packages/seobject.py", line 340, in finish self.commit() File "/usr/lib/python3.6/site-packages/seobject.py", line 330, in commit rc = semanage_commit(self.sh) OSError: [Errno 0] Error I managed to solve this by running: [root@host04 ~]# semodule -i /usr/share/selinux/packages/ovirt-vmconsole/ovirt_vmconsole.pp [root@host04 ~]# vdsm-tool configure --module sebool Checking configuration status... Running configure... Done configuring modules to VDSM. Regards -- gb PGP Key: http://pgp.mit.edu/ Primary key fingerprint: C510 0765 943E EBED A4F2 69D3 16CC DC90 B9CB 0F34

3 3

Unable to install on a bonded NIC
by weeglos＠yahoo.com 05 Jul '22

05 Jul '22

So I'm running a fresh install of oVirt on a new Centos Stream node. Fresh install. I installed the OS with bonded interfaces. I bonded them during the install via anaconda. I followed the doc here: https://ovirt.org/documentation/installing_ovirt_as_a_self-hosted_engine_us… When I got to the hosted-engine --deploy step, it errored out saying, "Only Team devices are present. Teaming is unsupported." However, I'm not teaming my network adapters at all. I'm bonding them: [root@mustafar ~]# cat /etc/sysconfig/network-scripts/ifcfg-Bond_connection_1 BONDING_OPTS="mode=balance-rr downdelay=0 miimon=1 updelay=0" TYPE=Bond BONDING_MASTER=yes PROXY_METHOD=none BROWSER_ONLY=no BOOTPROTO=none DEFROUTE=yes IPV4_FAILURE_FATAL=no IPV6INIT=yes IPV6_AUTOCONF=yes IPV6_DEFROUTE=yes IPV6_FAILURE_FATAL=no IPV6_ADDR_GEN_MODE=stable-privacy NAME="Bond connection 1" UUID=[redacted] DEVICE=bond0 ONBOOT=yes IPADDR=192.168.5.83 PREFIX=24 GATEWAY=192.168.5.1 DNS1=192.168.5.2 DNS2=192.168.5.3 DNS3=192.168.5.4 DOMAIN=[redacted] [root@mustafar ~]# What gives with this?

8 11

VM hangs after migration
by Giorgio Biacchi 26 Jun '22

26 Jun '22

Hi, I have a fresh Ovirt installation (4.4.10.7-1.el8 engine and oVirt Node 4.4.10) on a Dell VRTX chassis. There are 3 blades, two of them are identical hardware (PowerEdge M630) and the third is a little newer (PowerEdge M640). The third has different CPUs, more RAM, and slower NICs. I also have a bunch of data domains some on the shared PERC internal storage and others on an external iSCSI storage, all seems configured correctly and all the hosts are operational. I can migrate a VM back and forth from the first two blades without any problem, I can migrate a VM to the third blade but when I migrate a VM from the third blade to any of the other two the task terminate successfully, the VM is marked as up on the target host but the VM hangs, the console is frozen and the VM stops to respond to ping. I have no clues about why this is happening and I'm looking for suggestions about how to debug and hopefully fix this issue. Thanks in advance -- gb PGP Key: http://pgp.mit.edu/ Primary key fingerprint: C510 0765 943E EBED A4F2 69D3 16CC DC90 B9CB 0F34

3 2

API how to increase extend resize disk VM
by ovirt.org＠nevim.eu 25 Jun '22

25 Jun '22

Hello, please how to increase extend resize disk of VM? I can working with ansible or REST API. Ansible working is here, but i not found manual for update size: https://docs.ansible.com/ansible/2.3/ovirt_disks_module.html On official ovirt documentation i cant found how to update. I found only old manual in KB page, but not working on lastest: https://www.ovirt.org/develop/release-management/features/storage/online-vi… PUT /api/vms/{VM_ID}/disks/{DISK_ID} HTTP/1.1 Accept: application/xml Content-type: application/xml <disk> <size>{NEW_SIZE_IN_BYTES}</size> </disk> Thanks for advice.

5 13

Cannot log into oVirt Manager - certificate issue
by Diggy Mc 18 Jun '22

18 Jun '22

I cannot log into oVirt Manager. My browser gave me a warning that the site's certificate has expired. Then when I try to log in, I receive the following error message: "PKIX path validation failed: java.security.cert.CertPathValidatorException: validity check failed" How can I fix this problem? In advance, thank you for your help. hosted-engine: v4.4.8.6 hosts: oVirt Node v4.4.8.3

7 24

can't use vmconsole anymore
by Nathanaël Blanchet 13 Jun '22

13 Jun '22

Hi, I was used to use the vmconsole proxy, but since a while, I'm getting this issue (currently 4.4.5): # ssh -t -p 2222 ovirt-vmconsole(a)air.v100.abes.fr connect ovirt-vmconsole(a)air.v100.abes.fr: Permission denied (publickey). I found following in the engine.log 2021-04-15 17:55:43,094+02 ERROR [org.ovirt.engine.core.services.VMConsoleProxyServlet] (default task-4) [] Error validating ticket: : sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target at java.base/sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141) at java.base/sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:126) at java.base/java.security.cert.CertPathBuilder.build(CertPathBuilder.java:297) at org.ovirt.engine.core.uutils//org.ovirt.engine.core.uutils.crypto.CertificateChain.buildCertPath(CertificateChain.java:128) at org.ovirt.engine.core.uutils//org.ovirt.engine.core.uutils.crypto.ticket.TicketDecoder.decode(TicketDecoder.java:89) at deployment.engine.ear.services.war//org.ovirt.engine.core.services.VMConsoleProxyServlet.validateTicket(VMConsoleProxyServlet.java:175) at deployment.engine.ear.services.war//org.ovirt.engine.core.services.VMConsoleProxyServlet.doPost(VMConsoleProxyServlet.java:225) The user key is the good one, I use the same with my other engines and I can successfully connect to vm consoles. Thank you for helping -- Nathanaël Blanchet Supervision réseau SIRE 227 avenue Professeur-Jean-Louis-Viala 34193 MONTPELLIER CEDEX 5 Tél. 33 (0)4 67 54 84 55 Fax 33 (0)4 67 54 84 14 blanchet(a)abes.fr

5 16

looking for some ISV backup software which integrates the backup API
by Nathanaël Blanchet 08 Jun '22

08 Jun '22

Hello, We are about to change our backup provider, and I find it is a great chance to choose a full supported ovirt backup solution. I currently use this python script vm-backup-scheduler (https://github.com/wefixit-AT/oVirtBackup) but it is not the workflow officially suggested by the community (https://www.ovirt.org/develop/release-management/features/storage/backup-re…) I've been looking for a long time an ISV who supports such an API, but the only one I found is this one : Acronis Backup Advanced suggested here https://access.redhat.com/ecosystem/search/#/ecosystem/Red%20Hat%20Enterpri… I ran the trial version, but it doesn't seem to do better than the vm-backup-scheduler script, and it doesn't seem to use the backup API (attach a clone as a disk to an existing vm). Can you suggest me some other ISV solutions, if they ever exist... or share me your backup experience?

5 4

VM HostedEngine is down with error
by souvaliotimaria＠mail.com 26 May '22

26 May '22

Hello everyone, I have a replica 2 + arbiter installation and this morning the Hosted Engine gave the following error on the UI and resumed on a different node (node3) than the one it was originally running(node1). (The original node has more memory than the one it ended up, but it had a better memory usage percentage at the time). Also, the only way I discovered the migration had happened and there was an Error in Events, was because I logged in the web interface of ovirt for a routine inspection. Βesides that, everything was working properly and still is. The error that popped is the following: VM HostedEngine is down with error. Exit message: internal error: qemu unexpectedly closed the monitor: 2020-09-01T06:49:20.749126Z qemu-kvm: warning: All CPU(s) up to maxcpus should be described in NUMA config, ability to start up with partial NUMA mappings is obsoleted and will be removed in future 2020-09-01T06:49:20.927274Z qemu-kvm: -device virtio-blk-pci,iothread=iothread1,scsi=off,bus=pci.0,addr=0x7,drive=drive-ua-d5de54b6-9f8e-4fba-819b-ebf6780757d2,id=ua-d5de54b6-9f8e-4fba-819b-ebf6780757d2,bootindex=1,write-cache=on: Failed to get "write" lock Is another process using the image?. Which from what I could gather concerns the following snippet from the HostedEngine.xml and it's the virtio disk of the Hosted Engine: <disk type='file' device='disk' snapshot='no'> <driver name='qemu' type='raw' cache='none' error_policy='stop' io='threads' iothread='1'/> <source file='/var/run/vdsm/storage/80f6e393-9718-4738-a14a-64cf43c3d8c2/d5de54b6-9f8e-4fba-819b-ebf6780757d2/a48555f4-be23-4467-8a54-400ae7baf9d7'> <seclabel model='dac' relabel='no'/> </source> <target dev='vda' bus='virtio'/> <serial>d5de54b6-9f8e-4fba-819b-ebf6780757d2</serial> <alias name='ua-d5de54b6-9f8e-4fba-819b-ebf6780757d2'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x07' function='0x0'/> </disk> I've tried looking into the logs and the sar command but I couldn't find anything to relate with the above errors and determining the reason for it to happen. Is this a Gluster or a QEMU problem? The Hosted Engine was manually migrated five days before on node1. Is there a standard practice I could follow to determine what happened and secure my system? Thank you very much for your time, Maria Souvalioti

4 6

LACP across multiple switches
by Jorge Visentini 25 May '22

25 May '22

Hi all. Is it possible to configure oVirt for work with two NICs in bond/LACP across two switches, according to the image below? [image: LACP_Across_Two_Switchs.png] Thank you all. You guys do a wonderful job. -- Att, Jorge Visentini +55 55 98432-9868

5 5

OVS switch type for hosted-engine
by Devin A. Bougie 06 May '22

06 May '22

Is it possible to setup a hosted engine using the OVS switch type instead of Legacy? If it's not possible to start out as OVS, instructions for switching from Legacy to OVS after the fact would be greatly appreciated. Many thanks, Devin

4 5

Zanata user request
by Temuri Doghonadze 27 Apr '22

27 Apr '22

Hello, My name is Temuri and I'd like to ask for account for Zanata to help with translation of ovirt to Georgian. I've done translation of zoiper, FreeCAD, part of gitlab, protonmail, parts of gnome and KDE, etc etc etc. In case of questions feel free to ask. BR, Temuri

4 12

USB3 redirection
by Rik Theys 19 Apr '22

19 Apr '22

Hi, I'm trying to assign a USB3 controller to a CentOS 7.4 VM in oVirt 4.1 with USB redirection enabled. I've created the following file in /etc/ovirt-engine/osinfo.conf.d: 01-usb.properties with content os.other.devices.usb.controller.value = nec-xhci and have restarted ovirt-engine. If I disable USB-support in the web interface for the VM, the xhci controller is added to the VM (I can see it in the qemu-kvm commandline), but usb redirection is not available. If I enable USB-support in the UI, no xhci controller is added (only 4 uhci controllers). Is there a way to make the controllers for usb redirection xhci controllers? Regards, Rik -- Rik Theys System Engineer KU Leuven - Dept. Elektrotechniek (ESAT) Kasteelpark Arenberg 10 bus 2440 - B-3001 Leuven-Heverlee +32(0)16/32.11.07 ---------------------------------------------------------------- <<Any errors in spelling, tact or fact are transmission errors>>

3 5

OVN routing and firewalling in oVirt
by Gianluca Cecchi 19 Apr '22

19 Apr '22

Hello, how do we manage routing between different OVN networks in oVirt? And between OVN networks and physical ones? Based on architecture read here: http://openvswitch.org/support/dist-docs/ovn-architecture.7.html I see terms for logical routers and gateway routers respectively but how to apply to oVirt configuration? Do I have to choose between setting up a specialized VM or a physical one: is it applicable/advisable to put on oVirt host itself the gateway functionality? Is there any security policy (like security groups in Openstack) to implement? Thanks, Gianluca

4 6

VM failed to start when host's network is down
by lizhijian＠fujitsu.com 08 Apr '22

08 Apr '22

Post again after subscribing the mail list. Hi guys I have an all in one ovirt environment which node installed both vdsm and ovirt-engine. I have setup the ovirt environment and it could work well. For some reasons, i have to use this ovirt with node's networking down(i unplugged the network cable) In such case, I noticed that i cannot start a VM anymore. I wonder if there is a configuration switch to enable a ovirt to work with node's networking down ? if not, may i possible to make it work by a easy way ? When i tried to start VM with ovirt API, it responses with: ```bash [root@74d2ab9cb0 ~]# sh start.sh <?xml version="1.0" encoding="UTF-8" standalone="yes"?> <action> <async>false</async> <fault> <detail>[Cannot run VM. Unknown Data Center status.]</detail> <reason>Operation Failed</reason> </fault> <status>failed</status> </action> [root@74d2ab9cb0 ~]# sh start.sh <?xml version="1.0" encoding="UTF-8" standalone="yes"?> <action> <async>false</async> <fault> <detail>[Cannot run VM. Unknown Data Center status.]</detail> <reason>Operation Failed</reason> </fault> <status>failed</status> </action> [root@74d2ab9cb0 ~]# ``` Attached the vdsm and ovirt-engine Thanks Zhijian

2 1

Wait for the engine to come up on the target vm
by Vladimir Belov 08 Apr '22

08 Apr '22

I'm trying to deploy oVirt from a self-hosted engine, but at the last step I get an engine startup error. [ INFO ] TASK [Wait for the engine to come up on the target VM] [ ERROR ] fatal: [localhost]: FAILED! => {"attempts": 120, "changed": true, "cmd": ["hosted-engine", "--vm-status", "--json"], "delta": "0:00:00.181846", "end": "2022-03-28 15:41:28.853150", "rc": 0, "start": "2022-03-28 15:41:28.671304", "stderr": "", "stderr_lines": [], "stdout": "{\"1\": {\"conf_on_shared_storage\": true, \"live-data\": true, \"extra\": \"metadata_parse_version=1\\nmetadata_feature_version=1\\ntimestamp=5537 (Mon Mar 28 15:41:20 2022)\\nhost-id=1\\nscore=3400\\nvm_conf_refresh_time=5537 (Mon Mar 28 15:41:20 2022)\\nconf_on_shared_storage=True\\nmaintenance=False\\nstate=EngineStarting\\nstopped=False\\n\", \"hostname\": \"v2.test.ru\", \"host-id\": 1, \"engine-status\": {\"reason\": \"failed liveliness check\", \"health\": \"bad\", \"vm\": \"up\", \"detail\": \"Up\"}, \"score\": 3400, \"stopped\": false, \"maintenance\": false, \"crc32\": \"4d2eeaea\", \"local_conf_timestamp\": 5537, \"host-ts\": 5537}, \"global_maintenance\": false}", "stdout_lines": ["{\"1\": {\"conf_on_shared_storage\": true, \"live-data\": true, \"extra\": \"metadata_parse_version=1\\nmetadata_feature_version=1\\ntimestamp=5537 (Mon Mar 28 15:41:20 2022)\\nhost-id=1\\nscore=3400\\nvm_conf_refresh_time=5537 (Mon Mar 28 15:41:20 2022)\\nconf_on_shared_storage=True\\nmaintenance=False\\nstate=EngineStarting\\nstopped=False\\n\", \"hostname\": \"v2.test.ru\", \"host-id\": 1, \"engine-status\": {\"reason\": \"failed liveliness check\", \"health\": \"bad\", \"vm\": \"up\", \"detail\": \"Up\"}, \"score\": 3400, \"stopped\": false, \"maintenance\": false, \"crc32\": \"4d2eeaea\", \"local_conf_timestamp\": 5537, \"host-ts\": 5537}, \"global_maintenance\": false}"]} Аfter the installation is completed, the condition of the engine is as follows: Engine status: {"reason": "failed liveliness check", "health": "bad", "vm": "up", "detail": "Up"} After reading the vdsm.logs, I found that qemu-guest-agent failed to connect to the engine for some reason. Traceback (most recent call last): File "/usr/lib/python2.7/site-packages/vdsm/virt/vm.py", line 5400, in qemuGuestAgentShutdown self._dom.shutdownFlags(libvirt.VIR_DOMAIN_SHUTDOWN_GUEST_AGENT) File "/usr/lib/python2.7/site-packages/vdsm/virt/virdomain.py", line 98, in f ret = attr(*args, **kwargs) File "/usr/lib/python2.7/site-packages/vdsm/common/libvirtconnection.py", line 130, in wrapper ret = f(*args, **kwargs) File "/usr/lib/python2.7/site-packages/vdsm/common/function.py", line 92, in wrapper return func(inst, *args, **kwargs) File "/usr/lib64/python2.7/site-packages/libvirt.py", line 2517, in shutdownFlags if ret == -1: raise libvirtError ('virDomainShutdownFlags() failed', dom=self) libvirtError: Guest agent is not responding: QEMU guest agent is not connected During the installation phase, qemu-guest-agent on the guest VM is running. Setting a temporary password (hosted-engine --add-console-password --password) and connecting via VNC also failed. Using "hosted-engine --console" also failed to connect The engine VM is running on this host Connected to HostedEngine domain Escaping character: ^] error: internal error: character device <null> not found The network settings are configured using static addressing, without DHCP. It seems to me that this is due to the fact that the engine receives an IP address that does not match the entry in /etc/hosts, but I do not know how to fix it. Any help is welcome, I will provide the necessary logs. Thanks

3 2

Gluster storage and TRIM VDO
by Oleh Horbachov 08 Apr '22

08 Apr '22

Hello everyone. I have a Gluster distributed replication cluster deployed. The cluster - store for ovirt. For bricks - VDO over a raw disk. When discarding via 'fstrim -av' the storage hangs for a few seconds and the connection is lost. Does anyone know the best practices for using TRIM with VDO in the context of ovirt? ovirt - v4.4.10 gluster - v8.6

2 3

Mac addresses pool issues
by Nicolas MAIRE 08 Apr '22

08 Apr '22

Hi, We're encountering some issues on one of our production clusters running oVirt 4.2. We've had an incident with the engine's database a few weeks back that we were able to recover from, however since then we've been having a bunch of weird issues, mostly around MACs. It started off with the engine being unable to find a free MAC when creating a VM, despite there being significantly less virtual interfaces (around 250) than the total number of MACs in the default pool (default configuration, so 65536 addresses) and escalated into creating duplicate MACs (despite the pool not allowing it) and now we can't even modify the pool or remove VMs (since deleting the attached vnics fail), so we're kinda stuck with a cluster that has running VMs which are fine as long as we don't touch them, but on which we can't create new VMs (or modify the existing ones). In the engine's log we can see that we've had an "Unable to initialize MAC pool due to existing duplicates (Failed with error MAC_POOL_INITIALIZATION_FAILED and code 5010)" error when we tried to reconfigure the pool this morning (see the full error stack here : https://pastebin.com/6bKMfbLn) and now whenever we try to delete a VM or reconfigure the pool we have a 'Pool for id="58ca604b-017d-0374-0220-00000000014e" does not exist' error (see the full error stack here: https://pastebin.com/Huy91iig) but, if we check the engine's mac_pool table we can see that it's there : engine=# select * from mac_pools; id | name | description | allow_duplicate_mac_addresses | default_pool --------------------------------------+---------+------------------+-------------------------------+-------------- 58ca604b-017d-0374-0220-00000000014e | Default | Default MAC pool | f | t (1 row) engine=# select * from mac_pool_ranges; mac_pool_id | from_mac | to_mac --------------------------------------+-------------------+------------------- 58ca604b-017d-0374-0220-00000000014e | 56:6f:1a:1a:00:00 | 56:6f:1a:1a:ff:ff (1 row) I found this bugzilla that seems to somehow apply https://bugzilla.redhat.com/show_bug.cgi?id=1554180 however I don't really know how to "reinitialize engine", especially considering that the mac pool was not configured to allow duplicate macs to begin with, and I've no idea what the impact of that reinitialization would be on the current VMs. I'm quite new to oVirt (only been using it for one year) so any help would be greatly appreciated.

3 2

Enroll Host Certificate
by dlotarev＠yahoo.com 05 Apr '22

05 Apr '22

Hi there! I have a problem to enroll host certificate. The steps that I took: 1) Move host to maintenance mode (all VMs transferred to another host including HE VM) 2) Enroll certificate via web interface without errors 3) Exit from maintenance mode (transferred all VMs back including HE VM) 4) Restart ovirt-engine service But my problem that after 6 hours i get message from oVirt engine notifier that my certificate expired soon. I know that my oVirt installation is old (4.1.9), but what can i do with that? Maybe i missed something. I didn't reboot the host after renewing the certificate Thank you for any advice!

4 5

Python Unsupported Version Detection (ovirt Manager 4.4.10)
by michael.li＠hactlsolutions.com 04 Apr '22

04 Apr '22

Hi, We have installed oVirt manger in Centos stream 8 and running the security scanning by Tenable Nessus ID 148367 When I try to remove the python3.6. It will remove many dependency package related ovirt. How can I fixed this vulnerability as below? Python Unsupported Version Detection Plugin Output: The following Python installation is unsupported : Path : / Port : 35357 Installed version : 3.6.8 Latest version : 3.10 Support dates : 2021-12-23 (end of life) Regards, Michael Li

3 2

Network filters in oVirt : zero-trust, IP and port filtering
by ravi k 01 Apr '22

01 Apr '22

Good people of the community, Hope you are all doing well. We are exploring the network filters in oVirt to check if we can implement a zero-trust model at the network level. The intention is to have a filter which takes two parameters, IP and PORT. After that there will be a 'deny all' rule. We realized that none of the default network filters offer such a functionality and the only option is to write a custom filter. Why don't we have such a filter in libvirt and thereby in oVirt? Someone would've already thought about such a use case. So I was thinking maybe network filters aren't meant to be used for implementing such functionalities like zero-trust? Also what are some practical use cases of the default filters that are provided? I was able to understand and use the clean-traffic and clean-traffic-gateway. Regards, ravi

2 4

info about removal of LVM structures before removing LUNs
by Gianluca Cecchi 31 Mar '22

31 Mar '22

Hello, I'm going to hot remove some LUNS that were used as storage domains from a 4.4.7 environment. I have already removed them for oVirt. I think I would use the remove_mpath_device.yml playbook if I find it... it seems it should be in examples dir inside ovirt ansible collections, but there is not... Anyway I'm aware of the corresponding manual steps of (I think version 8 doesn't differ from 7 in this): . get disks name comprising the multipath device to remove . remove multipath device multipath -f "{{ lun }}" . flush I/O blockdev --flushbufs {{ item }} for every disk that was comprised in the multipath device . remove disks echo 1 > /sys/block/{{ item }}/device/delete for every disk that was comprised in the multipath device My main doubt is related to the LVM structure that I can see is yet present on the multipath devices. Eg for a multipath device 360002ac0000000000000013e0001894c: # pvs --config 'devices { filter = ["a|.*|" ] }' | grep 360002ac0000000000000013e0001894c /dev/mapper/360002ac0000000000000013e0001894c a7f5cf77-5640-4d2d-8f6d-abf663431d01 lvm2 a-- <4.00t <675.88g # lvs --config 'devices { filter = ["a|.*|" ] }' a7f5cf77-5640-4d2d-8f6d-abf663431d01 LV VG Attr LSize Pool Origin Data% Meta% Move Log Cpy%Sync Convert 067dd3d0-db3b-4fd0-9130-c616c699dbb4 a7f5cf77-5640-4d2d-8f6d-abf663431d01 -wi------- 900.00g 1682612b-fcbb-4226-a821-3d90621c0dc3 a7f5cf77-5640-4d2d-8f6d-abf663431d01 -wi------- 55.00g 3b863da5-2492-4c07-b4f8-0e8ac943803b a7f5cf77-5640-4d2d-8f6d-abf663431d01 -wi------- 128.00m 47586b40-b5c0-4a65-a7dc-23ddffbc64c7 a7f5cf77-5640-4d2d-8f6d-abf663431d01 -wi------- 35.00g 7a5878fb-d70d-4bb5-b637-53934d234ba9 a7f5cf77-5640-4d2d-8f6d-abf663431d01 -wi------- 570.00g 94852fc8-5208-4da1-a429-b97b0c82a538 a7f5cf77-5640-4d2d-8f6d-abf663431d01 -wi------- 55.00g a2edcd76-b9d7-4559-9c4f-a6941aaab956 a7f5cf77-5640-4d2d-8f6d-abf663431d01 -wi------- 128.00m de08d92d-611f-445c-b2d4-836e33935fcf a7f5cf77-5640-4d2d-8f6d-abf663431d01 -wi------- 300.00g de54928d-2727-46fc-81de-9de2ce002bee a7f5cf77-5640-4d2d-8f6d-abf663431d01 -wi------- 1.17t f9f4d24d-5f2b-4ec3-b7e3-1c50a7c45525 a7f5cf77-5640-4d2d-8f6d-abf663431d01 -wi------- 300.00g ids a7f5cf77-5640-4d2d-8f6d-abf663431d01 -wi------- 128.00m inbox a7f5cf77-5640-4d2d-8f6d-abf663431d01 -wi------- 128.00m leases a7f5cf77-5640-4d2d-8f6d-abf663431d01 -wi------- 2.00g master a7f5cf77-5640-4d2d-8f6d-abf663431d01 -wi------- 1.00g metadata a7f5cf77-5640-4d2d-8f6d-abf663431d01 -wi------- 128.00m outbox a7f5cf77-5640-4d2d-8f6d-abf663431d01 -wi------- 128.00m xleases a7f5cf77-5640-4d2d-8f6d-abf663431d01 -wi------- 1.00g So the question is: would it be better to execute something like lvremove for every LV lv_name lvremove --config 'devices { filter = ["a|.*|" ] }' a7f5cf77-5640-4d2d-8f6d-abf663431d01/lv_name vgremove vgremove --config 'devices { filter = ["a|.*|" ] }' a7f5cf77-5640-4d2d-8f6d-abf663431d01 pvremove pvremove --config 'devices { filter = ["a|.*|" ] }' /dev/mapper/360002ac0000000000000013e0001894c and then proceed with the steps above or nothing at all as the OS itself doesn't "see" the LVMs and it is only an oVirt view that is already "clean"? Also because LVM is not cluster aware, so after doing that on one node, I would have the problem about LVM rescan on other nodes.... Thanks in advance, Gianluca

2 5

oVirt Local Repo
by simon＠justconnect.ie 31 Mar '22

31 Mar '22

Hi all, I work in a secure environment with no external internet access and local mirrors provide a local oVirt repo. The person that set these up has since left with no documentation available. Updating our oVirt environments fails as 'no updates available' is the response. I recall a thread that stated something had broken when eol was announced in December but can't find that thread anymore. I would like to build a clean local ovirt and ovirt dependencies repos - is there any documentation for this. Kind Regards Simon...

2 4

Retiring the Hosted Engine's Data Center
by Calvin Ellison 31 Mar '22

31 Mar '22

We're retiring the physical data center that contains our Hosted Engine. Is there a documented process for changing the Hosted Engine's Data Center and Cluster? Should it "just work" via the normal engine backup and restore process? Calvin Ellison Systems Architect calvin.ellison(a)voxox.com +1 (213) 285-0555 <http://voxox.com> <https://www.facebook.com/VOXOX/> <https://www.instagram.com/voxoxofficial/> <https://www.linkedin.com/company/3573541/admin/> <https://twitter.com/Voxox> The information contained herein is confidential and privileged information or work product intended only for the individual or entity to whom it is addressed. Any unauthorized use, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, please notify me immediately.

2 1

4.5.0 beta compose delayed to April 4th 2022
by Sandro Bonazzola 30 Mar '22

30 Mar '22

oVirt 4.5.0 beta compose has been delayed to next week on April 4th as ovirt-engine and gluster-ansible-role support for ansible-core 2.12 missed today's deadline. Test day has been rescheduled accordingly to April 5th. Testers: please continue testing the released Alpha and providing feedback https://trello.com/b/3FZ7gdhM/ovirt-450-test-day A few packages that were meant to be shipped today as part of the beta release have been already pushed to testing repositories so you can already provide some feedback on the beta sanity. Known issues: - hyperconverged deployment doesn't work due to missing updated gluster-ansible-roles packages - ovirt-engine is still using ansible 2.9.27 and wasn't updated from 4.5.0 Alpha - ovirt-appliance and oVirt Node have not been built with current content of the testing repos as beta has been rescheduled Be aware the RHEL 8.6 Beta has been released yesterday so you can already try running on top of it. Rocky Linux announced they're already building 8.6 beta as well so it may be possible to start testing on top of it soon as well. Professional Services, Integrators and Backup vendors: please run a test session against your additional services, integrated solutions, downstream rebuilds, backup solution on the released alpha release and report issues as soon as possible. If you're not listed here: https://ovirt.org/community/user-stories/users-and-providers.html consider adding your company there. If you're willing to help updating the localization for oVirt 4.5.0 please follow https://ovirt.org/develop/localization.html If you're willing to help promoting the oVirt 4.5.0 release you can submit your banner proposals for the oVirt home page and for the social media advertising at https://github.com/oVirt/ovirt-site/issues no later than April 5th As an alternative please consider submitting a case study as in https://ovirt.org/community/user-stories/user-stories.html Feature owners: please submit a presentation of your feature for oVirt Youtube channel: https://www.youtube.com/c/ovirtproject no later than April 5th If you have some new feature requiring community feedback / testing please add your case under the "Test looking for volunteer" section no later than April 4th. Do you want to contribute to getting ready for this release? Read more about oVirt community at https://ovirt.org/community/ and join the oVirt developers https://ovirt.org/develop/ -- Sandro Bonazzola MANAGER, SOFTWARE ENGINEERING, EMEA R&D RHV Red Hat EMEA <https://www.redhat.com/> sbonazzo(a)redhat.com <https://www.redhat.com/> *Red Hat respects your work life balance. Therefore there is no need to answer this email out of your office hours.*

1 0