- Users - oVirt List Archives

How to recreate Ovirt CA from scratch
by Giorgio Biacchi 24 Feb '19

24 Feb '19

Hi list, during our datacenter lifetime many things changed. We moved the engine twice on different hosts with, of course, different FQDNs, and many other changes. Now we are stuck with an error when we try to upload an image to a data domain. The error is somehow bound to a failure to validate the ovirt-imageio-proxy certificate and, since the current root CA certificate is still signed with sha1WithRSAEncryption we'd like to regenerate the whole CA. That's the steps we've done.. without success... 1) Make a tar.gz of the /etc/pki/ovirt-engine as backup 2) Create a new CA cert using the same private key: openssl req -key /etc/pki/ovirt-engine/private/ca.pem -new -x509 -days 3650 -sha256 -extensions v3_ca -out newca.cert.pem 3) Put the new CA cert in place mv ca.pem ca.pem.orig.20190219;mv newca.cert.pem ca.pem 4) Resign all the other certs names="engine apache websocket-proxy jboss imageio-proxy" for name in $names; do subject="$( openssl \ x509 \ -in /etc/pki/ovirt-engine/certs/"${name}".cer \ -noout \ -subject \ | sed \ 's;subject= $.*$;\1;' \ )" /usr/share/ovirt-engine/bin/pki-enroll-pkcs12.sh \ --name="${name}" \ --password=mypass \ --subject="${subject}" \ --keep-key done 5) Restart all the services systemctl restart httpd systemctl restart ovirt-engine systemctl restart ovirt-websocket-proxy systemctl restart ovirt-imageio-proxy The following step was to take the backup at 1) and fall back to the initial state because nothing worked as expected. There's any documented procedure about how to recreate Ovirt CA from scratch?? Thanks in advance -- gb PGP Key: http://pgp.mit.edu/ Primary key fingerprint: C510 0765 943E EBED A4F2 69D3 16CC DC90 B9CB 0F34

2 3

Re: Info about AD integration and Root CA
by Strahil 23 Feb '19

23 Feb '19

You can get the root CA from any windows machine in the domain . Best Regards, Strahil Nikolov

1 0

Installing oVirt on Physical machine (Solved)
by emmanualvnebu1＠gmail.com 23 Feb '19

23 Feb '19

Issue: Unable to install oVirt on physical machine with USB. Once selected the option to install oVirt 4.3 it give a screen "dracut-initqueue time out And then get into emergency mode & gives dracut cmd line. Fix:I think I fixed it. The issue was with the bootable usb. Tried with multiple software to create & one worked. https://www.balena.io/etcher/ Thanks for everyone’s help.. Appreciate it.

1 0

Installing oVirt on Physical machine V4.3
by emmanualvnebu1＠gmail.com 23 Feb '19

23 Feb '19

Hi Guys, I am trying to install oVirt node on a physical machine. Once selected the option to install oVirt 4.3 it give a screen "dracut-initqueue time out And then get into emergency mode & gives dracut cmd line. if I exit the command line, it continue boot into the installation window. However it gives a message "Kickstart file /run/install/ks.config is missing" (Pane is dead). Tried the same on vmware, it boot fine & am able to install it. Can someone tell me how could I fix this?

3 11

Re: Installing oVirt on Physical machine V4.3
by Emmanual Vnebu 23 Feb '19

23 Feb '19

I think I fixed it. The issue was with the bootable usb. Tried with multiple software to create & one worked. https://www.balena.io/etcher/ Thanks for everyone’s help.. Appreciate it.. 😊 Sent from Mail for Windows 10

1 0

Design question: one big NFS share or several smaller ones?
by Markus Schaufler 22 Feb '19

22 Feb '19

Hi all, I've got a design question: Are there any best practices regarding NFS datastores especially datastore sizing? Should I use one big NFS datastore and expand it on demand or should the size not exceed a certain limit and start with a new NFS datastore? Are there any other configuration considerations (NFS v3 or v4(.1) and mounting options)?

3 2

Fencing : SSL or not?
by Nicolas Ecarnot 22 Feb '19

22 Feb '19

Hello, As fence_idrac has never worked for us, and as fence_ipmilan has worked nicely since years, we are using fence_ipmilan with the lanplus=1 option and we're happy with it. We upgraded to 4.3.0.4 and we're witnessing that we cannot fence our hosts anymore : 2019-02-18 09:42:08,678+01 ERROR [org.ovirt.engine.core.bll.pm.FenceProxyLocator] (default task-11) [2f78ed99-6703-4d92-b7cb-948c2d24b623] Can not run fence action on host 'xxxxx', no suitable proxy host was found. and on the SPM : fence_ipmilan: Failed: Unable to obtain correct plug status or plug is not available I found the suggested workaround here : https://access.redhat.com/solutions/3349841 but no combination of - lanplus={0,1} - -z - ssl=={0,1} lead to no solution. The package version is the same as what's described in the KB : fence-agents-rhevm-4.2.1-11.el7_6.7.x86_64 What should I test now? Thank you. -- Nicolas ECARNOT

2 7

Re: Host choice when migrating VMs
by Karli Sjöberg 22 Feb '19

22 Feb '19

1 0

Re: Host choice when migrating VMs
by Karli Sjöberg 22 Feb '19

22 Feb '19

3 2

Re: Host choice when migrating VMs
by Karli Sjöberg 22 Feb '19

22 Feb '19

2 1