- Users - oVirt List Archives

Problem with oVirt 4.4
by minnie.du＠vinchin.com 15 Jun '20

15 Jun '20

We have met a problem when testing oVirt 4.4. Our VM is on NFS storage. When testing the snapshot function of oVirt 4.4, we created snapshot 1 and then snapshot 2, but after clicking the delete button of snapshot 1, snapshot 1 failed to be deleted and the state of corresponding disk became illegal. Removing the snapshot in this state requires a lot of risky work in the background, leading to the inability to free up snapshot space. Long-term backups will cause the target VM to create a large number of unrecoverable snapshots, thus taking up a large amount of production storage. So we need your help.

4 4

Engine is one month ahead
by Strahil Nikolov 14 Jun '20

14 Jun '20

Hello All, I have a problem which started after the latest patching 4.3.9 to 4.3.10 . Symptoms so far: 1. Engine reports that Hypervisours are drifting too much 2. ETL service stopped working 3. Web UI constantly notifies me that the nodes are again active (fills the screen till the bottom) So far I have found an issue with one of the Hypervisours and after removing chrony's drift file and reboot - no more issues are observed. I found in the DB that DWH last update was one month (yes, that's July) ahead , so updating it to June has fixed the ETL issue. The problem with the constant "Host has been activated" was fixed by updating the Engine database , table Job (July was changed with June). The only problem I have now is that every event in the Web (and in the DB of course) is pointing to July. Any ideas how the engine is taking the time ,cause a restart doesn't fix the issue? As you can see both Hypervisours and HE VM are OK: [root@engine ~]# ntpdate -q time.cloudflare.com server 162.159.200.1, stratum 3, offset 0.000816, delay 0.02812 server 162.159.200.123, stratum 3, offset 0.000939, delay 0.02834 14 Jun 11:40:05 ntpdate[30135]: adjust time server 162.159.200.1 offset 0.000816 sec [root@engine ~]# logout Connection to engine closed. [root@ovirt1 ~]# for i in ovirt{1..3} ; do ntpdate -q time.cloudflare.com ; done server 162.159.200.123, stratum 3, offset 0.002658, delay 0.02948 server 162.159.200.1, stratum 3, offset 0.001741, delay 0.02768 14 Jun 11:40:24 ntpdate[29562]: adjust time server 162.159.200.1 offset 0.001741 sec server 162.159.200.1, stratum 3, offset 0.002529, delay 0.02914 server 162.159.200.123, stratum 3, offset 0.001931, delay 0.02788 14 Jun 11:40:31 ntpdate[29597]: adjust time server 162.159.200.123 offset 0.001931 sec server 162.159.200.123, stratum 3, offset 0.001765, delay 0.02742 server 162.159.200.1, stratum 3, offset 0.002551, delay 0.02924 14 Jun 11:40:37 ntpdate[29618]: adjust time server 162.159.200.123 offset 0.001765 sec Best Regards, Strahil Nikolov

1 1

ovirt 4.3.10 Web UI constantly "finished activating host"
by Strahil Nikolov 14 Jun '20

14 Jun '20

I'm not sure if this one is related to "time shift" in the DB (as I found that dwh_history_timekeeping had some entries 1 month ahead/ETL service issues also/, but I keep getting spammed that the host has been activated. Any hint ? Best Regards, Strahil Nikolov

2 2

oVirt 4.4.0 HE deployment on GlusterFS fails during health check
by Oliver Leinfelder 13 Jun '20

13 Jun '20

Hi, I have the following two components: 1.) A freshly installed VM host (oVirt Node 4.4.0 release ISO) 2.) 3 storage hosts, also freshly installed from oVirt Node 4.4.0 release ISO The storage hosts have been successfully installed with Gluster (through Cockpit). They have two volumes, both of which I can mount and read/write from a client. On the VM host, I ran "hosted-engine --deploy" (no backups imported). When prompted for storage, I answered "glusterfs" and specified "storagehost1:/engine" as storage for the HE deployment. For mount options, I specified "backup-volfile-servers=storagehost2:/engine:storagehost3:/engine" (Not the real hostnames, but all of them are resolvable via internal DNS) Everything seems to works fine, I also see the "engine" volume become populated with data. At some point I could ping and SSH login to the HE. When the setup proceed to health check, it failed and the whole process was aborted :-( "hosted-engine --vm-status" reported "failed liveliness check" when it was reachable via SSH. At some point the engine went down and, to my surprise, shows a grub prompt after the restart when doing a "hosted-engine --console". [ INFO ] TASK [ovirt.hosted_engine_setup : Check engine VM health] [ ERROR ] fatal: [localhost]: FAILED! => {"attempts": 180, "changed": true, "cmd": ["hosted-engine", "--vm-status", "--json"], "delta": "0:00:00.160595", "end": "2020-06-12 17:50:05.675774", "rc": 0, "start": "2020-06-12 17:50:05.515179", "stderr": "", "stderr_lines": [], "stdout": "{\"1\": {\"host-id\": 1, \"host-ts\": 11528, \"score\": 3400, \"engine-status\": {\"vm\": \"up\", \"health\": \"bad\", \"detail\": \"Powering down\", \"reason\": \"failed liveliness check\"}, \"hostname\": \"vmhost\", \"maintenance\": false, \"stopped\": false, \"crc32\": \"2c447835\", \"conf_on_shared_storage\": true, \"local_conf_timestamp\": 11528, \"extra\": \"metadata_parse_version=1\\nmetadata_feature_version=1\\ntimestamp=11528 (Fri Jun 12 17:49:57 2020)\\nhost-id=1\\nscore=3400\\nvm_conf_refresh_time=11528 (Fri Jun 12 17:49:57 2020)\\nconf_on_shared_storage=True\\nmaintenance=False\\nstate=EngineStop\\nstopped=False\\ntimeout=Thu Jan 1 04:12:48 1970\\n\", \"live-data\": true}, \"global_maintenance\": false}", "stdout_lines": ["{\"1\": {\"host-id\": 1, \"host-ts\": 11528, \"score\": 3400, \"engine-status\": {\"vm\": \"up\", \"health\": \"bad\", \"detail\": \"Powering down\", \"reason\": \"failed liveliness check\"}, \"hostname\": \"vmhost\", \"maintenance\": false, \"stopped\": false, \"crc32\": \"2c447835\", \"conf_on_shared_storage\": true, \"local_conf_timestamp\": 11528, \"extra\": \"metadata_parse_version=1\\nmetadata_feature_version=1\\ntimestamp=11528 (Fri Jun 12 17:49:57 2020)\\nhost-id=1\\nscore=3400\\nvm_conf_refresh_time=11528 (Fri Jun 12 17:49:57 2020)\\nconf_on_shared_storage=True\\nmaintenance=False\\nstate=EngineStop\\nstopped=False\\ntimeout=Thu Jan 1 04:12:48 1970\\n\", \"live-data\": true}, \"global_maintenance\": false}"]} A second attempt failed at exactly the same stage. I can see the following in the setup log: ovirt-hosted-engine-setup-20200612151212-j9zwd2.log: 2020-06-12 17:33:18,314+0200 DEBUG otopi.ovirt_hosted_engine_setup.ansible_utils ansible_utils._process_output:103 {'msg': 'non-zero return code', 'cmd': ['hosted-engine', '--reinitialize-lockspace', '--force'], 'stdout': '', 'stderr': 'Traceback (most recent call last):\n File "/usr/lib64/python3.6/runpy.py", line 193, in _run_module_as_main\n "__main__", mod_spec)\n File "/usr/lib64/python3.6/runpy.py", line 85, in _run_code\n exec(code, run_globals)\n File "/usr/lib/python3.6/site-packages/ovirt_hosted_engine_setup/reinitialize_ lockspace.py", line 30, in <module>\n ha_cli.reset_lockspace(force)\n File "/usr/lib/python3.6/site-packages/ovirt_hosted_engine_ha/client/client.py", line 286, in reset_lockspace\n stats = broker.get_stats_from_storage()\n File "/usr/lib/python3.6/site-packages/ov irt_hosted_engine_ha/lib/brokerlink.py", line 148, in get_stats_from_storage\n result = self._proxy.get_stats()\n File "/usr/lib64/python3.6/xmlrpc/client.py", line 1112, in __call__\n return self.__send(self.__name, args)\n File "/usr/lib64/python3.6/xmlrpc/client .py", line 1452, in __request\n verbose=self.__verbose\n File "/usr/lib64/python3.6/xmlrpc/client.py", line 1154, in request\n return self.single_request(host, handler, request_body, verbose)\n File "/usr/lib64/python3.6/xmlrpc/client.py", line 1166, in single_requ est\n http_conn = self.send_request(host, handler, request_body, verbose)\n File "/usr/lib64/python3.6/xmlrpc/client.py", line 1279, in send_request\n self.send_content(connection, request_body)\n File "/usr/lib64/python3.6/xmlrpc/client.py", line 1309, in send_con tent\n connection.endheaders(request_body)\n File "/usr/lib64/python3.6/http/client.py", line 1249, in endheaders\n self._send_output(message_body, encode_chunked=encode_chunked)\n File "/usr/lib64/python3.6/http/client.py", line 1036, in _send_output\n self.sen d(msg)\n File "/usr/lib64/python3.6/http/client.py", line 974, in send\n self.connect()\n File "/usr/lib/python3.6/site-packages/ovirt_hosted_engine_ha/lib/unixrpc.py", line 74, in connect\n self.sock.connect(base64.b16decode(self.host))\nFileNotFoundError: [Errno 2] No such file or directory', 'rc': 1, 'start': '2020-06-12 17:33:17.982995', 'end': '2020-06-12 17:33:18.164197', 'delta': '0:00:00.181202', 'changed': True, 'invocation': {'module_args': {'_raw_params': 'hosted-engine --reinitialize-lockspace --force', 'warn': True, '_u ses_shell': False, 'stdin_add_newline': True, 'strip_empty_ends': True, 'argv': None, 'chdir': None, 'executable': None, 'creates': None, 'removes': None, 'stdin': None}}, 'stdout_lines': [], 'stderr_lines': ['Traceback (most recent call last):', ' File "/usr/lib64/python 3.6/runpy.py", line 193, in _run_module_as_main', ' "__main__", mod_spec)', ' File "/usr/lib64/python3.6/runpy.py", line 85, in _run_code', ' exec(code, run_globals)', ' File "/usr/lib/python3.6/site-packages/ovirt_hosted_engine_setup/reinitialize_lockspace.py", li ne 30, in <module>', ' ha_cli.reset_lockspace(force)', ' File "/usr/lib/python3.6/site-packages/ovirt_hosted_engine_ha/client/client.py", line 286, in reset_lockspace', ' stats = broker.get_stats_from_storage()', ' File "/usr/lib/python3.6/site-packages/ovirt_hoste d_engine_ha/lib/brokerlink.py", line 148, in get_stats_from_storage', ' result = self._proxy.get_stats()', ' File "/usr/lib64/python3.6/xmlrpc/client.py", line 1112, in __call__', ' return self.__send(self.__name, args)', ' File "/usr/lib64/python3.6/xmlrpc/client. py", line 1452, in __request', ' verbose=self.__verbose', ' File "/usr/lib64/python3.6/xmlrpc/client.py", line 1154, in request', ' return self.single_request(host, handler, request_body, verbose)', ' File "/usr/lib64/python3.6/xmlrpc/client.py", line 1166, in sing le_request', ' http_conn = self.send_request(host, handler, request_body, verbose)', ' File "/usr/lib64/python3.6/xmlrpc/client.py", line 1279, in send_request', ' self.send_content(connection, request_body)', ' File "/usr/lib64/python3.6/xmlrpc/client.py", line 13 09, in send_content', ' connection.endheaders(request_body)', ' File "/usr/lib64/python3.6/http/client.py", line 1249, in endheaders', ' self._send_output(message_body, encode_chunked=encode_chunked)', ' File "/usr/lib64/python3.6/http/client.py", line 1036, in _se nd_output', ' self.send(msg)', ' File "/usr/lib64/python3.6/http/client.py", line 974, in send', ' self.connect()', ' File "/usr/lib/python3.6/site-packages/ovirt_hosted_engine_ha/lib/unixrpc.py", line 74, in connect', ' self.sock.connect(base64.b16decode(self.h ost))', 'FileNotFoundError: [Errno 2] No such file or directory'], '_ansible_no_log': False, 'attempts': 5} Bonus question: I can see the following in the gluster volume log on the storage host: [2020-06-12 17:30:38.368773] E [MSGID: 113072] [posix-inode-fd-ops.c:1976:posix_writev] 0-engine-posix: write failed: offset 0, [Invalid argument] [2020-06-12 17:30:38.368832] E [MSGID: 115067] [server-rpc-fops_v2.c:1372:server4_writev_cbk] 0-engine-server: 190586: WRITEV 4 (baf5fbaa-0dc0-4ee4-bfd9-fa98f8853827), client: CTX_ID:be1aca7a-5ba7-453d-94fd-d24f8c33511e-GRAPH_ID:0-PID:121217-HOST:vmhost-PC_NAME:engine-client-0-RECON_NO:-0, error-xlator: engine-posix [Invalid argument] There are some entries every few minutes like this (not like 100s per minute). Since gluster is completely new for me, I'm still trying to find out whether this might be related. Thanks for any input! Best regards Oliver

2 2

Skype for Bussines
by ozmen62＠hotmail.com 13 Jun '20

13 Jun '20

Hi, While using "skype for bussiness" on guest machine we've been getting sound and video problem. i've found a solution on https://docs.microsoft.com/en-us/skypeforbusiness/deploy/deploy-clients/dep… web page. But this is only for windows client and nor for spice connection Does anyone has a solution for this problem? Thanks

2 1

Re: oVirt noVNC
by Staniforth, Paul 12 Jun '20

12 Jun '20

Sorry Anton, I'm trying to get a lot of things sorted before the weekend. This seems the wrong way round, if you follow the documentation you shouldn't have the symbolic link on the working system unless you replaced the file it was pointing to. Do you have certificate bundles for both systems? Regards, Paul S. ________________________________ From: Anton Louw <Anton.Louw(a)voxtelecom.co.za> Sent: 12 June 2020 11:44 To: Staniforth, Paul <P.Staniforth(a)leedsbeckett.ac.uk>; users(a)ovirt.org <users(a)ovirt.org> Subject: RE: oVirt noVNC Caution External Mail: Do not click any links or open any attachments unless you trust the sender and know that the content is safe. Thanks Paul, So the symbolic link has then been removed, as per the below. Not quite sure where to go from here. Anton Louw Cloud Engineer: Storage and Virtualization at Vox ________________________________ T: 087 805 0000 | D: 087 805 1572 M: N/A E: anton.louw(a)voxtelecom.co.za<mailto:anton.louw@voxtelecom.co.za> A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg www.vox.co.za<https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.vox.co…> [F]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.faceb…> [T]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.twitt…> [I]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.insta…> [L]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.linke…> [Y]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.youtu…> From: Staniforth, Paul <P.Staniforth(a)leedsbeckett.ac.uk> Sent: 12 June 2020 12:30 To: Anton Louw <Anton.Louw(a)voxtelecom.co.za>; users(a)ovirt.org Subject: Re: oVirt noVNC Yes Anton, I think it's in the documentation it's Steps 2 & 3 * * The Engine has been configured to use /etc/pki/ovirt-engine/apache-ca.pem, which is symbolically linked to /etc/pki/ovirt-engine/ca.pem. Remove the symbolic link. # rm /etc/pki/ovirt-engine/apache-ca.pem * Save your CA certificate as /etc/pki/ovirt-engine/apache-ca.pem. # cp /tmp/3rd-party-ca-cert.pem /etc/pki/ovirt-engine/apache-ca.pem Regards, Paul S. ________________________________ From: Anton Louw <Anton.Louw(a)voxtelecom.co.za<mailto:Anton.Louw@voxtelecom.co.za>> Sent: 12 June 2020 11:06 To: Staniforth, Paul <P.Staniforth(a)leedsbeckett.ac.uk<mailto:P.Staniforth@leedsbeckett.ac.uk>>; users(a)ovirt.org<mailto:users@ovirt.org> <users(a)ovirt.org<mailto:users@ovirt.org>> Subject: RE: oVirt noVNC Caution External Mail: Do not click any links or open any attachments unless you trust the sender and know that the content is safe. Hi Paul, Double checked the permissions as well. All seems to be fine. The only thing that does look different between the environments are the below: ENV1 (Not working) [cid:image001.png@01D640B7.2B69DFC0] ENV2 (Working) [cid:image007.png@01D640B7.2B69DFC0] It seems that on the working environment, there is a shortcut file (apached-ca.pem) which points to the ca.pem file, but on the environment that is not working, the apache-ca.pem file is not a shortcut. Could this perhaps be an issue? Thanks Anton Louw Cloud Engineer: Storage and Virtualization at Vox ________________________________ T: 087 805 0000 | D: 087 805 1572 M: N/A E: anton.louw(a)voxtelecom.co.za<mailto:anton.louw@voxtelecom.co.za> A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg www.vox.co.za<https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.vox.co…> [F]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.faceb…> [T]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.twitt…> [I]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.insta…> [L]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.linke…> [Y]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.youtu…> From: Staniforth, Paul <P.Staniforth(a)leedsbeckett.ac.uk<mailto:P.Staniforth@leedsbeckett.ac.uk>> Sent: 12 June 2020 10:44 To: Anton Louw <Anton.Louw(a)voxtelecom.co.za<mailto:Anton.Louw@voxtelecom.co.za>>; users(a)ovirt.org<mailto:users@ovirt.org> Subject: Re: oVirt noVNC No worries, If all is pointing to the correct files I would check permissions. Regards, Paul S. ________________________________ From: Anton Louw <Anton.Louw(a)voxtelecom.co.za<mailto:Anton.Louw@voxtelecom.co.za>> Sent: 12 June 2020 09:34 To: Staniforth, Paul <P.Staniforth(a)leedsbeckett.ac.uk<mailto:P.Staniforth@leedsbeckett.ac.uk>>; users(a)ovirt.org<mailto:users@ovirt.org> <users(a)ovirt.org<mailto:users@ovirt.org>> Subject: RE: oVirt noVNC Caution External Mail: Do not click any links or open any attachments unless you trust the sender and know that the content is safe. Hi Paul, Thanks for the reply. Apologies, I should have added that I have installed our own certificates. The main problem I am facing is that the noVNC console just refuses to open, I get the attached error with any VM I try and access. I should have perhaps started with this issue in my first mail, apologies ?? Thanks Anton Louw Cloud Engineer: Storage and Virtualization at Vox ________________________________ T: 087 805 0000 | D: 087 805 1572 M: N/A E: anton.louw(a)voxtelecom.co.za<mailto:anton.louw@voxtelecom.co.za> A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg www.vox.co.za<https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.vox.co…> [F]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.faceb…> [T]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.twitt…> [I]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.insta…> [L]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.linke…> [Y]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.youtu…> From: Staniforth, Paul <P.Staniforth(a)leedsbeckett.ac.uk<mailto:P.Staniforth@leedsbeckett.ac.uk>> Sent: 12 June 2020 10:29 To: users(a)ovirt.org<mailto:users@ovirt.org>; Anton Louw <Anton.Louw(a)voxtelecom.co.za<mailto:Anton.Louw@voxtelecom.co.za>> Subject: Re: oVirt noVNC Hello Anton, if your organisation has it's own CA you can install your own certificates or get certificates from a trusted CA. https://www.ovirt.org/documentation/admin-guide/appe-oVirt_and_SSL.html<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ovirt…> Paul S. ________________________________ From: Anton Louw via Users <users(a)ovirt.org<mailto:users@ovirt.org>> Sent: 12 June 2020 08:56 To: users(a)ovirt.org<mailto:users@ovirt.org> <users(a)ovirt.org<mailto:users@ovirt.org>> Subject: [ovirt-users] oVirt noVNC Caution External Mail: Do not click any links or open any attachments unless you trust the sender and know that the content is safe. Hi Everybody, With regards to noVNC, is it a requirement to install the CA into your local browser? I would like users to access their VM console, but with no additional work from their side, ie. Downloading the CA and importing it. Thank you Anton Louw Cloud Engineer: Storage and Virtualization at Vox ________________________________ T: 087 805 0000 | D: 087 805 1572 M: N/A E: anton.louw(a)voxtelecom.co.za<mailto:anton.louw@voxtelecom.co.za> A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg www.vox.co.za<https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.vox.co…> [F]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.faceb…> [T]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.twitt…> [I]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.insta…> [L]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.linke…> [Y]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.youtu…> [#VoxBrand]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.vox.c…> Disclaimer The contents of this email are confidential to the sender and the intended recipient. Unless the contents are clearly and entirely of a personal nature, they are subject to copyright in favour of the holding company of the Vox group of companies. Any recipient who receives this email in error should immediately report the error to the sender and permanently delete this email from all storage devices. This email has been scanned for viruses and malware, and may have been automatically archived by Mimecast Ltd, an innovator in Software as a Service (SaaS) for business. Providing a safer and more useful place for your human generated data. Specializing in; Security, archiving and compliance. To find out more Click Here<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.voxte…>. To view the terms under which this email is distributed, please go to:- http://leedsbeckett.ac.uk/disclaimer/email/ To view the terms under which this email is distributed, please go to:- http://leedsbeckett.ac.uk/disclaimer/email/ To view the terms under which this email is distributed, please go to:- http://leedsbeckett.ac.uk/disclaimer/email/ To view the terms under which this email is distributed, please go to:- http://leedsbeckett.ac.uk/disclaimer/email/

1 0

Re: oVirt noVNC
by Anton Louw 12 Jun '20

12 Jun '20

Thanks Paul, So the symbolic link has then been removed, as per the below. Not quite sure where to go from here. Anton Louw Cloud Engineer: Storage and Virtualization ______________________________________ D: 087 805 1572 | M: N/A A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg anton.louw(a)voxtelecom.co.za www.vox.co.za From: Staniforth, Paul <P.Staniforth(a)leedsbeckett.ac.uk> Sent: 12 June 2020 12:30 To: Anton Louw <Anton.Louw(a)voxtelecom.co.za>; users(a)ovirt.org Subject: Re: oVirt noVNC Yes Anton, I think it's in the documentation it's Steps 2 & 3 • • The Engine has been configured to use /etc/pki/ovirt-engine/apache-ca.pem, which is symbolically linked to /etc/pki/ovirt-engine/ca.pem. Remove the symbolic link. # rm /etc/pki/ovirt-engine/apache-ca.pem • Save your CA certificate as /etc/pki/ovirt-engine/apache-ca.pem. # cp /tmp/3rd-party-ca-cert.pem /etc/pki/ovirt-engine/apache-ca.pem Regards, Paul S. ________________________________ From: Anton Louw <Anton.Louw(a)voxtelecom.co.za<mailto:Anton.Louw@voxtelecom.co.za>> Sent: 12 June 2020 11:06 To: Staniforth, Paul <P.Staniforth(a)leedsbeckett.ac.uk<mailto:P.Staniforth@leedsbeckett.ac.uk>>; users(a)ovirt.org<mailto:users@ovirt.org> <users(a)ovirt.org<mailto:users@ovirt.org>> Subject: RE: oVirt noVNC Caution External Mail: Do not click any links or open any attachments unless you trust the sender and know that the content is safe. Hi Paul, Double checked the permissions as well. All seems to be fine. The only thing that does look different between the environments are the below: ENV1 (Not working) [cid:image001.png@01D640B7.2B69DFC0] ENV2 (Working) [cid:image007.png@01D640B7.2B69DFC0] It seems that on the working environment, there is a shortcut file (apached-ca.pem) which points to the ca.pem file, but on the environment that is not working, the apache-ca.pem file is not a shortcut. Could this perhaps be an issue? Thanks Anton Louw Cloud Engineer: Storage and Virtualization at Vox ________________________________ T: 087 805 0000 | D: 087 805 1572 M: N/A E: anton.louw(a)voxtelecom.co.za<mailto:anton.louw@voxtelecom.co.za> A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg www.vox.co.za<https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.vox.co…> [F]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.faceb…> [T]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.twitt…> [I]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.insta…> [L]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.linke…> [Y]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.youtu…> From: Staniforth, Paul <P.Staniforth(a)leedsbeckett.ac.uk<mailto:P.Staniforth@leedsbeckett.ac.uk>> Sent: 12 June 2020 10:44 To: Anton Louw <Anton.Louw(a)voxtelecom.co.za<mailto:Anton.Louw@voxtelecom.co.za>>; users(a)ovirt.org<mailto:users@ovirt.org> Subject: Re: oVirt noVNC No worries, If all is pointing to the correct files I would check permissions. Regards, Paul S. ________________________________ From: Anton Louw <Anton.Louw(a)voxtelecom.co.za<mailto:Anton.Louw@voxtelecom.co.za>> Sent: 12 June 2020 09:34 To: Staniforth, Paul <P.Staniforth(a)leedsbeckett.ac.uk<mailto:P.Staniforth@leedsbeckett.ac.uk>>; users(a)ovirt.org<mailto:users@ovirt.org> <users(a)ovirt.org<mailto:users@ovirt.org>> Subject: RE: oVirt noVNC Caution External Mail: Do not click any links or open any attachments unless you trust the sender and know that the content is safe. Hi Paul, Thanks for the reply. Apologies, I should have added that I have installed our own certificates. The main problem I am facing is that the noVNC console just refuses to open, I get the attached error with any VM I try and access. I should have perhaps started with this issue in my first mail, apologies 😊 Thanks Anton Louw Cloud Engineer: Storage and Virtualization at Vox ________________________________ T: 087 805 0000 | D: 087 805 1572 M: N/A E: anton.louw(a)voxtelecom.co.za<mailto:anton.louw@voxtelecom.co.za> A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg www.vox.co.za<https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.vox.co…> [F]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.faceb…> [T]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.twitt…> [I]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.insta…> [L]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.linke…> [Y]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.youtu…> From: Staniforth, Paul <P.Staniforth(a)leedsbeckett.ac.uk<mailto:P.Staniforth@leedsbeckett.ac.uk>> Sent: 12 June 2020 10:29 To: users(a)ovirt.org<mailto:users@ovirt.org>; Anton Louw <Anton.Louw(a)voxtelecom.co.za<mailto:Anton.Louw@voxtelecom.co.za>> Subject: Re: oVirt noVNC Hello Anton, if your organisation has it's own CA you can install your own certificates or get certificates from a trusted CA. https://www.ovirt.org/documentation/admin-guide/appe-oVirt_and_SSL.html<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ovirt…> Paul S. ________________________________ From: Anton Louw via Users <users(a)ovirt.org<mailto:users@ovirt.org>> Sent: 12 June 2020 08:56 To: users(a)ovirt.org<mailto:users@ovirt.org> <users(a)ovirt.org<mailto:users@ovirt.org>> Subject: [ovirt-users] oVirt noVNC Caution External Mail: Do not click any links or open any attachments unless you trust the sender and know that the content is safe. Hi Everybody, With regards to noVNC, is it a requirement to install the CA into your local browser? I would like users to access their VM console, but with no additional work from their side, ie. Downloading the CA and importing it. Thank you Anton Louw Cloud Engineer: Storage and Virtualization at Vox ________________________________ T: 087 805 0000 | D: 087 805 1572 M: N/A E: anton.louw(a)voxtelecom.co.za<mailto:anton.louw@voxtelecom.co.za> A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg www.vox.co.za<https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.vox.co…> [F]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.faceb…> [T]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.twitt…> [I]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.insta…> [L]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.linke…> [Y]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.youtu…> [#VoxBrand]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.vox.c…> Disclaimer The contents of this email are confidential to the sender and the intended recipient. Unless the contents are clearly and entirely of a personal nature, they are subject to copyright in favour of the holding company of the Vox group of companies. Any recipient who receives this email in error should immediately report the error to the sender and permanently delete this email from all storage devices. This email has been scanned for viruses and malware, and may have been automatically archived by Mimecast Ltd, an innovator in Software as a Service (SaaS) for business. Providing a safer and more useful place for your human generated data. Specializing in; Security, archiving and compliance. To find out more Click Here<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.voxte…>. To view the terms under which this email is distributed, please go to:- http://leedsbeckett.ac.uk/disclaimer/email/<http://leedsbeckett.ac.uk/disclaimer/email/> To view the terms under which this email is distributed, please go to:- http://leedsbeckett.ac.uk/disclaimer/email/<http://leedsbeckett.ac.uk/disclaimer/email/> To view the terms under which this email is distributed, please go to:- http://leedsbeckett.ac.uk/disclaimer/email/<http://leedsbeckett.ac.uk/disclaimer/email/>

1 0

Re: oVirt noVNC
by Staniforth, Paul 12 Jun '20

12 Jun '20

Yes Anton, I think it's in the documentation it's Steps 2 & 3 * * The Engine has been configured to use /etc/pki/ovirt-engine/apache-ca.pem, which is symbolically linked to /etc/pki/ovirt-engine/ca.pem. Remove the symbolic link. # rm /etc/pki/ovirt-engine/apache-ca.pem * Save your CA certificate as /etc/pki/ovirt-engine/apache-ca.pem. # cp /tmp/3rd-party-ca-cert.pem /etc/pki/ovirt-engine/apache-ca.pem Regards, Paul S. ________________________________ From: Anton Louw <Anton.Louw(a)voxtelecom.co.za> Sent: 12 June 2020 11:06 To: Staniforth, Paul <P.Staniforth(a)leedsbeckett.ac.uk>; users(a)ovirt.org <users(a)ovirt.org> Subject: RE: oVirt noVNC Caution External Mail: Do not click any links or open any attachments unless you trust the sender and know that the content is safe. Hi Paul, Double checked the permissions as well. All seems to be fine. The only thing that does look different between the environments are the below: ENV1 (Not working) [cid:image001.png@01D640B1.B1BEAA20] ENV2 (Working) [cid:image007.png@01D640B1.E97498D0] It seems that on the working environment, there is a shortcut file (apached-ca.pem) which points to the ca.pem file, but on the environment that is not working, the apache-ca.pem file is not a shortcut. Could this perhaps be an issue? Thanks Anton Louw Cloud Engineer: Storage and Virtualization at Vox ________________________________ T: 087 805 0000 | D: 087 805 1572 M: N/A E: anton.louw(a)voxtelecom.co.za<mailto:anton.louw@voxtelecom.co.za> A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg www.vox.co.za<https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.vox.co…> [F]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.faceb…> [T]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.twitt…> [I]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.insta…> [L]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.linke…> [Y]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.youtu…> From: Staniforth, Paul <P.Staniforth(a)leedsbeckett.ac.uk> Sent: 12 June 2020 10:44 To: Anton Louw <Anton.Louw(a)voxtelecom.co.za>; users(a)ovirt.org Subject: Re: oVirt noVNC No worries, If all is pointing to the correct files I would check permissions. Regards, Paul S. ________________________________ From: Anton Louw <Anton.Louw(a)voxtelecom.co.za<mailto:Anton.Louw@voxtelecom.co.za>> Sent: 12 June 2020 09:34 To: Staniforth, Paul <P.Staniforth(a)leedsbeckett.ac.uk<mailto:P.Staniforth@leedsbeckett.ac.uk>>; users(a)ovirt.org<mailto:users@ovirt.org> <users(a)ovirt.org<mailto:users@ovirt.org>> Subject: RE: oVirt noVNC Caution External Mail: Do not click any links or open any attachments unless you trust the sender and know that the content is safe. Hi Paul, Thanks for the reply. Apologies, I should have added that I have installed our own certificates. The main problem I am facing is that the noVNC console just refuses to open, I get the attached error with any VM I try and access. I should have perhaps started with this issue in my first mail, apologies ? Thanks Anton Louw Cloud Engineer: Storage and Virtualization at Vox ________________________________ T: 087 805 0000 | D: 087 805 1572 M: N/A E: anton.louw(a)voxtelecom.co.za<mailto:anton.louw@voxtelecom.co.za> A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg www.vox.co.za<https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.vox.co…> [F]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.faceb…> [T]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.twitt…> [I]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.insta…> [L]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.linke…> [Y]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.youtu…> From: Staniforth, Paul <P.Staniforth(a)leedsbeckett.ac.uk<mailto:P.Staniforth@leedsbeckett.ac.uk>> Sent: 12 June 2020 10:29 To: users(a)ovirt.org<mailto:users@ovirt.org>; Anton Louw <Anton.Louw(a)voxtelecom.co.za<mailto:Anton.Louw@voxtelecom.co.za>> Subject: Re: oVirt noVNC Hello Anton, if your organisation has it's own CA you can install your own certificates or get certificates from a trusted CA. https://www.ovirt.org/documentation/admin-guide/appe-oVirt_and_SSL.html<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ovirt…> Paul S. ________________________________ From: Anton Louw via Users <users(a)ovirt.org<mailto:users@ovirt.org>> Sent: 12 June 2020 08:56 To: users(a)ovirt.org<mailto:users@ovirt.org> <users(a)ovirt.org<mailto:users@ovirt.org>> Subject: [ovirt-users] oVirt noVNC Caution External Mail: Do not click any links or open any attachments unless you trust the sender and know that the content is safe. Hi Everybody, With regards to noVNC, is it a requirement to install the CA into your local browser? I would like users to access their VM console, but with no additional work from their side, ie. Downloading the CA and importing it. Thank you Anton Louw Cloud Engineer: Storage and Virtualization at Vox ________________________________ T: 087 805 0000 | D: 087 805 1572 M: N/A E: anton.louw(a)voxtelecom.co.za<mailto:anton.louw@voxtelecom.co.za> A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg www.vox.co.za<https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.vox.co…> [F]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.faceb…> [T]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.twitt…> [I]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.insta…> [L]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.linke…> [Y]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.youtu…> [#VoxBrand]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.vox.c…> Disclaimer The contents of this email are confidential to the sender and the intended recipient. Unless the contents are clearly and entirely of a personal nature, they are subject to copyright in favour of the holding company of the Vox group of companies. Any recipient who receives this email in error should immediately report the error to the sender and permanently delete this email from all storage devices. This email has been scanned for viruses and malware, and may have been automatically archived by Mimecast Ltd, an innovator in Software as a Service (SaaS) for business. Providing a safer and more useful place for your human generated data. Specializing in; Security, archiving and compliance. To find out more Click Here<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.voxte…>. To view the terms under which this email is distributed, please go to:- http://leedsbeckett.ac.uk/disclaimer/email/ To view the terms under which this email is distributed, please go to:- http://leedsbeckett.ac.uk/disclaimer/email/ To view the terms under which this email is distributed, please go to:- http://leedsbeckett.ac.uk/disclaimer/email/

1 0

Re: oVirt noVNC
by Kim Kargaard 12 Jun '20

12 Jun '20

Yes, in the end, it was a permission on the one CA file, that was set to 700 and should have been 750 (if I remember correctly). From: Anton Louw <Anton.Louw(a)voxtelecom.co.za> Date: Friday, 12 June 2020 at 12:01 To: Kim Kargaard <Kim.Kargaard(a)noroff.no>, "Staniforth, Paul" <P.Staniforth(a)leedsbeckett.ac.uk>, "users(a)ovirt.org" <users(a)ovirt.org> Subject: RE: [ovirt-users] Re: oVirt noVNC Hi Kim, Hopefully 😊 I will still run through a couple of checks, I am sure it is something small I am missing. Was your issue due to owner and permissions? Yes, for some of our offerings we do use oVirt. Anton Louw Cloud Engineer: Storage and Virtualization at Vox ________________________________ T: 087 805 0000 | D: 087 805 1572 M: N/A E: anton.louw(a)voxtelecom.co.za<mailto:anton.louw@voxtelecom.co.za> A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg www.vox.co.za<http://www.vox.co.za> [F]<https://www.facebook.com/voxtelecomZA> [T]<https://www.twitter.com/voxtelecom> [I]<https://www.instagram.com/voxtelecomza/> [L]<https://www.linkedin.com/company/voxtelecom> [Y]<https://www.youtube.com/user/VoxTelecom> From: Kim Kargaard <Kim.Kargaard(a)noroff.no> Sent: 12 June 2020 11:43 To: Anton Louw <Anton.Louw(a)voxtelecom.co.za>; Staniforth, Paul <P.Staniforth(a)leedsbeckett.ac.uk>; users(a)ovirt.org Subject: Re: [ovirt-users] Re: oVirt noVNC Hi Anton, Don´t worry, it had me tearing out hair for a while. But, Paul managed to save my remaining hair, so hopefully he has a suggestion that will sort things out for you too 😊 By the way, is Vox using ovirt as their cloud system for customers? Just curious of course. Kind regards Kim From: Anton Louw <Anton.Louw(a)voxtelecom.co.za<mailto:Anton.Louw@voxtelecom.co.za>> Date: Friday, 12 June 2020 at 11:36 To: Kim Kargaard <Kim.Kargaard(a)noroff.no<mailto:Kim.Kargaard@noroff.no>>, "Staniforth, Paul" <P.Staniforth(a)leedsbeckett.ac.uk<mailto:P.Staniforth@leedsbeckett.ac.uk>>, "users(a)ovirt.org<mailto:users@ovirt.org>" <users(a)ovirt.org<mailto:users@ovirt.org>> Subject: RE: [ovirt-users] Re: oVirt noVNC Hi Kim, Thanks for the reply. I double checked the permissions on the cert files now, and they are exactly the same as my other environment. But, the other environment does not have a CA, these are the default certs from ovirt. The other environment is working as expected though. I have checked the websocket service and config, and it seems to be correct. The port is also open on the firewall. I can telnet to my FQDN on port 6100. This is breaking my spirit 😊 Anton Louw Cloud Engineer: Storage and Virtualization at Vox ________________________________ T: 087 805 0000 | D: 087 805 1572 M: N/A E: anton.louw(a)voxtelecom.co.za<mailto:anton.louw@voxtelecom.co.za> A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg www.vox.co.za<http://www.vox.co.za> [F]<https://www.facebook.com/voxtelecomZA> [T]<https://www.twitter.com/voxtelecom> [I]<https://www.instagram.com/voxtelecomza/> [L]<https://www.linkedin.com/company/voxtelecom> [Y]<https://www.youtube.com/user/VoxTelecom> From: Kim Kargaard <Kim.Kargaard(a)noroff.no<mailto:Kim.Kargaard@noroff.no>> Sent: 12 June 2020 10:51 To: Anton Louw <Anton.Louw(a)voxtelecom.co.za<mailto:Anton.Louw@voxtelecom.co.za>>; Staniforth, Paul <P.Staniforth(a)leedsbeckett.ac.uk<mailto:P.Staniforth@leedsbeckett.ac.uk>>; users(a)ovirt.org<mailto:users@ovirt.org> Subject: Re: [ovirt-users] Re: oVirt noVNC Have you checked that websocket proxy is configured and running? Is the port open on the firewall? And finally, have you checked the ownerships and permissions of the cert files on the engine server? The permissions was where we came unstuck for a while 😊 The individual users should not need to download the CA, the novnc browser option should just open the VM, if the settings are right. From: Anton Louw via Users <users(a)ovirt.org<mailto:users@ovirt.org>> Reply to: Anton Louw <Anton.Louw(a)voxtelecom.co.za<mailto:Anton.Louw@voxtelecom.co.za>> Date: Friday, 12 June 2020 at 10:48 To: "Staniforth, Paul" <P.Staniforth(a)leedsbeckett.ac.uk<mailto:P.Staniforth@leedsbeckett.ac.uk>>, "users(a)ovirt.org<mailto:users@ovirt.org>" <users(a)ovirt.org<mailto:users@ovirt.org>> Subject: [ovirt-users] Re: oVirt noVNC Hi Paul, Thanks for the reply. Apologies, I should have added that I have installed our own certificates. The main problem I am facing is that the noVNC console just refuses to open, I get the attached error with any VM I try and access. I should have perhaps started with this issue in my first mail, apologies 😊 Thanks Anton Louw Cloud Engineer: Storage and Virtualization at Vox ________________________________ T: 087 805 0000 | D: 087 805 1572 M: N/A E: anton.louw(a)voxtelecom.co.za<mailto:anton.louw@voxtelecom.co.za> A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg www.vox.co.za<http://www.vox.co.za> [F]<https://www.facebook.com/voxtelecomZA> [T]<https://www.twitter.com/voxtelecom> [I]<https://www.instagram.com/voxtelecomza/> [L]<https://www.linkedin.com/company/voxtelecom> [Y]<https://www.youtube.com/user/VoxTelecom> From: Staniforth, Paul <P.Staniforth(a)leedsbeckett.ac.uk<mailto:P.Staniforth@leedsbeckett.ac.uk>> Sent: 12 June 2020 10:29 To: users(a)ovirt.org<mailto:users@ovirt.org>; Anton Louw <Anton.Louw(a)voxtelecom.co.za<mailto:Anton.Louw@voxtelecom.co.za>> Subject: Re: oVirt noVNC Hello Anton, if your organisation has it's own CA you can install your own certificates or get certificates from a trusted CA. https://www.ovirt.org/documentation/admin-guide/appe-oVirt_and_SSL.html Paul S. ________________________________ From: Anton Louw via Users <users(a)ovirt.org<mailto:users@ovirt.org>> Sent: 12 June 2020 08:56 To: users(a)ovirt.org<mailto:users@ovirt.org> <users(a)ovirt.org<mailto:users@ovirt.org>> Subject: [ovirt-users] oVirt noVNC Caution External Mail: Do not click any links or open any attachments unless you trust the sender and know that the content is safe. Hi Everybody, With regards to noVNC, is it a requirement to install the CA into your local browser? I would like users to access their VM console, but with no additional work from their side, ie. Downloading the CA and importing it. Thank you Anton Louw Cloud Engineer: Storage and Virtualization at Vox ________________________________ T: 087 805 0000 | D: 087 805 1572 M: N/A E: anton.louw(a)voxtelecom.co.za<mailto:anton.louw@voxtelecom.co.za> A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg www.vox.co.za<https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.vox.co…> [Image removed by sender. F]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.faceb…> [Image removed by sender. T]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.twitt…> [Image removed by sender. I]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.insta…> [Image removed by sender. L]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.linke…> [Image removed by sender. Y]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.youtu…> [Image removed by sender. #VoxBrand]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.vox.c…> Disclaimer The contents of this email are confidential to the sender and the intended recipient. Unless the contents are clearly and entirely of a personal nature, they are subject to copyright in favour of the holding company of the Vox group of companies. Any recipient who receives this email in error should immediately report the error to the sender and permanently delete this email from all storage devices. This email has been scanned for viruses and malware, and may have been automatically archived by Mimecast Ltd, an innovator in Software as a Service (SaaS) for business. Providing a safer and more useful place for your human generated data. Specializing in; Security, archiving and compliance. To find out more Click Here<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.voxte…>. To view the terms under which this email is distributed, please go to:- http://leedsbeckett.ac.uk/disclaimer/email/

1 0

Re: oVirt noVNC
by Anton Louw 12 Jun '20

12 Jun '20

Hi Paul, Double checked the permissions as well. All seems to be fine. The only thing that does look different between the environments are the below: ENV1 (Not working) [cid:image001.png@01D640B1.B1BEAA20] ENV2 (Working) [cid:image007.png@01D640B1.E97498D0] It seems that on the working environment, there is a shortcut file (apached-ca.pem) which points to the ca.pem file, but on the environment that is not working, the apache-ca.pem file is not a shortcut. Could this perhaps be an issue? Thanks Anton Louw Cloud Engineer: Storage and Virtualization ______________________________________ D: 087 805 1572 | M: N/A A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg anton.louw(a)voxtelecom.co.za www.vox.co.za From: Staniforth, Paul <P.Staniforth(a)leedsbeckett.ac.uk> Sent: 12 June 2020 10:44 To: Anton Louw <Anton.Louw(a)voxtelecom.co.za>; users(a)ovirt.org Subject: Re: oVirt noVNC No worries, If all is pointing to the correct files I would check permissions. Regards, Paul S. ________________________________ From: Anton Louw <Anton.Louw(a)voxtelecom.co.za<mailto:Anton.Louw@voxtelecom.co.za>> Sent: 12 June 2020 09:34 To: Staniforth, Paul <P.Staniforth(a)leedsbeckett.ac.uk<mailto:P.Staniforth@leedsbeckett.ac.uk>>; users(a)ovirt.org<mailto:users@ovirt.org> <users(a)ovirt.org<mailto:users@ovirt.org>> Subject: RE: oVirt noVNC Caution External Mail: Do not click any links or open any attachments unless you trust the sender and know that the content is safe. Hi Paul, Thanks for the reply. Apologies, I should have added that I have installed our own certificates. The main problem I am facing is that the noVNC console just refuses to open, I get the attached error with any VM I try and access. I should have perhaps started with this issue in my first mail, apologies 😊 Thanks Anton Louw Cloud Engineer: Storage and Virtualization at Vox ________________________________ T: 087 805 0000 | D: 087 805 1572 M: N/A E: anton.louw(a)voxtelecom.co.za<mailto:anton.louw@voxtelecom.co.za> A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg www.vox.co.za<https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.vox.co…> [F]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.faceb…> [T]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.twitt…> [I]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.insta…> [L]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.linke…> [Y]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.youtu…> From: Staniforth, Paul <P.Staniforth(a)leedsbeckett.ac.uk<mailto:P.Staniforth@leedsbeckett.ac.uk>> Sent: 12 June 2020 10:29 To: users(a)ovirt.org<mailto:users@ovirt.org>; Anton Louw <Anton.Louw(a)voxtelecom.co.za<mailto:Anton.Louw@voxtelecom.co.za>> Subject: Re: oVirt noVNC Hello Anton, if your organisation has it's own CA you can install your own certificates or get certificates from a trusted CA. https://www.ovirt.org/documentation/admin-guide/appe-oVirt_and_SSL.html<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ovirt…> Paul S. ________________________________ From: Anton Louw via Users <users(a)ovirt.org<mailto:users@ovirt.org>> Sent: 12 June 2020 08:56 To: users(a)ovirt.org<mailto:users@ovirt.org> <users(a)ovirt.org<mailto:users@ovirt.org>> Subject: [ovirt-users] oVirt noVNC Caution External Mail: Do not click any links or open any attachments unless you trust the sender and know that the content is safe. Hi Everybody, With regards to noVNC, is it a requirement to install the CA into your local browser? I would like users to access their VM console, but with no additional work from their side, ie. Downloading the CA and importing it. Thank you Anton Louw Cloud Engineer: Storage and Virtualization at Vox ________________________________ T: 087 805 0000 | D: 087 805 1572 M: N/A E: anton.louw(a)voxtelecom.co.za<mailto:anton.louw@voxtelecom.co.za> A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg www.vox.co.za<https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.vox.co…> [F]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.faceb…> [T]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.twitt…> [I]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.insta…> [L]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.linke…> [Y]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.youtu…> [#VoxBrand]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.vox.c…> Disclaimer The contents of this email are confidential to the sender and the intended recipient. Unless the contents are clearly and entirely of a personal nature, they are subject to copyright in favour of the holding company of the Vox group of companies. Any recipient who receives this email in error should immediately report the error to the sender and permanently delete this email from all storage devices. This email has been scanned for viruses and malware, and may have been automatically archived by Mimecast Ltd, an innovator in Software as a Service (SaaS) for business. Providing a safer and more useful place for your human generated data. Specializing in; Security, archiving and compliance. To find out more Click Here<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.voxte…>. To view the terms under which this email is distributed, please go to:- http://leedsbeckett.ac.uk/disclaimer/email/<http://leedsbeckett.ac.uk/disclaimer/email/> To view the terms under which this email is distributed, please go to:- http://leedsbeckett.ac.uk/disclaimer/email/<http://leedsbeckett.ac.uk/disclaimer/email/>

1 0

Re: oVirt noVNC
by Kim Kargaard 12 Jun '20

12 Jun '20

Hi Anton, Don´t worry, it had me tearing out hair for a while. But, Paul managed to save my remaining hair, so hopefully he has a suggestion that will sort things out for you too 😊 By the way, is Vox using ovirt as their cloud system for customers? Just curious of course. Kind regards Kim From: Anton Louw <Anton.Louw(a)voxtelecom.co.za> Date: Friday, 12 June 2020 at 11:36 To: Kim Kargaard <Kim.Kargaard(a)noroff.no>, "Staniforth, Paul" <P.Staniforth(a)leedsbeckett.ac.uk>, "users(a)ovirt.org" <users(a)ovirt.org> Subject: RE: [ovirt-users] Re: oVirt noVNC Hi Kim, Thanks for the reply. I double checked the permissions on the cert files now, and they are exactly the same as my other environment. But, the other environment does not have a CA, these are the default certs from ovirt. The other environment is working as expected though. I have checked the websocket service and config, and it seems to be correct. The port is also open on the firewall. I can telnet to my FQDN on port 6100. This is breaking my spirit 😊 Anton Louw Cloud Engineer: Storage and Virtualization at Vox ________________________________ T: 087 805 0000 | D: 087 805 1572 M: N/A E: anton.louw(a)voxtelecom.co.za<mailto:anton.louw@voxtelecom.co.za> A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg www.vox.co.za<http://www.vox.co.za> [F]<https://www.facebook.com/voxtelecomZA> [T]<https://www.twitter.com/voxtelecom> [I]<https://www.instagram.com/voxtelecomza/> [L]<https://www.linkedin.com/company/voxtelecom> [Y]<https://www.youtube.com/user/VoxTelecom> From: Kim Kargaard <Kim.Kargaard(a)noroff.no> Sent: 12 June 2020 10:51 To: Anton Louw <Anton.Louw(a)voxtelecom.co.za>; Staniforth, Paul <P.Staniforth(a)leedsbeckett.ac.uk>; users(a)ovirt.org Subject: Re: [ovirt-users] Re: oVirt noVNC Have you checked that websocket proxy is configured and running? Is the port open on the firewall? And finally, have you checked the ownerships and permissions of the cert files on the engine server? The permissions was where we came unstuck for a while 😊 The individual users should not need to download the CA, the novnc browser option should just open the VM, if the settings are right. From: Anton Louw via Users <users(a)ovirt.org<mailto:users@ovirt.org>> Reply to: Anton Louw <Anton.Louw(a)voxtelecom.co.za<mailto:Anton.Louw@voxtelecom.co.za>> Date: Friday, 12 June 2020 at 10:48 To: "Staniforth, Paul" <P.Staniforth(a)leedsbeckett.ac.uk<mailto:P.Staniforth@leedsbeckett.ac.uk>>, "users(a)ovirt.org<mailto:users@ovirt.org>" <users(a)ovirt.org<mailto:users@ovirt.org>> Subject: [ovirt-users] Re: oVirt noVNC Hi Paul, Thanks for the reply. Apologies, I should have added that I have installed our own certificates. The main problem I am facing is that the noVNC console just refuses to open, I get the attached error with any VM I try and access. I should have perhaps started with this issue in my first mail, apologies 😊 Thanks Anton Louw Cloud Engineer: Storage and Virtualization at Vox ________________________________ T: 087 805 0000 | D: 087 805 1572 M: N/A E: anton.louw(a)voxtelecom.co.za<mailto:anton.louw@voxtelecom.co.za> A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg www.vox.co.za<http://www.vox.co.za> [F]<https://www.facebook.com/voxtelecomZA> [T]<https://www.twitter.com/voxtelecom> [I]<https://www.instagram.com/voxtelecomza/> [L]<https://www.linkedin.com/company/voxtelecom> [Y]<https://www.youtube.com/user/VoxTelecom> From: Staniforth, Paul <P.Staniforth(a)leedsbeckett.ac.uk<mailto:P.Staniforth@leedsbeckett.ac.uk>> Sent: 12 June 2020 10:29 To: users(a)ovirt.org<mailto:users@ovirt.org>; Anton Louw <Anton.Louw(a)voxtelecom.co.za<mailto:Anton.Louw@voxtelecom.co.za>> Subject: Re: oVirt noVNC Hello Anton, if your organisation has it's own CA you can install your own certificates or get certificates from a trusted CA. https://www.ovirt.org/documentation/admin-guide/appe-oVirt_and_SSL.html Paul S. ________________________________ From: Anton Louw via Users <users(a)ovirt.org<mailto:users@ovirt.org>> Sent: 12 June 2020 08:56 To: users(a)ovirt.org<mailto:users@ovirt.org> <users(a)ovirt.org<mailto:users@ovirt.org>> Subject: [ovirt-users] oVirt noVNC Caution External Mail: Do not click any links or open any attachments unless you trust the sender and know that the content is safe. Hi Everybody, With regards to noVNC, is it a requirement to install the CA into your local browser? I would like users to access their VM console, but with no additional work from their side, ie. Downloading the CA and importing it. Thank you Anton Louw Cloud Engineer: Storage and Virtualization at Vox ________________________________ T: 087 805 0000 | D: 087 805 1572 M: N/A E: anton.louw(a)voxtelecom.co.za<mailto:anton.louw@voxtelecom.co.za> A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg www.vox.co.za<https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.vox.co…> [Image removed by sender. F]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.faceb…> [Image removed by sender. T]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.twitt…> [Image removed by sender. I]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.insta…> [Image removed by sender. L]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.linke…> [Image removed by sender. Y]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.youtu…> [Image removed by sender. #VoxBrand]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.vox.c…> Disclaimer The contents of this email are confidential to the sender and the intended recipient. Unless the contents are clearly and entirely of a personal nature, they are subject to copyright in favour of the holding company of the Vox group of companies. Any recipient who receives this email in error should immediately report the error to the sender and permanently delete this email from all storage devices. This email has been scanned for viruses and malware, and may have been automatically archived by Mimecast Ltd, an innovator in Software as a Service (SaaS) for business. Providing a safer and more useful place for your human generated data. Specializing in; Security, archiving and compliance. To find out more Click Here<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.voxte…>. To view the terms under which this email is distributed, please go to:- http://leedsbeckett.ac.uk/disclaimer/email/

2 1

Re: oVirt noVNC
by Kim Kargaard 12 Jun '20

12 Jun '20

Have you checked that websocket proxy is configured and running? Is the port open on the firewall? And finally, have you checked the ownerships and permissions of the cert files on the engine server? The permissions was where we came unstuck for a while 😊 The individual users should not need to download the CA, the novnc browser option should just open the VM, if the settings are right. From: Anton Louw via Users <users(a)ovirt.org> Reply to: Anton Louw <Anton.Louw(a)voxtelecom.co.za> Date: Friday, 12 June 2020 at 10:48 To: "Staniforth, Paul" <P.Staniforth(a)leedsbeckett.ac.uk>, "users(a)ovirt.org" <users(a)ovirt.org> Subject: [ovirt-users] Re: oVirt noVNC Hi Paul, Thanks for the reply. Apologies, I should have added that I have installed our own certificates. The main problem I am facing is that the noVNC console just refuses to open, I get the attached error with any VM I try and access. I should have perhaps started with this issue in my first mail, apologies 😊 Thanks Anton Louw Cloud Engineer: Storage and Virtualization at Vox ________________________________ T: 087 805 0000 | D: 087 805 1572 M: N/A E: anton.louw(a)voxtelecom.co.za<mailto:anton.louw@voxtelecom.co.za> A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg www.vox.co.za<http://www.vox.co.za> [F]<https://www.facebook.com/voxtelecomZA> [T]<https://www.twitter.com/voxtelecom> [I]<https://www.instagram.com/voxtelecomza/> [L]<https://www.linkedin.com/company/voxtelecom> [Y]<https://www.youtube.com/user/VoxTelecom> From: Staniforth, Paul <P.Staniforth(a)leedsbeckett.ac.uk> Sent: 12 June 2020 10:29 To: users(a)ovirt.org; Anton Louw <Anton.Louw(a)voxtelecom.co.za> Subject: Re: oVirt noVNC Hello Anton, if your organisation has it's own CA you can install your own certificates or get certificates from a trusted CA. https://www.ovirt.org/documentation/admin-guide/appe-oVirt_and_SSL.html Paul S. ________________________________ From: Anton Louw via Users <users(a)ovirt.org<mailto:users@ovirt.org>> Sent: 12 June 2020 08:56 To: users(a)ovirt.org<mailto:users@ovirt.org> <users(a)ovirt.org<mailto:users@ovirt.org>> Subject: [ovirt-users] oVirt noVNC Caution External Mail: Do not click any links or open any attachments unless you trust the sender and know that the content is safe. Hi Everybody, With regards to noVNC, is it a requirement to install the CA into your local browser? I would like users to access their VM console, but with no additional work from their side, ie. Downloading the CA and importing it. Thank you Anton Louw Cloud Engineer: Storage and Virtualization at Vox ________________________________ T: 087 805 0000 | D: 087 805 1572 M: N/A E: anton.louw(a)voxtelecom.co.za<mailto:anton.louw@voxtelecom.co.za> A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg www.vox.co.za<https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.vox.co…> [Image removed by sender. F]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.faceb…> [Image removed by sender. T]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.twitt…> [Image removed by sender. I]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.insta…> [Image removed by sender. L]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.linke…> [Image removed by sender. Y]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.youtu…> [Image removed by sender. #VoxBrand]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.vox.c…> Disclaimer The contents of this email are confidential to the sender and the intended recipient. Unless the contents are clearly and entirely of a personal nature, they are subject to copyright in favour of the holding company of the Vox group of companies. Any recipient who receives this email in error should immediately report the error to the sender and permanently delete this email from all storage devices. This email has been scanned for viruses and malware, and may have been automatically archived by Mimecast Ltd, an innovator in Software as a Service (SaaS) for business. Providing a safer and more useful place for your human generated data. Specializing in; Security, archiving and compliance. To find out more Click Here<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.voxte…>. To view the terms under which this email is distributed, please go to:- http://leedsbeckett.ac.uk/disclaimer/email/

2 1

Re: oVirt noVNC
by Staniforth, Paul 12 Jun '20

12 Jun '20

No worries, If all is pointing to the correct files I would check permissions. Regards, Paul S. ________________________________ From: Anton Louw <Anton.Louw(a)voxtelecom.co.za> Sent: 12 June 2020 09:34 To: Staniforth, Paul <P.Staniforth(a)leedsbeckett.ac.uk>; users(a)ovirt.org <users(a)ovirt.org> Subject: RE: oVirt noVNC Caution External Mail: Do not click any links or open any attachments unless you trust the sender and know that the content is safe. Hi Paul, Thanks for the reply. Apologies, I should have added that I have installed our own certificates. The main problem I am facing is that the noVNC console just refuses to open, I get the attached error with any VM I try and access. I should have perhaps started with this issue in my first mail, apologies ? Thanks Anton Louw Cloud Engineer: Storage and Virtualization at Vox ________________________________ T: 087 805 0000 | D: 087 805 1572 M: N/A E: anton.louw(a)voxtelecom.co.za<mailto:anton.louw@voxtelecom.co.za> A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg www.vox.co.za<https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.vox.co…> [F]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.faceb…> [T]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.twitt…> [I]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.insta…> [L]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.linke…> [Y]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.youtu…> From: Staniforth, Paul <P.Staniforth(a)leedsbeckett.ac.uk> Sent: 12 June 2020 10:29 To: users(a)ovirt.org; Anton Louw <Anton.Louw(a)voxtelecom.co.za> Subject: Re: oVirt noVNC Hello Anton, if your organisation has it's own CA you can install your own certificates or get certificates from a trusted CA. https://www.ovirt.org/documentation/admin-guide/appe-oVirt_and_SSL.html<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ovirt…> Paul S. ________________________________ From: Anton Louw via Users <users(a)ovirt.org<mailto:users@ovirt.org>> Sent: 12 June 2020 08:56 To: users(a)ovirt.org<mailto:users@ovirt.org> <users(a)ovirt.org<mailto:users@ovirt.org>> Subject: [ovirt-users] oVirt noVNC Caution External Mail: Do not click any links or open any attachments unless you trust the sender and know that the content is safe. Hi Everybody, With regards to noVNC, is it a requirement to install the CA into your local browser? I would like users to access their VM console, but with no additional work from their side, ie. Downloading the CA and importing it. Thank you Anton Louw Cloud Engineer: Storage and Virtualization at Vox ________________________________ T: 087 805 0000 | D: 087 805 1572 M: N/A E: anton.louw(a)voxtelecom.co.za<mailto:anton.louw@voxtelecom.co.za> A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg www.vox.co.za<https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.vox.co…> [F]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.faceb…> [T]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.twitt…> [I]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.insta…> [L]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.linke…> [Y]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.youtu…> [#VoxBrand]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.vox.c…> Disclaimer The contents of this email are confidential to the sender and the intended recipient. Unless the contents are clearly and entirely of a personal nature, they are subject to copyright in favour of the holding company of the Vox group of companies. Any recipient who receives this email in error should immediately report the error to the sender and permanently delete this email from all storage devices. This email has been scanned for viruses and malware, and may have been automatically archived by Mimecast Ltd, an innovator in Software as a Service (SaaS) for business. Providing a safer and more useful place for your human generated data. Specializing in; Security, archiving and compliance. To find out more Click Here<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.voxte…>. To view the terms under which this email is distributed, please go to:- http://leedsbeckett.ac.uk/disclaimer/email/ To view the terms under which this email is distributed, please go to:- http://leedsbeckett.ac.uk/disclaimer/email/

1 0

Re: oVirt noVNC
by Anton Louw 12 Jun '20

12 Jun '20

Hi Paul, Thanks for the reply. Apologies, I should have added that I have installed our own certificates. The main problem I am facing is that the noVNC console just refuses to open, I get the attached error with any VM I try and access. I should have perhaps started with this issue in my first mail, apologies 😊 Thanks Anton Louw Cloud Engineer: Storage and Virtualization ______________________________________ D: 087 805 1572 | M: N/A A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg anton.louw(a)voxtelecom.co.za www.vox.co.za From: Staniforth, Paul <P.Staniforth(a)leedsbeckett.ac.uk> Sent: 12 June 2020 10:29 To: users(a)ovirt.org; Anton Louw <Anton.Louw(a)voxtelecom.co.za> Subject: Re: oVirt noVNC Hello Anton, if your organisation has it's own CA you can install your own certificates or get certificates from a trusted CA. https://www.ovirt.org/documentation/admin-guide/appe-oVirt_and_SSL.html<https://www.ovirt.org/documentation/admin-guide/appe-oVirt_and_SSL.html> Paul S. ________________________________ From: Anton Louw via Users <users(a)ovirt.org<mailto:users@ovirt.org>> Sent: 12 June 2020 08:56 To: users(a)ovirt.org<mailto:users@ovirt.org> <users(a)ovirt.org<mailto:users@ovirt.org>> Subject: [ovirt-users] oVirt noVNC Caution External Mail: Do not click any links or open any attachments unless you trust the sender and know that the content is safe. Hi Everybody, With regards to noVNC, is it a requirement to install the CA into your local browser? I would like users to access their VM console, but with no additional work from their side, ie. Downloading the CA and importing it. Thank you Anton Louw Cloud Engineer: Storage and Virtualization at Vox ________________________________ T: 087 805 0000 | D: 087 805 1572 M: N/A E: anton.louw(a)voxtelecom.co.za<mailto:anton.louw@voxtelecom.co.za> A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg www.vox.co.za<https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.vox.co…> [F]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.faceb…> [T]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.twitt…> [I]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.insta…> [L]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.linke…> [Y]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.youtu…> [#VoxBrand]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.vox.c…> Disclaimer The contents of this email are confidential to the sender and the intended recipient. Unless the contents are clearly and entirely of a personal nature, they are subject to copyright in favour of the holding company of the Vox group of companies. Any recipient who receives this email in error should immediately report the error to the sender and permanently delete this email from all storage devices. This email has been scanned for viruses and malware, and may have been automatically archived by Mimecast Ltd, an innovator in Software as a Service (SaaS) for business. Providing a safer and more useful place for your human generated data. Specializing in; Security, archiving and compliance. To find out more Click Here<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.voxte…>. To view the terms under which this email is distributed, please go to:- http://leedsbeckett.ac.uk/disclaimer/email/<http://leedsbeckett.ac.uk/disclaimer/email/>

1 0

Re: oVirt noVNC
by Staniforth, Paul 12 Jun '20

12 Jun '20

Hello Anton, if your organisation has it's own CA you can install your own certificates or get certificates from a trusted CA. https://www.ovirt.org/documentation/admin-guide/appe-oVirt_and_SSL.html Paul S. ________________________________ From: Anton Louw via Users <users(a)ovirt.org> Sent: 12 June 2020 08:56 To: users(a)ovirt.org <users(a)ovirt.org> Subject: [ovirt-users] oVirt noVNC Caution External Mail: Do not click any links or open any attachments unless you trust the sender and know that the content is safe. Hi Everybody, With regards to noVNC, is it a requirement to install the CA into your local browser? I would like users to access their VM console, but with no additional work from their side, ie. Downloading the CA and importing it. Thank you Anton Louw Cloud Engineer: Storage and Virtualization at Vox ________________________________ T: 087 805 0000 | D: 087 805 1572 M: N/A E: anton.louw(a)voxtelecom.co.za<mailto:anton.louw@voxtelecom.co.za> A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg www.vox.co.za<https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.vox.co…> [F]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.faceb…> [T]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.twitt…> [I]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.insta…> [L]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.linke…> [Y]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.youtu…> [#VoxBrand]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.vox.c…> Disclaimer The contents of this email are confidential to the sender and the intended recipient. Unless the contents are clearly and entirely of a personal nature, they are subject to copyright in favour of the holding company of the Vox group of companies. Any recipient who receives this email in error should immediately report the error to the sender and permanently delete this email from all storage devices. This email has been scanned for viruses and malware, and may have been automatically archived by Mimecast Ltd, an innovator in Software as a Service (SaaS) for business. Providing a safer and more useful place for your human generated data. Specializing in; Security, archiving and compliance. To find out more Click Here<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.voxte…>. To view the terms under which this email is distributed, please go to:- http://leedsbeckett.ac.uk/disclaimer/email/

1 0

oVirt noVNC
by Anton Louw 12 Jun '20

12 Jun '20

Hi Everybody, With regards to noVNC, is it a requirement to install the CA into your local browser? I would like users to access their VM console, but with no additional work from their side, ie. Downloading the CA and importing it. Thank you Anton Louw Cloud Engineer: Storage and Virtualization ______________________________________ D: 087 805 1572 | M: N/A A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg anton.louw(a)voxtelecom.co.za www.vox.co.za

1 0

PKIX path error
by Stack Korora 11 Jun '20

11 Jun '20

Greetings, I have a running oVirt install that's been working for almost 2 years. I'm building a _completely_ new install. I mention it because it is useful for me to compare configurations when I run into issues like this one. Right now there are three physical hosts: 1x management where I run the engine and db 2x hypervisor nodes. I had it up and installed and running smooth this morning on 4.3.9.4-1.el7 on Scientific Linux 7.8 (fully patched). I copied over our 3rd party certs from the running system and restarted httpd. Perfect. SSL is running! /etc/pki/ovirt-engine/apache-ca.pem /etc/pki/ovirt-engine/certs/apache.cer /etc/pki/ovirt-engine/keys/apache.key.nopass Next I used ovirt-engine-extension-aaa-ldap-setup to point to our ldap server. I did the login and search test and both passed on the command line! Horray! Then I went to the web interface... sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target I'm digging through logs and I don't see anything close to this error except nearly the identical message in engine.log. ERROR [org.ovirt.engine.core.aaa.servlet.SslPostLoginServlet] (default task-2) [] server_error: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target I can't log in via the web at all, I only get that message (so I can't even test out the local admin). The aaa ldap configuration it generated is darn near perfectly identical (just a name change). The certs are the same. Even when I look in the keystore, the sha1 hashes are the same between the two environments! After over an hour poking at this, I'm completely stumped. Can someone please give me a pointer on what I should try next? Thanks! ~Stack~

3 8

Gluster remount?
by Christoph Köhler 11 Jun '20

11 Jun '20

Hey, it happens in our ovirt 4.3.9 occasionally that after reboot one of the dedicated gluster nodes (replica3, arbiter 1) some client connections are missing on server side: # gluster volume status gluvol3 clients Client connections for volume gluvol3 ---------------------------------------------- Brick : glusrv01:/gluster/p1/brick1 Clients connected : 17 Hostname . . . -------------------------------------------- Brick : glusrv02:/gluster/p1/brick1 Clients connected : 15 <---- two connections missing Hostname . . . ---------------------------------------------- Brick : glusrv03:/gluster/p1/brick1 Clients connected : 17 Hostname . . . ---------------------------------------------- I don't know why it happes, the log files don't really help. Now: is there a possibility on the missing nodes to reinitiate the gluster mount like 'mount -o remount' or so? The only way I actually know is to set the concerned node to maintenance and reactivate it. But that is really long-moving with many VMs... Any ideas? Thanks Chris

1 0

[ANN] oVirt 4.4.1 Fourth Release Candidate is now available for testing
by Sandro Bonazzola 11 Jun '20

11 Jun '20

oVirt 4.4.1 Fourth Release Candidate is now available for testing The oVirt Project is pleased to announce the availability of oVirt 4.4.1 Fourth Release Candidate for testing, as of June 11th, 2020. This update is the first in a series of stabilization updates to the 4.4 series. Important notes before you try it Please note this is a pre-release build. The oVirt Project makes no guarantees as to its suitability or usefulness. This pre-release must not be used in production. Some of the features included in oVirt 4.4.1 Release Candidate require content that will be available in CentOS Linux 8.2 but can’t be tested on RHEL 8.2 yet due to some incompatibility in openvswitch package shipped in CentOS Virt SIG which requires to rebuild openvswitch on top of CentOS 8.2. Installation instructions For the engine: either use appliance or: - Install CentOS Linux 8 minimal from http://centos.mirror.garr.it/centos/8.1.1911/isos/x86_64/CentOS-8.1.1911-x8… - dnf install https://resources.ovirt.org/pub/yum-repo/ovirt-release44-pre.rpm - dnf update (reboot if needed) - dnf module enable -y javapackages-tools pki-deps postgresql:12 - dnf install ovirt-engine - engine-setup For the nodes: Either use oVirt Node ISO or: - Install CentOS Linux 8 from http://centos.mirror.garr.it/centos/8.1.1911/isos/x86_64/CentOS-8.1.1911-x8… ; select minimal installation - dnf install https://resources.ovirt.org/pub/yum-repo/ovirt-release44-pre.rpm - dnf update (reboot if needed) - Attach the host to engine and let it be deployed. This release is available now on x86_64 architecture for: * Red Hat Enterprise Linux 8.1 or newer * CentOS Linux (or similar) 8.1 or newer This release supports Hypervisor Hosts on x86_64 and ppc64le architectures for: * Red Hat Enterprise Linux 8.1 or newer * CentOS Linux (or similar) 8.1 or newer * oVirt Node 4.4.1 based on CentOS Linux 8.1 (available for x86_64 only) See the release notes [1] for installation instructions and a list of new features and bugs fixed. Notes: - oVirt Appliance is already available for CentOS Linux 8 - oVirt Node NG is already available for CentOS Linux 8 Additional Resources: * Read more about the oVirt 4.4.1 release highlights: http://www.ovirt.org/release/4.4.1/ * Get more oVirt project updates on Twitter: https://twitter.com/ovirt * Check out the latest project news on the oVirt blog: http://www.ovirt.org/blog/ [1] http://www.ovirt.org/release/4.4.1/ [2] http://resources.ovirt.org/pub/ovirt-4.4-pre/iso/ -- Sandro Bonazzola MANAGER, SOFTWARE ENGINEERING, EMEA R&D RHV Red Hat EMEA <https://www.redhat.com/> sbonazzo(a)redhat.com <https://www.redhat.com/> *Red Hat respects your work life balance. Therefore there is no need to answer this email out of your office hours. <https://mojo.redhat.com/docs/DOC-1199578>*

1 0

teaming vs bonding
by Diggy Mc 10 Jun '20

10 Jun '20

Does 4.4.x support adapter teaming? If yes, which is preferred, teaming or bonding?

7 6

how to test incremental backup in 4.4
by Gianluca Cecchi 10 Jun '20

10 Jun '20

Hello, going to test incremental backup in 4.4. Is this page the updated one to use: https://www.ovirt.org/develop/release-management/features/storage/increment… ? Is there already any ansible module/role ongoing to support it? Thanks, Gianluca

5 17

What happens when shared storage is down?
by Vinícius Ferrão 10 Jun '20

10 Jun '20

Hello, This is a pretty vague and difficult question to answer. But what happens if the shared storage holding the VMs is down or unavailable for a period of time? I’m aware that a longer timeout may put the VMs on pause state, but how this is handled? Is it a time limit? Requests limit? Who manages this? In an event of self recovery of the storage backend what happens next? Manual intervention is required? The VMs may be down or they just continue to run? It depends on the guest OS running like in XenServer where different scenarios may happen? I’ve looked here: https://www.ovirt.org/documentation/admin-guide/chap-Storage.html but there’s nothing that goes about this question. Thanks, Sent from my iPhone

3 4

Ovirt Manager HA
by Vijay Sachdeva 10 Jun '20

10 Jun '20

Hi All, Is there a documentation on creating Ovirt-Manager in HA or is it possible to make the manager to run in HA environment. Since it seems to be a single point of failure..!! Thanks Vijay Sachdeva

4 3

Cannot start ppc64le VM's
by Vinícius Ferrão 10 Jun '20

10 Jun '20

Hello, I’m trying to run ppc64le VM’s on POWER9 but qemu-kvm fails complaining about NUMA issues: VM ppc64le.local.versatushpc.com.br<http://ppc64le.local.versatushpc.com.br> is down with error. Exit message: internal error: qemu unexpectedly closed the monitor: 2020-06-05T06:16:10.716052Z qemu-kvm: warning: CPU(s) not present in any NUMA nodes: CPU 4 [core-id: 4], CPU 5 [core-id: 5], CPU 6 [core-id: 6], CPU 7 [core-id: 7], CPU 8 [core-id: 8], CPU 9 [core-id: 9], CPU 10 [core-id: 10], CPU 11 [core-id: 11], CPU 12 [core-id: 12], CPU 13 [core-id: 13], CPU 14 [core-id: 14], CPU 15 [core-id: 15] 2020-06-05T06:16:10.716067Z qemu-kvm: warning: All CPU(s) up to maxcpus should be described in NUMA config, ability to start up with partial NUMA mappings is obsoleted and will be removed in future 2020-06-05T06:16:11.155924Z qemu-kvm: Requested safe indirect branch capability level not supported by kvm, try cap-ibs=fixed-ibs. Any idea of what’s happening? I found some links, but I’m not sure if they are related or not: https://bugzilla.redhat.com/show_bug.cgi?id=1732726 https://bugzilla.redhat.com/show_bug.cgi?id=1592648 Thanks,

2 5

Re: Global Maintenance
by Yedidyah Bar David 10 Jun '20

10 Jun '20

On Tue, Jun 9, 2020 at 8:03 PM Anton Louw <Anton.Louw(a)voxtelecom.co.za> wrote: > > > > Hi Didi, > > I followed the below steps in order to move the HE to a standalone engine: > > Backup and remove Hosted Engine: > > 1. Backup Hosted Engine (engine-backup --scope=all --mode=backup --file=Full --log=Log_Full) > 2. Download the backup files from HE using WinSCP > 3. Enable global Maintenance (hosted-engine --set-maintenance --mode=global) > 4. Power down hosted engine (hosted-engine --vm-shutdown) > > --------------------------------------------------------------------------------------------- > Redeploy Hosted Engine: > > Build new CentOS VM in another environment > *Same IP > *Same name > *Same resources > > 1. sudo yum install https://resources.ovirt.org/pub/yum-repo/ovirt-release43.rpm > 2. sudo yum install -y ovirt-engine > 3. Copy backup files to newly deployed CentOS VM > 4. engine-backup --mode=restore --file=Full --log=Log_Full --provision-db --provision-dwh-db --restore-permissions > 5. after restore has completed, run engine-setup > > Yes, I get “It seems that you are running your engine inside of the hosted-engine VM and are not in "Global Maintenance" mode” error message when running anything to do with engine-setup. In this case, I would like to reconfigure the Websocket proxy. > > How will I go about updating the below: > > update vds_statistics set ha_global_maintenance=f; Please remember that this isn't tested. Please thoroughly test first on a test setup. One way to do that is: /usr/share/ovirt-engine/dbscripts/engine-psql.sh -c 'update vds_statistics set ha_global_maintenance=f;' As I said, it's probably best to do this while the engine is down, to prevent caching issues etc. Best regards, > > Thank you > > Anton Louw > Cloud Engineer: Storage and Virtualization at Vox > ________________________________ > T: 087 805 0000 | D: 087 805 1572 > M: N/A > E: anton.louw(a)voxtelecom.co.za > A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg > www.vox.co.za > > > > > > > > > Disclaimer > > The contents of this email are confidential to the sender and the intended recipient. Unless the contents are clearly and entirely of a personal nature, they are subject to copyright in favour of the holding company of the Vox group of companies. Any recipient who receives this email in error should immediately report the error to the sender and permanently delete this email from all storage devices. > > This email has been scanned for viruses and malware, and may have been automatically archived by Mimecast Ltd, an innovator in Software as a Service (SaaS) for business. Providing a safer and more useful place for your human generated data. Specializing in; Security, archiving and compliance. To find out more Click Here. > > > > > -----Original Message----- > From: Yedidyah Bar David <didi(a)redhat.com> > Sent: 09 June 2020 15:19 > To: Anton Louw <Anton.Louw(a)voxtelecom.co.za> > Cc: users(a)ovirt.org > Subject: Re: [ovirt-users] Global Maintenance > > On Tue, Jun 9, 2020 at 9:39 AM Anton Louw via Users <users(a)ovirt.org> wrote: > > > > > > > > Hi Everybody, > > > > > > > > Just a bit of background. A couple of weeks back I moved my self-hosted engine to a standalone manager. Everything went smooth, my environment is up and running without any issues. > > How exactly did you do that? > > > Just one thing, when I want to reconfigure settings on my self-hosted engine, it says: > > > > “It seems that you are running your engine inside of the hosted-engine VM and are not in "Global Maintenance" mode” > > This message is in engine-setup, right? > > engine-setup's code is checking this by: > > /usr/share/ovirt-engine/setup/plugins/ovirt-engine-common/ovirt-engine/system/he.py > > SELECT vm_guid, run_on_vds > FROM vms > WHERE vm_name = %(HostedEngineVmName)s; > > where HostedEngineVmName is either the option of same name from vdc_options, or 'HostedEngine' if missing. Then, where VdsId is 'run_on_vds' column of the result of above: > > SELECT vds_id, ha_global_maintenance > FROM vds_statistics > WHERE vds_id = %(VdsId)s; > > So if this isn't a hosted-engine setup anymore, it should probably be safe to do: > > update vds_statistics set ha_global_maintenance=f; > > and perhaps restart the engine (in case it also does similar checks itself but caches this data). > > Please note that I didn't try this myself. > > > > > > > > > When trying to enable global maintenance from my node, I also get the below: > > > > > > > > “Cannot connect to the HA daemon, please check the logs” > > This is expected, no? You say it's not a hosted-engine setup anymore. > > > > > > > > > Is there something I missed when I moved my self-hosted engine to a standalone manager? > > Either Yes, or the procedure you followed is incomplete. If latter, please file a bug about it. Thanks! > > Best regards, > -- > Didi -- Didi

1 0