- Users - oVirt List Archives

Migrating to keycloak
by eric.j.gillingham＠jpl.nasa.gov 08 Dec '22

08 Dec '22

I have an existing ovirt cluster, and I'm trying to migrate it from the internal sso and LDAP over to keycloak but am kind of at a loss. I followed the Activation procedures on https://github.com/oVirt/ovirt-engine-keycloak/blob/master/keycloak_usage.m… and am able to login to the keycloak console fine, but when I try to access the ovirt-engine admin panel I just get an internal server error. httpd log contains "oidc_util_json_string_print: oidc_util_check_json_error: response contained an "error" entry with value: ""Realm does not exist""" Does engine-setup not configure the keycloak it creates with the proper configuration for ovirt? The apache config seems to have some password and other settings for oidc, so that end got configured, but not the keycloak side. There's no ovirt-engine or other ovirt related clients inside the newly created keycloak.

1 0

centos-stream-release-8.6-1.el8.noarch vs redhat-release-8.7-0.3.el8.x86_64
by eshwayri＠gmail.com 07 Dec '22

07 Dec '22

What is the best way to resolve the below error. All other EL8 packages are now at 8.7. (--nobest) but the release file(s) aren't updating because this package won't upgrade. The blocking centos-stream-release-8.6-1.el8.noarch package is a pre-req for all the oVirt files, so I can't remove it. I suspect all oVirt is using from it are the repos. Do I force install redhat-release-8.7-0.3.el8.x86_64? Is there a way to do that? [root@kvmo-el8 /]# yum update Updating Subscription Management repositories. Last metadata expiration check: 2:28:57 ago on Wed 07 Dec 2022 03:25:45 PM EST. Error: Problem: installed package centos-stream-release-8.6-1.el8.noarch obsoletes redhat-release < 9 provided by redhat-release-8.7-0.3.el8.x86_64 - cannot install the best update candidate for package redhat-release-8.6-0.1.el8.x86_64 - problem with installed package centos-stream-release-8.6-1.el8.noarch (try to add '--skip-broken' to skip uninstallable packages or '--nobest' to use not only best candidate packages)

1 0

Failed to execute stage 'Closing up': Command '/usr/share/ovirt-engine-keycloak/bin/kk_cli.sh' failed to execute
by yp414＠163.com 07 Dec '22

07 Dec '22

engine-setup [ INFO ] Stage: Initializing [ INFO ] Stage: Environment setup Configuration files: /etc/ovirt-engine-setup.conf.d/10-packaging-jboss.conf, /etc/ovirt-engine-setup.conf.d/10-packaging.conf Log file: /var/log/ovirt-engine/setup/ovirt-engine-setup-20221204031123-60y1er.log Version: otopi-1.10.3 (otopi-1.10.3-1.el8) [ INFO ] Stage: Environment packages setup [ INFO ] Stage: Programs detection [ INFO ] Stage: Environment setup (late) [ INFO ] Stage: Environment customization --== PRODUCT OPTIONS ==-- Configure Cinderlib integration (Currently in tech preview) (Yes, No) [No]: Configure Engine on this host (Yes, No) [Yes]: Configuring ovirt-provider-ovn also sets the Default cluster's default network provider to ovirt-provider-ovn. Non-Default clusters may be configured with an OVN after installation. Configure ovirt-provider-ovn (Yes, No) [Yes]: Configure WebSocket Proxy on this host (Yes, No) [Yes]: * Please note * : Data Warehouse is required for the engine. If you choose to not configure it on this host, you have to configure it on a remote host, and then configure the engine on this host so that it can access the database of the remote Data Warehouse host. Configure Data Warehouse on this host (Yes, No) [Yes]: * Please note * : Keycloak is now deprecating AAA/JDBC authentication module. It is highly recommended to install Keycloak based authentication. Configure Keycloak on this host (Yes, No) [Yes]: Configure VM Console Proxy on this host (Yes, No) [Yes]: Configure Grafana on this host (Yes, No) [Yes]: --== PACKAGES ==-- [ INFO ] Checking for product updates... [ INFO ] No product updates found --== NETWORK CONFIGURATION ==-- Host fully qualified DNS name of this server [pm.local]: [WARNING] Failed to resolve pm.local using DNS, it can be resolved only locally Setup can automatically configure the firewall on this system. Note: automatic configuration of the firewall may overwrite current settings. Do you want Setup to configure the firewall? (Yes, No) [Yes]: [ INFO ] firewalld will be configured as firewall manager. --== DATABASE CONFIGURATION ==-- Where is the DWH database located? (Local, Remote) [Local]: Setup can configure the local postgresql server automatically for the DWH to run. This may conflict with existing applications. Would you like Setup to automatically configure postgresql and create DWH database, or prefer to perform that manually? (Automatic, Manual) [Automatic]: Where is the Keycloak database located? (Local, Remote) [Local]: Setup can configure the local postgresql server automatically for the Keycloak to run. This may conflict with existing applications. Would you like Setup to automatically configure postgresql and create Keycloak database, or prefer to perform that manually? (Automatic, Manual) [Automatic]: Where is the Engine database located? (Local, Remote) [Local]: Setup can configure the local postgresql server automatically for the engine to run. This may conflict with existing applications. Would you like Setup to automatically configure postgresql and create Engine database, or prefer to perform that manually? (Automatic, Manual) [Automatic]: --== OVIRT ENGINE CONFIGURATION ==-- Engine admin password: Confirm engine admin password: [WARNING] Password is weak: The password is shorter than 8 characters Use weak password? (Yes, No) [No]:yes Application mode (Virt, Gluster, Both) [Both]: Use Engine admin password as initial keycloak admin password (Yes, No) [Yes]: --== STORAGE CONFIGURATION ==-- Default SAN wipe after delete (Yes, No) [No]: --== PKI CONFIGURATION ==-- Organization name for certificate [local]: --== APACHE CONFIGURATION ==-- Setup can configure the default page of the web server to present the application home page. This may conflict with existing applications. Do you wish to set the application as the default page of the web server? (Yes, No) [Yes]: Setup can configure apache to use SSL using a certificate issued from the internal CA. Do you wish Setup to configure that, or prefer to perform that manually? (Automatic, Manual) [Automatic]: --== SYSTEM CONFIGURATION ==-- --== MISC CONFIGURATION ==-- Please choose Data Warehouse sampling scale: (1) Basic (2) Full (1, 2)[1]: Use Engine admin password as initial Grafana admin password (Yes, No) [Yes]: --== END OF CONFIGURATION ==-- [ INFO ] Stage: Setup validation [WARNING] Less than 16384MB of memory is available --== CONFIGURATION PREVIEW ==-- Application mode : both Default SAN wipe after delete : False Host FQDN : pm.local Firewall manager : firewalld Update Firewall : True Set up Cinderlib integration : False Configure local Engine database : True Set application as default page : True Configure Apache SSL : True Keycloak installation : True Engine database host : localhost Engine database port : 5432 Engine database secured connection : False Engine database host name validation : False Engine database name : engine Engine database user name : engine Engine installation : True PKI organization : local Set up ovirt-provider-ovn : True DWH installation : True DWH database host : localhost DWH database port : 5432 DWH database secured connection : False DWH database host name validation : False DWH database name : ovirt_engine_history Configure local DWH database : True Grafana integration : True Grafana database user name : ovirt_engine_history_grafana Keycloak database host : localhost Keycloak database port : 5432 Keycloak database secured connection : False Keycloak database host name validation : False Keycloak database name : ovirt_engine_keycloak Keycloak database user name : ovirt_engine_keycloak Configure local Keycloak database : True Configure VMConsole Proxy : True Configure WebSocket Proxy : True Please confirm installation settings (OK, Cancel) [OK]: [ INFO ] Stage: Transaction setup [ INFO ] Stopping engine service [ INFO ] Stopping ovirt-fence-kdump-listener service [ INFO ] Stopping dwh service [ INFO ] Stopping vmconsole-proxy service [ INFO ] Stopping websocket-proxy service [ INFO ] Stage: Misc configuration (early) [ INFO ] Stage: Package installation [ INFO ] Stage: Misc configuration [ INFO ] Upgrading CA [ INFO ] Creating PostgreSQL 'engine' database [ INFO ] Configuring PostgreSQL [ INFO ] Creating PostgreSQL 'ovirt_engine_history' database [ INFO ] Configuring PostgreSQL [ INFO ] Creating PostgreSQL 'ovirt_engine_keycloak' database [ INFO ] Configuring PostgreSQL [ INFO ] Creating CA: /etc/pki/ovirt-engine/ca.pem [ INFO ] Creating CA: /etc/pki/ovirt-engine/qemu-ca.pem [ INFO ] Creating a user for Grafana [ INFO ] Setting up ovirt-vmconsole proxy helper PKI artifacts [ INFO ] Setting up ovirt-vmconsole SSH PKI artifacts [ INFO ] Configuring WebSocket Proxy [ INFO ] Creating/refreshing Engine database schema [ INFO ] Creating/refreshing DWH database schema [ INFO ] Updating OVN SSL configuration [ INFO ] Updating OVN timeout configuration [ INFO ] Creating/refreshing Engine 'internal' domain database schema [ INFO ] Creating default mac pool range [ INFO ] Adding default OVN provider to database [ INFO ] Adding OVN provider secret to database [ INFO ] Setting a password for internal user admin [ INFO ] Creating initial Keycloak admin user [ INFO ] Generating post install configuration file '/etc/ovirt-engine-setup.conf.d/20-setup-ovirt-post.conf' [ INFO ] Stage: Transaction commit [ INFO ] Stage: Closing up --== SUMMARY ==-- [ INFO ] No need to restart fapolicyd because it is not running. [ INFO ] Starting dwh service [ INFO ] Starting Grafana service [ INFO ] Restarting ovirt-vmconsole proxy service To login to oVirt using Keycloak SSO, enter 'admin@ovirt' as username and the password provided during Setup To login to Keycloak Administration Console enter 'admin' as username and the password provided during Setup Web access for Keycloak Administration Console is enabled at: https://pm.local/ovirt-engine-auth/admin Web access is enabled at: http://pm.local:80/ovirt-engine https://pm.local:443/ovirt-engine Internal CA fingerprint: SHA256: F6:6C:CF:41:58:64:D1:84:25:10:A6:6B:4D:96:8B:EB:F5:F2:DA:FB:BD:CF:B4:2C:02:62:0B:0A:B3:15:14:33 SSH fingerprint: SHA256:Xnov0hwwe6/DN5udn3MypHx9EU5CelG6eYMHlaUZJFQ [ INFO ] Starting engine service [WARNING] Less than 16384MB of memory is available Web access for grafana is enabled at: https://pm.local/ovirt-engine-grafana/ Please run the following command on the engine machine pm.local, for SSO to work: systemctl restart ovirt-engine --== END OF SUMMARY ==-- [ INFO ] Restarting httpd [ INFO ] Start with setting up Keycloak for Ovirt Engine [ ERROR ] Failed to execute stage 'Closing up': Command '/usr/share/ovirt-engine-keycloak/bin/kk_cli.sh' failed to execute [ INFO ] Stage: Clean up Log file is located at /var/log/ovirt-engine/setup/ovirt-engine-setup-20221204031123-60y1er.log [ INFO ] Generating answer file '/var/lib/ovirt-engine/setup/answers/20221204031509-setup.conf' [ INFO ] Stage: Pre-termination [ INFO ] Stage: Termination [ ERROR ] Execution of setup failed

3 2

Re: el9 official use?
by Michal Skrivanek 07 Dec '22

07 Dec '22

> On 6. 12. 2022, at 17:29, Nathanaël Blanchet via Users <users(a)ovirt.org> wrote: > > Hello, > Until 4.5.4, el9 ovirt-node was for testing. Following 4.5.4 releases note, it seems to be officially supported but there is no information about el9 engine support. > What about it? all the packages are released for both el8 and el9 at the moment. Thanks, michal > _______________________________________________ > Users mailing list -- users(a)ovirt.org <mailto:users@ovirt.org> > To unsubscribe send an email to users-leave(a)ovirt.org <mailto:users-leave@ovirt.org> > Privacy Statement: https://www.ovirt.org/privacy-policy.html <https://www.ovirt.org/privacy-policy.html> > oVirt Code of Conduct: https://www.ovirt.org/community/about/community-guidelines/ <https://www.ovirt.org/community/about/community-guidelines/> > List Archives: https://lists.ovirt.org/archives/list/users@ovirt.org/message/25BKPHSXS4VJN… <https://lists.ovirt.org/archives/list/users@ovirt.org/message/25BKPHSXS4VJN…>

1 0

After failed upgrade from 4.5.1 to 4.5.3, upgrades do not show up anymore
by Gianluca Amato 07 Dec '22

07 Dec '22

Hi all, I recently tried to upgrade an oVirt node from 4.5.1 to 4.5.3. The upgrade failed (I have no idea idea why... how can I access the installation logs?). The node is still working fine running the old 4.5.1 release, but now the oVirt web console says that it is up to date and it does not let me retry the upgrade. However, I am still on version 4.5.1, as witnessed by the result of "nodectl info": ---- bootloader: default: ovirt-node-ng-4.5.1-0.20220623.0 (4.18.0-394.el8.x86_64) entries: ovirt-node-ng-4.5.1-0.20220623.0 (4.18.0-394.el8.x86_64): index: 0 kernel: /boot//ovirt-node-ng-4.5.1-0.20220623.0+1/vmlinuz-4.18.0-394.el8.x86_64 args: crashkernel=auto resume=/dev/mapper/onn_ovirt--clai1-swap rd.lvm.lv=onn_ovirt-clai1/ovirt-node-ng-4.5.1-0.20220623.0+1 rd.lvm.lv=onn_ovirt-clai1/swap rhgb quiet boot=UUID=9d44cf2a-38bb-477d-b542-4bfc30463d1f rootflags=discard img.bootid=ovirt-node-ng-4.5.1-0.20220623.0+1 intel_iommu=on modprobe.blacklist=nouveau transparent_hugepage=never hugepagesz=1G hugepages=256 default_hugepagesz=1G root: /dev/onn_ovirt-clai1/ovirt-node-ng-4.5.1-0.20220623.0+1 initrd: /boot//ovirt-node-ng-4.5.1-0.20220623.0+1/initramfs-4.18.0-394.el8.x86_64.img title: ovirt-node-ng-4.5.1-0.20220623.0 (4.18.0-394.el8.x86_64) blsid: ovirt-node-ng-4.5.1-0.20220623.0+1-4.18.0-394.el8.x86_64 layers: ovirt-node-ng-4.5.1-0.20220623.0: ovirt-node-ng-4.5.1-0.20220623.0+1 current_layer: ovirt-node-ng-4.5.1-0.20220623.0+1 ------ Comparing the situation with other hosts in the same data center, it seems that the problem is that the package ovirt-node-ng-image-update-placeholder is not installed anymore, hence "dnf upgrade" has nothing to do. My idea was to manually download and install the 4.5.1 version of ovirt-node-ng-image-update-placeholder and attempt installation again. Is it a correct way to proceed ? Thanks for any help. --gianluca amato

2 3

el9 official use?
by Nathanaël Blanchet 06 Dec '22

06 Dec '22

Hello, Until 4.5.4, el9 ovirt-node was for testing. Following 4.5.4 releases note, it seems to be officially supported but there is no information about el9 engine support. What about it?

1 0

Max network performance on w2019 guest
by Gianluca Cecchi 06 Dec '22

06 Dec '22

One customer sees 2,5gbs on 10gbs adapters for w2019 VM with virtio using iperf3. Instead with Oracle linux 8 VMS of the same infra sees 9gbs. What is the expected maximum on windows with virtio based on experience? Thanks Gianluca

3 5

State sync
by KSNull Zero 06 Dec '22

06 Dec '22

Hello! Is there any way to "sync" current host/datastore/vm state after Engine restore from backup ? For example - let's say we have a backup made 3 hour later from current time and in this 3 hours we made some changes to vm (change config/power state/take snapshots for example) or hosts (enter maintenace mode, network changes and so on). If we restore backup we did not see those changes because all of the info is stored in the engine database. So the question - is there any way to get "synced" with current actual infrastructure/vm state ? Thank you.

1 1

oVirt Update Errors
by Matthew J Black 06 Dec '22

06 Dec '22

Hi Guys, Attempting to do a Cluster update via the oVirt GUI and I'm getting the following errors (taken from the logs) which I've confirmed via a straight `dnf update`: Problem 1: package ovirt-hosted-engine-setup-2.6.6-1.el8.noarch conflicts with ansible-core >= 2.13 provided by ansible-core-2.13.3-1.el8.x86_64 - cannot install the best update candidate for package ovirt-hosted-engine-setup-2.6.6-1.el8.noarch - cannot install the best update candidate for package ansible-core-2.12.7-1.el8.x86_64 Problem 2: problem with installed package ovirt-hosted-engine-setup-2.6.6-1.el8.noarch - package ovirt-hosted-engine-setup-2.6.6-1.el8.noarch conflicts with ansible-core >= 2.13 provided by ansible-core-2.13.3-1.el8.x86_64 - package ovirt-ansible-collection-3.0.0-1.el8.noarch requires ansible-core >= 2.13.0, but none of the providers can be installed - cannot install the best update candidate for package ovirt-ansible-collection-2.3.0-1.el8.noarch Is it OK to do a `dnf update --nobest` or a `dnf update --allowerasing` on each host, or is there some other solution that I'm missing? Cheers Dulux-Oz

4 6

Nvidia A10 vGPU support on oVirt 4.5.2
by Don Dupuis 05 Dec '22

05 Dec '22

Hello I can run an Nvidia GRID T4 on oVirt 4.5.2 with no issue but I have a new GRID A10 that doesn't seem to work in oVirt 4.5.2. This new card seems to use SRIOV instead of mediated devices or it seems that I only get the mdev_supported_types directory structure when I run the /usr/lib/nvidia/sriov-manager command. Has anyone got this card working on oVirt or has developers working on oVirt/RHV know about this? Thanks Don

1 0