January 2023 - Users - oVirt List Archives

oVirt host deploy: disable multipath
by femi adegoke 27 Mar '23

27 Mar '23

https://bugzilla.redhat.com/show_bug.cgi?id=1472356 There are 2 drives in my install that oVirt is claiming as multipath. I have tried blacklisting at /etc/multipath/ but that hasn't worked. Any better solutions? I need these 2 drives to be non-multipathed.

4 19

4.5.2 Create Additional Gluster Logical Volumes fails
by simon＠justconnect.ie 21 Mar '23

21 Mar '23

Hi, In 4.4 adding additional gluster volumes was a simple ansible task (or via cockpit). With 4.5.2 I tried to add new volumes but the logic has changed/broken. Here's the error I am getting: TASK [gluster.infra/roles/backend_setup : Create volume groups] ******************************************************************************************************************************** failed: [bdtovirthcidmz02-strg.mydomain.com] (item={'key': 'gluster_vg_sda', 'value': [{'vgname': 'gluster_vg_sda', 'pvname': '/dev/sda'}]}) => {"ansible_loop_var": "item", "changed": true, "cmd": ["vgcreate", "--dataalignment", "2048K", "-s", "2048K", "gluster_vg_sda", "/dev/sda"], "delta": "0:00:00.010442", "end": "2022-11-10 13:11:16.717772", "item": {"key": "gluster_vg_sda", "value": [{"pvname": "/dev/sda", "vgname": "gluster_vg_sda"}]}, "msg": "non-zero return code", "rc": 3, "start": "2022-11-10 13:11:16.707330", "stderr": " Configuration setting \"filter\" invalid. It's not part of any section.\n /dev/gluster_vg_sda: already exists in filesystem\n Run `vgcreate --help' for more information.", "stderr_lines": [" Configuration setting \"filter\" invalid. It's not part of any section.", " /dev/gluster_vg_sda: already exists in filesystem", " Run `vgcreate --help' for more information."], "stdout": "", "stdout_lines": []} failed: [bdtovirthcidmz03-strg.mydomain.com] (item={'key': 'gluster_vg_sda', 'value': [{'vgname': 'gluster_vg_sda', 'pvname': '/dev/sda'}]}) => {"ansible_loop_var": "item", "changed": true, "cmd": ["vgcreate", "--dataalignment", "2048K", "-s", "2048K", "gluster_vg_sda", "/dev/sda"], "delta": "0:00:00.010231", "end": "2022-11-10 13:12:35.607565", "item": {"key": "gluster_vg_sda", "value": [{"pvname": "/dev/sda", "vgname": "gluster_vg_sda"}]}, "msg": "non-zero return code", "rc": 3, "start": "2022-11-10 13:12:35.597334", "stderr": " Configuration setting \"filter\" invalid. It's not part of any section.\n /dev/gluster_vg_sda: already exists in filesystem\n Run `vgcreate --help' for more information.", "stderr_lines": [" Configuration setting \"filter\" invalid. It's not part of any section.", " /dev/gluster_vg_sda: already exists in filesystem", " Run `vgcreate --help' for more information."], "stdout": "", "stdout_lines": []} failed: [bdtovirthcidmz01-strg.mydomain.com] (item={'key': 'gluster_vg_sda', 'value': [{'vgname': 'gluster_vg_sda', 'pvname': '/dev/sda'}]}) => {"ansible_loop_var": "item", "changed": true, "cmd": ["vgcreate", "--dataalignment", "2048K", "-s", "2048K", "gluster_vg_sda", "/dev/sda"], "delta": "0:00:00.011282", "end": "2022-11-10 13:13:24.336233", "item": {"key": "gluster_vg_sda", "value": [{"pvname": "/dev/sda", "vgname": "gluster_vg_sda"}]}, "msg": "non-zero return code", "rc": 3, "start": "2022-11-10 13:13:24.324951", "stderr": " Configuration setting \"filter\" invalid. It's not part of any section.\n /dev/gluster_vg_sda: already exists in filesystem\n Run `vgcreate --help' for more information.", "stderr_lines": [" Configuration setting \"filter\" invalid. It's not part of any section.", " /dev/gluster_vg_sda: already exists in filesystem", " Run `vgcreate --help' for more information."], "stdout": "", "stdout_lines": []} The vg was created as part of the initial ansible build with logical volumes being added when required. Any assistance would be greatly appreciated. Kind regards Simon

6 21

Host Reboot Timeout of 10 Minutes
by Peter H 27 Feb '23

27 Feb '23

I'm working in a group that maintains a large oVirt setup based on 4.4.1 which works very well. We are afraid of upgrading and prefer setting up a new installation and gradually enlist the hosts one by one into the new installation. We have tried 4.4.10 and 4.5.1 - 4.5.4 based on CentOS Stream 8, Rocky 8, Alma Linux 9.1 with various problems. Worst was the problem that the rpm db ended up in a catch-22 state. Using Alma Linux 9.1 and current oVirt 4.5.4 seems promising as no rpm problems are present after installation. We have only one nuisance left which we have seen in all installation attempts we have made since 4.4.10. When rebooting a host it takes 10 minutes before it's activated again. In 4.4.1 the hosts are activated a few seconds after they have booted up. I have found the following in the engine log: 2023-01-24 23:01:57,564+01 INFO [org.ovirt.engine.core.bll.SshHostRebootCommand] (EE-ManagedThreadFactory-engine-Thread-1513) [2bb08d20] Waiting 600 seconds, for server to finish reboot process. Our ansible playbooks for deployment times out and we could increase the timeout but how come that this 10 minutes delay has been introduced? Does a config file exist where this timeout can be set to a lower value? BR Peter H.

2 2

Out-of-sync networks can only be detached
by Sakhi Hadebe 27 Feb '23

27 Feb '23

Hi, I have a 3-node oVirt cluster. I have configured 2 logical networks: ovirtmgmt and public. Public logical network is attached in only 2 nodes and failing to attach on the 3rd node with the below error Invalid operation, out-of-sync network 'public' can only be detached. Please have been stuck on this for almost the whole day now. How do I fix this error? -- Regards, Sakhi Hadebe

3 5

VDSM Host command Get Host Capabilities failed: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
by Vasudev.ippili＠broadcom.com 24 Feb '23

24 Feb '23

We have a situation where nodes are left in Unassigned state. SSL certificate was expired and even after cert update the nodes are not coming out of Unassigned state. Its not even going in maintenance mode as there are VMs on it (although they are not responding right now). Anyway we can remove the node from HE and add it back?

3 2

{REQUEST} oVirt (including RHHI) as HCI in the future
by 樽井周久（KTCSP） 10 Feb '23

10 Feb '23

To whom it may concern I have been using oVirt in an HCI environment for over 5 years. The reason why I chose oVirt (most attractive point of oVirt for me) was that it is easy to build an HCI environment with GUI deployment. Now, I found out that the deployment by GUI has been deprecated (from ovirt4.5) on your forum site, and that all the contents related to HCI were deleted (dropped) in your official installation guide site. https://lists.ovirt.org/archives/list/users@ovirt.org/message/CBDUBBKLTCW4M… https://www.ovirt.org/documentation/installing_ovirt_as_a_self-hosted_engin… It seems that oVirt will not be able to build HCI environment in the future. So I'm very worried about whether I can continue to use oVirt as before. I would appreciate it if you could tell me about your prospects regarding oVirt as HCI. For your reference below. On 4.5.3 oVirt host, Gluster deployment was done with GUI, but hosted-engine had to be deployed with CLI. On 4.5.4 oVirt host, Guster deployment failed with GUI, so subsequent hosted-engine deployment could not proceed. ('str object' has no attribute 'vgname') Best regards, Kanehisa Tarui Tokyo, Japan

2 1

oVirt Installation in ESXi 7
by mikejhathaway＠gmail.com 03 Feb '23

03 Feb '23

Hi Folks, Am a complete newbie with oVirt and am researching how to install in an ESXi server, the idea is to create a VM that runs the oVirt host and hosted engine with a virtual NFS server, I found the following but am not able to get the hoste engine VM to deploy, I am not seeing anything leaping out at me from the log file and was hoping that others may have experiences they can share? https://jorgedelacruz.uk/2021/07/26/ovirt-detailed-guide-on-how-to-deploy-a… am also using https://www.ovirt.org/documentation/installing_ovirt_as_a_self-hosted_engin… TIA Mike

2 1

Re: Self-hosted engine 4.5.0 deployment fails
by John 01 Feb '23

01 Feb '23

I would run the deploy again, wait until the engine is up and then from the server you are deploying the engine on # virsh list obtain the virtual machine number from the above command, in the example below we assume the number is 1 # virsh console 1 login as root wait for all packages to finish updating: tail -f /var/log/dnf.rpm.log then: # dnf downgrade postgresql-jdbc once that's done the deployment of the engine should get past the [ INFO ] TASK [ovirt.ovirt.engine_setup : Check if Engine health page is up] step. On 03/05/2022 17:03, Mohamed Roushdy wrote: > > Hello, > > I’m deploying on Ovirt nodes v4.5.0.1, but it fails to deploy the > self-hosted engine with the following errors in the web installer: > > [ INFO ] skipping: [localhost] > [ INFO ] TASK [ovirt.ovirt.engine_setup : Check if Engine health page > is up] > [ ERROR ] fatal: [localhost -> 192.168.222.197]: FAILED! => > {"attempts": 30, "changed": false, "connection": "close", > "content_encoding": "identity", "content_length": "86", > "content_type": "text/html; charset=UTF-8", "date": "Tue, 03 May 2022 > 15:57:20 GMT", "elapsed": 0, "msg": "Status code was 500 and not > [200]: HTTP Error 500: Internal Server Error", "redirected": false, > "server": "Apache/2.4.37 (centos) OpenSSL/1.1.1k > mod_auth_gssapi/1.6.1", "status": 500, "url": > http://localhost/ovirt-engine/services/health} > [ INFO ] TASK [ovirt.ovirt.engine_setup : Clean temporary files] > [ INFO ] changed: [localhost -> 192.168.222.197] > [ INFO ] TASK [ovirt.ovirt.hosted_engine_setup : Sync on engine machine] > [ INFO ] changed: [localhost -> 192.168.222.197] > [ INFO ] TASK [ovirt.ovirt.hosted_engine_setup : Set destination > directory path] > [ INFO ] ok: [localhost -> localhost] > [ INFO ] TASK [ovirt.ovirt.hosted_engine_setup : Create destination > directory] > [ INFO ] changed: [localhost -> localhost] > [ INFO ] TASK [ovirt.ovirt.hosted_engine_setup : include_tasks] > [ INFO ] ok: [localhost] > [ INFO ] TASK [ovirt.ovirt.hosted_engine_setup : Find the local > appliance image] > [ INFO ] ok: [localhost -> localhost] > [ INFO ] TASK [ovirt.ovirt.hosted_engine_setup : Set local_vm_disk_path] > [ INFO ] ok: [localhost -> localhost] > [ INFO ] TASK [ovirt.ovirt.hosted_engine_setup : Give the vm time to > flush dirty buffers] > [ INFO ] ok: [localhost -> localhost] > [ INFO ] TASK [ovirt.ovirt.hosted_engine_setup : Copy engine logs] > [ INFO ] changed: [localhost] > [ INFO ] TASK [ovirt.ovirt.hosted_engine_setup : Change ownership of > copied engine logs] > [ INFO ] changed: [localhost -> localhost] > [ INFO ] TASK [ovirt.ovirt.hosted_engine_setup : Notify the user about > a failure] > [ ERROR ] fatal: [localhost]: FAILED! => {"changed": false, "msg": > "There was a failure deploying the engine on the local engine VM. The > system may not be provisioned according to the playbook results: > please check the logs for the issue, fix accordingly or re-deploy from > scratch.\n"} > > Any idea if this is a bug or something? I tried to deploy for eight > times with different configuration > > Thank y9ou, > > > _______________________________________________ > Users mailing list --users(a)ovirt.org > To unsubscribe send an email tousers-leave(a)ovirt.org > Privacy Statement:https://www.ovirt.org/privacy-policy.html > oVirt Code of Conduct:https://www.ovirt.org/community/about/community-guidelines/ > List Archives:https://lists.ovirt.org/archives/list/users@ovirt.org/message/XL3Q…

2 1

multiple disk snapshot_memory stay in locked state
by Nathanaël Blanchet 30 Jan '23

30 Jan '23

Hello, After many (failed) snapshot attempts, I find many disk snapshot_memory in locked state into the disks menu. unlock utility returns anything... how can I erase those disks, knowing that there is no listed snapshot for this vm

1 1

I need the deploy script to wait for fixing network configuration manually in oVirt 4.3.10
by lars.stolpe＠bvg.de 30 Jan '23

30 Jan '23

Hi, i'm planing to upgrade our production environment from oVirt 4.3 to 4.4. So i do need a fresh oVirt 4.3 installation to test the procedure before doing it in production. The command line deploy script can't handle network interfaces correctly. If i use either a single NIC oder a bond (active/passive) i get the error message "The selected network interface is not valid". If i predefine the management bridge to a running state, the deploy process goes on, but fails to activate the added host and removes the already running engine vm. The deploy process fails to synchronize the existing working network configuration with the engine configuration. I can already log in to the engine GUI and see, that the bridge "ovirtmgmt" needs to be assigned to the bonding IF, but i'm not fast enough to do so, because the deployment process ist already shutting down and erasing the vm. I do see the following ways to succeed: 1. make the depoyment process accept the given interfaces (maybe ignore errors) 2. make the deploy process wait for me to take necessary actions before checking the engine Do anyone know, how to achieve this? All i need is a running engine on hosted_storage... any other issues i can fix later. Another idea is to use one of the destined hosts as a bare metal engine, add hosts, backup the engine and use that backup for a hosted engine restore deploy, since the deploy script asks to wait after local vm is ready, but only if i do a recovery deploy. Any suggestions?

3 3

How to view multi ovirt-manager VM ?
by rak kim 27 Jan '23

27 Jan '23

Hello, I'm kim I have 7 ovirt-manager running on each service I want to manage 7 ovirt-manger on one platform Is there any program to view VMs at each ovirt-manager for one platform ? (like multi-cloud platform ?) I guess I just need to be able to control/view the VM.

2 2

Changing the Cluster Compatibility Version in hyperconverged environment
by lexxthefox＠gmail.com 25 Jan '23

25 Jan '23

Hi! I'm sorry if it is a noob question but it is very important for me. We are researching oVirt in our company and hope to use existing environment where there's no SAN/NAS solution. Just a bunch of servers. We were able to set up a hyperconverged installation with oVirt 4.4 a while ago and now I'm resuming research and trying to upgrade it to 4.5. I was able to upgrade HE and Hosts. What's left is to upgrade Cluster Compatibility Version from 4.5 to 4.7. I don't seem to find a way to do it as when I try to Edit cluster I get this error: "Cluster Compatibility Version". Upgrade Guide on https://www.ovirt.org/documentation/upgrade_guide/ does not have entries for hyperconverged set up. So I don't know where to look for information on this topic. Is it possible to achieve my goal at all? Can "frozen" Cluster Compatibility Version cause problems in the long run? I can rebuild the whole setup now when it is still being reviewed and planed. But if we start using it actively it won't be possible. I'm afraid that this could be a show-stopper in the long run. Thanks in advance!

3 6

New Ovirt installation on existing Ovirt
by yevhen.kyrylchenko＠gmail.com 25 Jan '23

25 Jan '23

Hi! I have a strange idea - I try to create a small Ovirt test lab on my existing Ovirt infrastructure. I have two real Ovirt hosts: host01 - 192.168.1.10/24, GW 192.168.1.1 host02 - 192.168.1.11/24, GW 192.168.1.1 I created VM on which I want to install new Ovirt instance: v_host01 - 192.168.1.100, checked Pass-Through Host CPU. During deployment hosted engine on v_host01 (lets say v_he - 192.168.1.110), Ovirt creates temporary bridge with random IP and hosted engine VM can comunicate through that bridge. After successful deployment this HE VM has assigned static IP 192.168.1.110. And now communication is possible only between v_host01 and v_he... I can't reach network from v_he further than v_host01 and can't reach v_he from hosts other than v_host01. Seems than bridge on v_host01, created during deployment doesn't want to forward traffik... Do you have any ideas what should I check? Regards!

1 0

Regenerate DWH ovirt_engine_history
by Diego Ercolani 24 Jan '23

24 Jan '23

Hello to all and happy new year. My question is "simple". I need to "reset" the ovirt_engine_history database. I tried to use: engine-setup --reconfigure-optional-components after removing: - ovirt_engine_history - set to "False" OVESETUP_DWH_CORE/enable=bool:True OVESETUP_GRAFANA_CORE/enable=bool:True in /etc/ovirt-engine-setup.conf.d/20-setup-ovirt-post.conf (obviously all in "Global Maintenance") currently I have a system where I have an initialized ovirt_engine_history but no engine is writing in it. I tried to follow (in some manner): https://www.ovirt.org/documentation/data_warehouse_guide/ In the ovirt engine's log there is no exception... so I cannot address the issue. I need help to reinitialize the db... I don't need the history.. only from now on. Thank you for your help but no one is

2 11

cluster level - features
by marek 24 Jan '23

24 Jan '23

hi, do you have tips where can i find information about new features in cluster levels? i found only https://access.redhat.com/documentation/en-us/red_hat_virtualization/4.4/ht… there is only information "there are new features" hard way i tried check https://www.ovirt.org/release/4.5.0/ and found https://bugzilla.redhat.com/show_bug.cgi?id=2021545 - Detecting if scratch disks can be extended automatically - Detecting if host support disk format conversion - Maybe for using qcow2 format by default to enable incremental backup by https://bugzilla.redhat.com/show_bug.cgi?id=2033185 - e1000e is there some "central" place ? Marek

1 0

ovirt upgrade - Failed to execute stage 'Misc configuration' FATAL: Ident authentication failed for user "root"
by marek 24 Jan '23

24 Jan '23

upgrade from ovirt 4.4.4 to 4.5.5 engine-setup 2023-01-24 00:35:17,885+0100 DEBUG otopi.context context._executeMethod:145 method exception Traceback (most recent call last): File "/usr/lib/python3.6/site-packages/otopi/context.py", line 132, in _executeMethod method['method']() File "/usr/share/ovirt-engine/setup/bin/../plugins/ovirt-engine-setup/ovirt-engine-grafana-dwh/db/default_privileges.py", line 51, in _misc_set_default_privileges user=self.environment[ogdwhcons.GrafanaDBEnv.USER], File "/usr/share/ovirt-engine/setup/ovirt_engine_setup/engine_common/database.py", line 1808, in setDefaultPrivilegesReadOnlyForUser ownConnection=True, File "/usr/share/ovirt-engine/setup/ovirt_engine_setup/engine_common/database.py", line 249, in execute database=database, File "/usr/share/ovirt-engine/setup/ovirt_engine_setup/engine_common/database.py", line 182, in connect sslmode=sslmode, File "/usr/lib64/python3.6/site-packages/psycopg2/__init__.py", line 127, in connect conn = _connect(dsn, connection_factory=connection_factory, **kwasync) psycopg2.OperationalError: FATAL: Ident authentication failed for user "root" FATAL: Ident authentication failed for user "root" 2023-01-24 00:35:17,886+0100 ERROR otopi.context context._executeMethod:154 Failed to execute stage 'Misc configuration': FATAL: Ident authentication failed for user "root" FATAL: Ident authentication failed for user "root" any tips? Marek

2 4

Disaster recovery failed with direct lun 4.4.10
by jaime luque 23 Jan '23

23 Jan '23

Good night I am configuring the disaster recovery with the following environment Ovirt 4.4.10 Site A An external manager A hypervisor server Site B An external manager A hypervisor server *Mons are being replicated from one storage to another with the conditions mentioned in the active passive guide. In the File disaster_recovery_vars.yml **** The mapping of the virtual machines is carried out, one of these has direct luns When I execute the failover the virtual machines are not importing in the secondary site. If I comment on the mapping of the direct luns, it is possible to import the virtual machines and they remain working correctly. NOTE: The direct lun that the vm has is without format or partition, since I am in the testing phase. Can you please give me ideas of what to check.

1 1

pass-through CPU
by duparchy＠esrf.fr 23 Jan '23

23 Jan '23

Hi, What are the pro and cons of enabling pass-through CPU ? It is a greyed option for a VM, unless specific host(s) is/are selected. That's the thing : it's possible to select all hosts..., so, it does not make difference w/ "Start on any host" option

3 3

VM backup issue on oVirt 4.4.7
by Don Dupuis 23 Jan '23

23 Jan '23

Hello, I am having an issue backing up vms using the backup_vm.py example script. The error I get is below: [ 0.0 ] Starting full backup for VM 'c656db00-065c-4fd0-b8b9-74a86dc864fc' Traceback (most recent call last): File "/opt/riva-config/backup_vm.py", line 547, in <module> main() File "/opt/riva-config/backup_vm.py", line 146, in main args.command(args) File "/opt/riva-config/backup_vm.py", line 160, in cmd_full backup = start_backup(connection, args) File "/opt/riva-config/backup_vm.py", line 348, in start_backup description=args.description File "/usr/lib64/python3.6/site-packages/ovirtsdk4/services.py", line 34151, in add return self._internal_add(backup, headers, query, wait) File "/usr/lib64/python3.6/site-packages/ovirtsdk4/service.py", line 232, in _internal_add return future.wait() if wait else future File "/usr/lib64/python3.6/site-packages/ovirtsdk4/service.py", line 55, in wait return self._code(response) File "/usr/lib64/python3.6/site-packages/ovirtsdk4/service.py", line 229, in callback self._check_fault(response) File "/usr/lib64/python3.6/site-packages/ovirtsdk4/service.py", line 132, in _check_fault self._raise_error(response, body) File "/usr/lib64/python3.6/site-packages/ovirtsdk4/service.py", line 118, in _raise_error raise error ovirtsdk4.Error: Fault reason is "Operation Failed". Fault detail is "[Cannot backup VM. Host (vsh001) is running on a version lower than 4.4.5. Please upgrade the host in order to use incremental backup.]". HTTP response code is 409. The strange this is that I am running oVirt 4.4.7. What component is it complaining about that is not up to version needed? Any help on this would be appreciated. oVirt rpm is ovirt-host-4.4.7-1.el8.x86_64. I plan on upgrading to version 4.4.10 but want to get this fixed first. I also can't got to 4.5.x because I have problems with Windows 10 vms and vGPUs. Thanks Don

3 7

Hosted-Engine Down VSDM Cert Expired
by jarredm＠ecboces.org 22 Jan '23

22 Jan '23

Hey all, I'm looking to get a bit of guidance here. As the subject suggests, we have a hosted-engine ovirt cluster. I ran into an issue trying to login to the web interface. I was seeing errors about certificate expiration, although I didn't know what cert it was referring to at the time. I ssh'd to the hosted-engine and restarted it. However, once it shutdown, it was unable to start again. What I've discovered so far is that the hosted-engine is currently residing on node 33 (storage is on a gluster volume) and the vdsm certificate for that node has expired. There are three nodes in total, and two of them have expired certs. However, one of them has a valid cert still. I'm able to run vdsm-client commands on that node. Although I haven't done anything with that yet other than to verify that I'm able to do some of the Host get* commands successfully. I'm wondering if it is possible to "pull" the hosted-engine onto this host and fire it back up there. Thanks in advance for your help! I'm gathering log info etc as described and it will be available here: https://drive.google.com/drive/folders/1cBPrN8SuIR-dgnpRKe1eKXRZZTPPshyJ?us… Version info: Installed Packages centos-release-gluster8.noarch 1.0-1.el8 @extras centos-release-storage-common.noarch 2-2.el8 @extras glusterfs.x86_64 8.6-2.el8 @centos-gluster8 ovirt-release44.noarch 4.4.8.3-1.el8 @@commandline vdsm.x86_64 4.40.80.6-1.el8 @ovirt-4.4

2 1

Re: Cannot prepare internal mirrorlist
by ahmad.hidayat＠singtel.com 22 Jan '23

22 Jan '23

Good day Nathan! Firstly, it's polite for me to thank the moderators for approving my post.. Thank you for guiding me on this. I have configured the /etc/environment and /etc/yum.conf with the proxy configurations then curl the mirrorlist site and it was successful. Our KVM is behind a firewall, do we need to allow the traffic for a specific range of IP addresses for this? Regards, Hidayat

1 0

ovirtsdk4 python - global maintenance
by yevhen.kyrylchenko＠gmail.com 20 Jan '23

20 Jan '23

Hi! I know how to set global maintenance mode using python SDK, something like vms_service.vm_service(vm.id).maintenance(maintenance_enabled=True) on HostedEngine. But now I try to find if global maintenance is enabled. And I'm going to give up - I can't find how to do it in documentation... Is there a way to get this info? Regards!

2 2

remote-viewer, vnc console, error certificate's owner does not match hostname
by Jiří Sléžka 20 Jan '23

20 Jan '23

Hello, I have recently enrolled new certificates on all hosts in our RHV (4.5.3.5-1.el8ev) cluster but now I cannot connect to VNC or SPICE+VNC console via remote-viewer (virt-viewer-11.0-2.fc36.x86_64) because of error The certificate's owner does not match hostname '10.224.102.72' 10.224.102.72 is host's ip address Connection through spice protocol works fine .vv file looks like [virt-viewer] type=vnc host=10.224.102.72 port=5910 password=******* # Password is valid for 120 seconds. delete-this-file=1 fullscreen=0 title=srv.example.com:%d toggle-fullscreen=shift+f11 release-cursor=shift+f12 secure-attention=ctrl+alt+end versions=rhev-win64:2.0-160;rhev-win32:2.0-160;rhel8:7.0-3;rhel7:2.0-6;rhel6:99.0-1 newer-version-url=https://rhv.example.com/ovirt-engine/rhv/client-resources [ovirt] host=rhv.example.com:443 vm-guid=d9f1e9f8-1111-2222-3333-1c1db6704f21 sso-token=K9r1tHadO7H8oB........JMCSwtcwyD0syaENFA admin=1 I also tried to copy oVirt's CA cert to ~/.pki/CA/cacert.pem as mentioned in https://access.redhat.com/solutions/6217601 but error persists. Debug log looks like remote-viewer --debug Downloads/console.vv --gtk-vnc-debug (remote-viewer:2445675): gtk-vnc-DEBUG: 14:36:54.160: ../src/vncdisplay.c Connected to VNC server (remote-viewer:2445675): gtk-vnc-DEBUG: 14:36:54.160: ../src/vncconnection.c Protocol initialization (remote-viewer:2445675): gtk-vnc-DEBUG: 14:36:54.160: ../src/vncconnection.c Schedule greeting timeout 0x5621f9d53478 (remote-viewer:2445675): gtk-vnc-DEBUG: 14:36:54.161: ../src/vncconnection.c Remove timeout 0x5621f9d53478 (remote-viewer:2445675): gtk-vnc-DEBUG: 14:36:54.161: ../src/vncconnection.c Server version: 3.8 (remote-viewer:2445675): gtk-vnc-DEBUG: 14:36:54.161: ../src/vncconnection.c Sending full greeting (remote-viewer:2445675): gtk-vnc-DEBUG: 14:36:54.161: ../src/vncconnection.c Using version: 3.8 (remote-viewer:2445675): gtk-vnc-DEBUG: 14:36:54.190: ../src/vncconnection.c Possible auth 19 (remote-viewer:2445675): virt-viewer-DEBUG: 14:36:54.191: Allocated 1024x768 (remote-viewer:2445675): virt-viewer-DEBUG: 14:36:54.191: Child allocate 1024x768 (remote-viewer:2445675): gtk-vnc-DEBUG: 14:36:54.192: ../src/vncconnection.c Emit main context 14 (remote-viewer:2445675): gtk-vnc-DEBUG: 14:36:54.192: ../src/vncconnection.c Thinking about auth type 19 (remote-viewer:2445675): gtk-vnc-DEBUG: 14:36:54.192: ../src/vncconnection.c Decided on auth type 19 (remote-viewer:2445675): gtk-vnc-DEBUG: 14:36:54.192: ../src/vncconnection.c Waiting for auth type (remote-viewer:2445675): gtk-vnc-DEBUG: 14:36:54.192: ../src/vncconnection.c Choose auth 19 (remote-viewer:2445675): gtk-vnc-DEBUG: 14:36:54.192: ../src/vncconnection.c Checking if credentials are needed (remote-viewer:2445675): gtk-vnc-DEBUG: 14:36:54.192: ../src/vncconnection.c No credentials required (remote-viewer:2445675): gtk-vnc-DEBUG: 14:36:54.194: ../src/vncconnection.c Possible VeNCrypt sub-auth 261 (remote-viewer:2445675): gtk-vnc-DEBUG: 14:36:54.194: ../src/vncconnection.c Emit main context 15 (remote-viewer:2445675): gtk-vnc-DEBUG: 14:36:54.194: ../src/vncconnection.c Requested auth subtype 261 (remote-viewer:2445675): gtk-vnc-DEBUG: 14:36:54.194: ../src/vncconnection.c Waiting for VeNCrypt auth subtype (remote-viewer:2445675): gtk-vnc-DEBUG: 14:36:54.194: ../src/vncconnection.c Choose auth subtype 261 (remote-viewer:2445675): gtk-vnc-DEBUG: 14:36:54.194: ../src/vncconnection.c Checking if credentials are needed (remote-viewer:2445675): gtk-vnc-DEBUG: 14:36:54.194: ../src/vncconnection.c No credentials required (remote-viewer:2445675): gtk-vnc-DEBUG: 14:36:54.194: ../src/vncconnection.c Do TLS handshake (remote-viewer:2445675): gtk-vnc-DEBUG: 14:36:54.195: ../src/vncconnection.c Checking if credentials are needed (remote-viewer:2445675): gtk-vnc-DEBUG: 14:36:54.195: ../src/vncconnection.c Want a TLS clientname (remote-viewer:2445675): gtk-vnc-DEBUG: 14:36:54.195: ../src/vncconnection.c Requesting missing credentials (remote-viewer:2445675): gtk-vnc-DEBUG: 14:36:54.195: ../src/vncconnection.c Emit main context 13 (remote-viewer:2445675): virt-viewer-DEBUG: 14:36:54.195: Got VNC credential request for 1 credential(s) (remote-viewer:2445675): gtk-vnc-DEBUG: 14:36:54.195: ../src/vncconnection.c Set credential 2 libvirt (remote-viewer:2445675): gtk-vnc-DEBUG: 14:36:54.195: ../src/vncconnection.c Searching for certs in /etc/pki (remote-viewer:2445675): gtk-vnc-DEBUG: 14:36:54.195: ../src/vncconnection.c Searching for certs in /home/user/.pki (remote-viewer:2445675): gtk-vnc-DEBUG: 14:36:54.195: ../src/vncconnection.c Failed to find certificate CA/cacrl.pem (remote-viewer:2445675): gtk-vnc-DEBUG: 14:36:54.195: ../src/vncconnection.c Failed to find certificate libvirt/private/clientkey.pem (remote-viewer:2445675): gtk-vnc-DEBUG: 14:36:54.195: ../src/vncconnection.c Failed to find certificate libvirt/clientcert.pem (remote-viewer:2445675): gtk-vnc-DEBUG: 14:36:54.195: ../src/vncconnection.c Waiting for missing credentials (remote-viewer:2445675): gtk-vnc-DEBUG: 14:36:54.195: ../src/vncconnection.c Got all credentials (remote-viewer:2445675): gtk-vnc-DEBUG: 14:36:54.195: ../src/vncconnection.c No client cert or key provided (remote-viewer:2445675): gtk-vnc-DEBUG: 14:36:54.195: ../src/vncconnection.c No CA revocation list provided (remote-viewer:2445675): gtk-vnc-DEBUG: 14:36:54.195: ../src/vncconnection.c Handshake was blocking (remote-viewer:2445675): gtk-vnc-DEBUG: 14:36:54.197: ../src/vncconnection.c Handshake was blocking (remote-viewer:2445675): gtk-vnc-DEBUG: 14:36:54.199: ../src/vncconnection.c Handshake was blocking (remote-viewer:2445675): gtk-vnc-DEBUG: 14:36:54.200: ../src/vncconnection.c Handshake was blocking (remote-viewer:2445675): gtk-vnc-DEBUG: 14:36:54.200: ../src/vncconnection.c Handshake done (remote-viewer:2445675): gtk-vnc-DEBUG: 14:36:54.200: ../src/vncconnection.c Validating (remote-viewer:2445675): gtk-vnc-DEBUG: 14:36:54.200: ../src/vncconnection.c Certificate is valid. (remote-viewer:2445675): gtk-vnc-DEBUG: 14:36:54.200: ../src/vncconnection.c Checking chain 0 (remote-viewer:2445675): gtk-vnc-DEBUG: 14:36:54.200: ../src/vncconnection.c Error: The certificate's owner does not match hostname '10.224.102.72' (remote-viewer:2445675): gtk-vnc-DEBUG: 14:36:54.200: ../src/vncconnection.c Emit main context 19 (remote-viewer:2445675): virt-viewer-WARNING **: 14:36:54.200: vnc-session: got vnc error The certificate's owner does not match hostname '10.224.102.72' (remote-viewer:2445675): gtk-vnc-DEBUG: 14:36:54.200: ../src/vncdisplay.c VNC server error (remote-viewer:2445675): gtk-vnc-DEBUG: 14:36:54.200: ../src/vncconnection.c Auth failed Also noVNC client throws "Something went wrong, connection is closed" Certificate on one of hosts looks like [root@rhev01 ~]# openssl x509 -in /etc/pki/vdsm/libvirt-vnc/server-cert.pem -text -noout Certificate: Data: Version: 3 (0x2) Serial Number: 165 (0xa5) Signature Algorithm: sha256WithRSAEncryption Issuer: C = US, O = SU Opava, CN = CA-rhv.example.com.51627 Validity Not Before: Jan 11 12:06:21 2023 GMT Not After : Jan 13 12:06:21 2028 GMT Subject: O = SU Opava, CN = rhev01.net.slu.cz ... X509v3 Subject Alternative Name: DNS:rhev01.net.slu.cz Yes, certificate has dns name of host inside, .vv file uses an ip address. Is it a bug? Can I disable hostname checking in remote-viewer somehow? Thanks in advance, Jiri

1 0

Updating the DNS configuration for the Hosted Engine
by nathan.english＠bt.com 20 Jan '23

20 Jan '23

Hi All, I've had a look through the documentation and not been able to find any up to date information on how to do this. We've now built a permanent DNS solution and need to update the Hosted Engine DNS server details. Luckily, I have managed to update the hosts configuration using the Data Center Settings so it's just the Hosted Engine to complete. Any advice on where should I update? I didn't want to update the if config file, as I assumed it's controlled by ansible somewhere! Kind Regards, Nathan

2 2

Cannot prepare internal mirrorlist
by ahmad.hidayat＠singtel.com 20 Jan '23

20 Jan '23

Hi Everyone, I am new here and hoping to get some advise on my issue that i'm encountering. I am setting up ovirt self hosting engine 4.5.4 and require proxy to access the internet. Below is the issue i encountered: [localhost -> 192.168.222.66]: FAILED! => {"changed": false, "msg": "Failed to download metadata for repo 'centos-ceph-pacific': Cannot prepare internal mirrorlist: Curl error (6): Couldn't resolve host name for http://mirrorlist.centos.org/?release=8-stream&arch=x86_64&repo=storage-cep… [Could not resolve host: mirrorlist.centos.org]", "rc": 1, "results": []} Hoping to gain some information to solve it. Thank you in advance!

2 1