Using self-hosted engine.

I thought about using several interfaces on the engine VM.

= =3D

The reason why I want to do that : I would like the users access= =3D ing the web interface not to be on the same network that ovirt is using to = =3D communicate betweem hosts and engine.

But it would mean that 2 di= =3D fferent FQDN are necessary, right ? I heard HA requires to access to the en= =3D gine FQDN...

Do you have any idea how to solve thi= =3D s situation ?

Alexis

= On 2=3D 4 August 2017 at 15:39, Alexis HAUSER
<alexis.hauser(a)imt-atlantique= .f=3D r> wrote:
>
> In the way Ovirt is currently designed, is the= =3D re a way to separate the
> following elements in different VLANs :>
> 1) Communication betweem nodes (hypervisors) and engine (mana= =3D ger)
> 2) Access to webadmin interface
> 3) access to user web = =3D interface
>
> It seems that the following elements all rely on = =3D ovirtmgmt, right ?

Only #1. #2 and #3 could be changed AFAIK, depend= =3D ing on where and how
you run the engine (Fir e.g. if you run it on a sep= =3D arate host, you
could attach other interfaces with other VLANs to it).

--
Barak Korren
RHV DevOps team , RHCE, RHCi
Red Hat EM= =3D EA
redhat.com | TRIED. TESTED. TRUSTED. | redhat.com/trusted

--=3D_96ea490d-6118-4146-9d6a-bd5f5c0a2a6b-- --===============7790680276076102547== Content-Type: multipart/alternative MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.bin" LS09Xzk2ZWE0OTBkLTYxMTgtNDE0Ni05ZDZhLWJkNWY1YzBhMmE2YgpDb250ZW50LVR5cGU6IHRl eHQvcGxhaW47IGNoYXJzZXQ9dXRmLTgKQ29udGVudC1UcmFuc2Zlci1FbmNvZGluZzogN2JpdAoK VXNpbmcgc2VsZi1ob3N0ZWQgZW5naW5lLiAKSSB0aG91Z2h0IGFib3V0IHVzaW5nIHNldmVyYWwg aW50ZXJmYWNlcyBvbiB0aGUgZW5naW5lIFZNLiAKClRoZSByZWFzb24gd2h5IEkgd2FudCB0byBk byB0aGF0IDogSSB3b3VsZCBsaWtlIHRoZSB1c2VycyBhY2Nlc3NpbmcgdGhlIHdlYiBpbnRlcmZh Y2Ugbm90IHRvIGJlIG9uIHRoZSBzYW1lIG5ldHdvcmsgdGhhdCBvdmlydCBpcyB1c2luZyB0byBj b21tdW5pY2F0ZSBiZXR3ZWVtIGhvc3RzIGFuZCBlbmdpbmUuIApCdXQgaXQgd291bGQgbWVhbiB0 aGF0IDIgZGlmZmVyZW50IEZRRE4gYXJlIG5lY2Vzc2FyeSwgcmlnaHQgPyBJIGhlYXJkIEhBIHJl cXVpcmVzIHRvIGFjY2VzcyB0byB0aGUgZW5naW5lIEZRRE4uLi4gCgpEbyB5b3UgaGF2ZSBhbnkg aWRlYSBob3cgdG8gc29sdmUgdGhpcyBzaXR1YXRpb24gPyAKCgpBbGV4aXMgCgoKCgpPbiAyNCBB dWd1c3QgMjAxNyBhdCAxNTozOSwgQWxleGlzIEhBVVNFUiAKPGFsZXhpcy5oYXVzZXJAaW10LWF0 bGFudGlxdWUuZnI+IHdyb3RlOiAKPiAKPiBJbiB0aGUgd2F5IE92aXJ0IGlzIGN1cnJlbnRseSBk ZXNpZ25lZCwgaXMgdGhlcmUgYSB3YXkgdG8gc2VwYXJhdGUgdGhlIAo+IGZvbGxvd2luZyBlbGVt ZW50cyBpbiBkaWZmZXJlbnQgVkxBTnMgOiAKPiAKPiAxKSBDb21tdW5pY2F0aW9uIGJldHdlZW0g bm9kZXMgKGh5cGVydmlzb3JzKSBhbmQgZW5naW5lIChtYW5hZ2VyKSAKPiAyKSBBY2Nlc3MgdG8g d2ViYWRtaW4gaW50ZXJmYWNlIAo+IDMpIGFjY2VzcyB0byB1c2VyIHdlYiBpbnRlcmZhY2UgCj4g Cj4gSXQgc2VlbXMgdGhhdCB0aGUgZm9sbG93aW5nIGVsZW1lbnRzIGFsbCByZWx5IG9uIG92aXJ0 bWdtdCwgcmlnaHQgPyAKCk9ubHkgIzEuICMyIGFuZCAjMyBjb3VsZCBiZSBjaGFuZ2VkIEFGQUlL LCBkZXBlbmRpbmcgb24gd2hlcmUgYW5kIGhvdyAKeW91IHJ1biB0aGUgZW5naW5lIChGaXIgZS5n LiBpZiB5b3UgcnVuIGl0IG9uIGEgc2VwYXJhdGUgaG9zdCwgeW91IApjb3VsZCBhdHRhY2ggb3Ro ZXIgaW50ZXJmYWNlcyB3aXRoIG90aGVyIFZMQU5zIHRvIGl0KS4gCgoKLS0gCkJhcmFrIEtvcnJl biAKUkhWIERldk9wcyB0ZWFtICwgUkhDRSwgUkhDaSAKUmVkIEhhdCBFTUVBIApyZWRoYXQuY29t IHwgVFJJRUQuIFRFU1RFRC4gVFJVU1RFRC4gfCByZWRoYXQuY29tL3RydXN0ZWQgCgotLT1fOTZl YTQ5MGQtNjExOC00MTQ2LTlkNmEtYmQ1ZjVjMGEyYTZiCkNvbnRlbnQtVHlwZTogdGV4dC9odG1s OyBjaGFyc2V0PXV0Zi04CkNvbnRlbnQtVHJhbnNmZXItRW5jb2Rpbmc6IHF1b3RlZC1wcmludGFi bGUKCjxodG1sPjxib2R5PjxkaXYgc3R5bGU9M0QiZm9udC1mYW1pbHk6IGFyaWFsLCBoZWx2ZXRp Y2EsIHNhbnMtc2VyaWY7IGZvbnQtcz0KaXplOiAxMnB0OyBjb2xvcjogIzAwMDAwMCI+PGRpdj48 ZGl2PlVzaW5nIHNlbGYtaG9zdGVkIGVuZ2luZS48YnI+PC9kaXY+PGRpPQp2PkkgdGhvdWdodCBh Ym91dCB1c2luZyBzZXZlcmFsIGludGVyZmFjZXMgb24gdGhlIGVuZ2luZSBWTS48L2Rpdj48ZGl2 Pjxicj49CjwvZGl2PjxkaXY+VGhlIHJlYXNvbiB3aHkgSSB3YW50IHRvIGRvIHRoYXQgOiBJIHdv dWxkIGxpa2UgdGhlIHVzZXJzIGFjY2Vzcz0KaW5nIHRoZSB3ZWIgaW50ZXJmYWNlIG5vdCB0byBi ZSBvbiB0aGUgc2FtZSBuZXR3b3JrIHRoYXQgb3ZpcnQgaXMgdXNpbmcgdG8gPQpjb21tdW5pY2F0 ZSBiZXR3ZWVtIGhvc3RzIGFuZCBlbmdpbmUuPC9kaXY+PGRpdj5CdXQgaXQgd291bGQgbWVhbiB0 aGF0IDIgZGk9CmZmZXJlbnQgRlFETiBhcmUgbmVjZXNzYXJ5LCByaWdodCA/IEkgaGVhcmQgSEEg cmVxdWlyZXMgdG8gYWNjZXNzIHRvIHRoZSBlbj0KZ2luZSBGUUROLi4uPC9kaXY+PGRpdj48YnI+ PC9kaXY+PGRpdj5EbyB5b3UgaGF2ZSBhbnkgaWRlYSBob3cgdG8gc29sdmUgdGhpPQpzIHNpdHVh dGlvbiA/PC9kaXY+PGRpdj48YnI+PC9kaXY+PGRpdj48YnI+PC9kaXY+PGRpdj5BbGV4aXM8L2Rp dj48YnI+PC9kaXY9Cj48ZGl2PjxiciBkYXRhLW1jZS1ib2d1cz0zRCIxIj48L2Rpdj48ZGl2Pjxi ciBkYXRhLW1jZS1ib2d1cz0zRCIxIj48L2Rpdj48ZD0KaXY+PGJyIGRhdGEtbWNlLWJvZ3VzPTNE IjEiPjwvZGl2PjxkaXYgZGF0YS1tYXJrZXI9M0QiX19RVU9URURfVEVYVF9fIj5PbiAyPQo0IEF1 Z3VzdCAyMDE3IGF0IDE1OjM5LCBBbGV4aXMgSEFVU0VSPGJyPiZsdDthbGV4aXMuaGF1c2VyQGlt dC1hdGxhbnRpcXVlLmY9CnImZ3Q7IHdyb3RlOjxicj4mZ3Q7PGJyPiZndDsgSW4gdGhlIHdheSBP dmlydCBpcyBjdXJyZW50bHkgZGVzaWduZWQsIGlzIHRoZT0KcmUgYSB3YXkgdG8gc2VwYXJhdGUg dGhlPGJyPiZndDsgZm9sbG93aW5nIGVsZW1lbnRzIGluIGRpZmZlcmVudCBWTEFOcyA6PGJyPQo+ Jmd0Ozxicj4mZ3Q7IDEpIENvbW11bmljYXRpb24gYmV0d2VlbSBub2RlcyAoaHlwZXJ2aXNvcnMp IGFuZCBlbmdpbmUgKG1hbmE9Cmdlcik8YnI+Jmd0OyAyKSBBY2Nlc3MgdG8gd2ViYWRtaW4gaW50 ZXJmYWNlPGJyPiZndDsgMykgYWNjZXNzIHRvIHVzZXIgd2ViID0KaW50ZXJmYWNlPGJyPiZndDs8 YnI+Jmd0OyBJdCBzZWVtcyB0aGF0IHRoZSBmb2xsb3dpbmcgZWxlbWVudHMgYWxsIHJlbHkgb24g PQpvdmlydG1nbXQsIHJpZ2h0ID88YnI+PGJyPk9ubHkgIzEuICMyIGFuZCAjMyBjb3VsZCBiZSBj aGFuZ2VkIEFGQUlLLCBkZXBlbmQ9CmluZyBvbiB3aGVyZSBhbmQgaG93PGJyPnlvdSBydW4gdGhl IGVuZ2luZSAoRmlyIGUuZy4gaWYgeW91IHJ1biBpdCBvbiBhIHNlcD0KYXJhdGUgaG9zdCwgeW91 PGJyPmNvdWxkIGF0dGFjaCBvdGhlciBpbnRlcmZhY2VzIHdpdGggb3RoZXIgVkxBTnMgdG8gaXQp LjxiPQpyPjxicj48YnI+LS0gPGJyPkJhcmFrIEtvcnJlbjxicj5SSFYgRGV2T3BzIHRlYW0gLCBS SENFLCBSSENpPGJyPlJlZCBIYXQgRU09CkVBPGJyPnJlZGhhdC5jb20gfCBUUklFRC4gVEVTVEVE LiBUUlVTVEVELiB8IHJlZGhhdC5jb20vdHJ1c3RlZDxicj48L2Rpdj48Lz0KZGl2PjwvYm9keT48 L2h0bWw+Ci0tPV85NmVhNDkwZC02MTE4LTQxNDYtOWQ2YS1iZDVmNWMwYTJhNmItLQo= --===============7790680276076102547==-- From bkorren at redhat.com Fri Aug 25 10:20:02 2017 Content-Type: multipart/mixed; boundary="===============8426313021003661309==" MIME-Version: 1.0 From: Barak Korren To: users at ovirt.org Subject: Re: [ovirt-users] Ovirtmgmt, webinterfaces and VLANs Date: Fri, 25 Aug 2017 13:20:00 +0300 Message-ID: In-Reply-To: 1597944877.995467.1503655120432.JavaMail.zimbra@imt-atlantique.fr --===============8426313021003661309== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Barak Korren bkorren(a)redhat.com RHCE, RHCi, RHV-DevOps Team https://ifireball.wordpress.com/ =D7=91=D7=AA=D7=90=D7=A8=D7=99=D7=9A 25 =D7=91=D7=90=D7=95=D7=92=D7=B3 2017= 01:05 PM,=E2=80=8F "Alexis HAUSER" < alexis.hauser(a)imt-atlantique.fr> =D7=9B=D7=AA=D7=91: Using self-hosted engine. I thought about using several interfaces on the engine VM. The reason why I want to do that : I would like the users accessing the web interface not to be on the same network that ovirt is using to communicate betweem hosts and engine. But it would mean that 2 different FQDN are necessary, right ? I heard HA requires to access to the engine FQDN... Do you have any idea how to solve this situation ? AFAIK the main issue would be with the SSL certificate for the UI/API. But you can add more FQDNs to it during the installation. I'm not an HA expert but I think it would probably only need acccess to the engine port that is connected to the ovirtmgmt network. --===============8426313021003661309== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGRpdiBkaXI9ImF1dG8iPjxkaXY+PGJyPjxicj48ZGl2IGRhdGEtc21hcnRtYWlsPSJnbWFpbF9z aWduYXR1cmUiPkJhcmFrIEtvcnJlbjxicj48YSBocmVmPSJtYWlsdG86YmtvcnJlbkByZWRoYXQu Y29tIj5ia29ycmVuQHJlZGhhdC5jb208L2E+PGJyPlJIQ0UsIFJIQ2ksIFJIVi1EZXZPcHMgVGVh bTxicj48YSBocmVmPSJodHRwczovL2lmaXJlYmFsbC53b3JkcHJlc3MuY29tLyI+aHR0cHM6Ly9p ZmlyZWJhbGwud29yZHByZXNzLmNvbS88L2E+PC9kaXY+PGRpdiBjbGFzcz0iZ21haWxfZXh0cmEi Pjxicj48ZGl2IGNsYXNzPSJnbWFpbF9xdW90ZSI+15HXqteQ16jXmdeaIDI1INeR15DXldeS17Mg MjAxNyAwMTowNSBQTSzigI8gJnF1b3Q7QWxleGlzIEhBVVNFUiZxdW90OyAmbHQ7PGEgaHJlZj0i bWFpbHRvOmFsZXhpcy5oYXVzZXJAaW10LWF0bGFudGlxdWUuZnIiPmFsZXhpcy5oYXVzZXJAaW10 LWF0bGFudGlxdWUuZnI8L2E+Jmd0OyDXm9eq15E6PGJyIHR5cGU9ImF0dHJpYnV0aW9uIj48Ymxv Y2txdW90ZSBjbGFzcz0icXVvdGUiIHN0eWxlPSJtYXJnaW46MCAwIDAgLjhleDtib3JkZXItbGVm dDoxcHggI2NjYyBzb2xpZDtwYWRkaW5nLWxlZnQ6MWV4Ij48ZGl2PjxkaXYgc3R5bGU9ImZvbnQt ZmFtaWx5OmFyaWFsLGhlbHZldGljYSxzYW5zLXNlcmlmO2ZvbnQtc2l6ZToxMnB0O2NvbG9yOiMw MDAwMDAiPjxkaXY+PGRpdj5Vc2luZyBzZWxmLWhvc3RlZCBlbmdpbmUuPGJyPjwvZGl2PjxkaXY+ SSB0aG91Z2h0IGFib3V0IHVzaW5nIHNldmVyYWwgaW50ZXJmYWNlcyBvbiB0aGUgZW5naW5lIFZN LjwvZGl2PjxkaXY+PGJyPjwvZGl2PjxkaXY+VGhlIHJlYXNvbiB3aHkgSSB3YW50IHRvIGRvIHRo YXQgOiBJIHdvdWxkIGxpa2UgdGhlIHVzZXJzIGFjY2Vzc2luZyB0aGUgd2ViIGludGVyZmFjZSBu b3QgdG8gYmUgb24gdGhlIHNhbWUgbmV0d29yayB0aGF0IG92aXJ0IGlzIHVzaW5nIHRvIGNvbW11 bmljYXRlIGJldHdlZW0gaG9zdHMgYW5kIGVuZ2luZS48L2Rpdj48ZGl2PkJ1dCBpdCB3b3VsZCBt ZWFuIHRoYXQgMiBkaWZmZXJlbnQgRlFETiBhcmUgbmVjZXNzYXJ5LCByaWdodCA/IEkgaGVhcmQg SEEgcmVxdWlyZXMgdG8gYWNjZXNzIHRvIHRoZSBlbmdpbmUgRlFETi4uLjwvZGl2PjxkaXY+PGJy PjwvZGl2PjxkaXY+RG8geW91IGhhdmUgYW55IGlkZWEgaG93IHRvIHNvbHZlIHRoaXMgc2l0dWF0 aW9uID88L2Rpdj48L2Rpdj48L2Rpdj48L2Rpdj48L2Jsb2NrcXVvdGU+PC9kaXY+PC9kaXY+PC9k aXY+PGRpdiBkaXI9ImF1dG8iPjxicj48L2Rpdj48ZGl2IGRpcj0iYXV0byI+QUZBSUsgdGhlIG1h aW4gaXNzdWUgd291bGQgYmUgd2l0aCB0aGUgU1NMIGNlcnRpZmljYXRlIGZvciB0aGUgVUkvQVBJ LiBCdXQgeW91IGNhbiBhZGQgbW9yZSBGUUROcyB0byBpdCBkdXJpbmcgdGhlIGluc3RhbGxhdGlv bi48L2Rpdj48ZGl2IGRpcj0iYXV0byI+PGJyPjwvZGl2PjxkaXYgZGlyPSJhdXRvIj5JJiMzOTtt IG5vdCBhbiBIQSBleHBlcnQgYnV0IEkgdGhpbmsgaXQgd291bGQgcHJvYmFibHkgb25seSBuZWVk IGFjY2Nlc3MgdG8gdGhlIGVuZ2luZSBwb3J0IHRoYXQgaXMgY29ubmVjdGVkIHRvIHRoZSBvdmly dG1nbXQgbmV0d29yay48L2Rpdj48ZGl2IGRpcj0iYXV0byI+PC9kaXY+PGRpdiBkaXI9ImF1dG8i PjxkaXYgY2xhc3M9ImdtYWlsX2V4dHJhIj48YnI+PC9kaXY+PC9kaXY+PC9kaXY+Cg== --===============8426313021003661309==--