- Users - oVirt List Archives

oVirt does not get keycloak groups
by Christian Fischer 31 Jan '25

31 Jan '25

Hi everyone. I have setup a oVirt Installation with Keycloak for a PoC-Evaluation but i'm actually struggling with Keycloak Groups sync to oVirt. I Added Active Directory Users and also a Group Mapper for LDAP Groups -> in Keycloak i see all Users and also that they belong to Groups but the Group-Membership is not populated to oVirt back. As a result i can't grant Permissions groupwise - only per user. For the initial group-sync i ticked the Option "Drop non-existing groups during sync" which also deleted the ovirt-administrator group. Maybe this is the main Problem here. I created this group again and unchecked this option but it still does not sync the groups. What do you recommend? Purge the system and do a clean install or is there another easy fix out there? Thanks, have a nice weekend. Greetings Christian

1 0

Questions and Suggestions for oVirt
by Daniel Gurgel 30 Jan '25

30 Jan '25

With the new leadership of the project, most users who admire and support oVirt would like to know the roadmap and future plans. From my perspective, I understand that Red Hat discontinued its support purely for financial reasons. Therefore, this is probably one of the key areas where oVirt needs to strengthen. Wouldn't it be worth seeking support and collaboration with Veeam and Oracle, given its "OLVM"? Especially considering that, after the VMware/Broadcom licensing changes, Oracle has been aggressively offering OLVM to customers as a migration alternative. A positive development was Veeam Backup & Replication recently adding support for OLVM. This has increased interest in the solution, but there are still limitations, such as migration/backup/restore between different hypervisors (interestingly, this feature is available for Proxmox/KVM, which uses similar technology). These are some of the main questions from customers: 1. When will it be updated to Enterprise Linux 9 or 10? 2. What support will be available for new technologies? 3. How about a change in the Engine/Manager, allowing VMs to be managed even when the Engine is unavailable! (Sorry, but this is one of oVirt's biggest bottlenecks, and inevitably, comparisons with VMware/VCenter arise.) 4. Support for VM migration between Datacenters should also be carefully considered. **Note**: The oVirt website needs to be more user-friendly for general users. I also suggest a fundraising campaign—I would be happy to contribute, and I believe the entire user base would as well!

1 0

Re: [EXT]Re: Re: [SOLVED] Re: Re: How to re-enroll (or renew) host certificates for a single-host hosted-engine deployment?
by Cosmin Cioranu 29 Jan '25

29 Jan '25

I have checked the solution and it works, apart from the console feature of the virtual machine. In my case, once a got control over the host, migrated all the vms and then Maintenance and then Enroll Certificate. So: an updated version ``` set -x ## Make the script echo everything out, so if it fails you know where set -e ## Make the script STOP on any error set my_date="$(date +"%Y%m%d%H%M%S")" # Backup the existing CA files /bin/cp -p /etc/pki/ovirt-engine/private/ca.pem /etc/pki/ovirt-engine/private/ca.pem.$my_date /bin/cp -p /etc/pki/ovirt-engine/ca.pem{,.$my_date} /bin/mv /etc/pki/ovirt-engine/certs/ca.der{,.$my_date} # Sign the key openssl x509 -signkey /etc/pki/ovirt-engine/private/ca.pem -in /etc/pki/ovirt-engine/ca.pem -out /etc/pki/ovirt-engine/ca.pem.new -days 3650 -sha256 openssl x509 -in /etc/pki/ovirt-engine/ca.pem.new -text > /etc/pki/ovirt-engine/ca.pem.new.full # Put the files into place /bin/mv -f /etc/pki/ovirt-engine/ca.pem.new.full /etc/pki/ovirt-engine/ca.pem /bin/cp -p /etc/pki/ovirt-engine/ca.pem.new /etc/pki/ovirt-engine/certs/ca.der ``` Now you need to copy the new CA file over to the host: Source: ENGINE `/etc/pki/ovirt-engine/ca.pem` Dest: HOST `/tmp/new-ca.pem` ########### On the oVirt Host ########### # Create a CSR using the information from the existing certificate and the existing key: openssl x509 -x509toreq -in /etc/pki/libvirt/clientcert.pem -out /tmp/HOST.csr -signkey /etc/pki/libvirt/private/clientkey.pem Now you need to copy the new CA file over to the host: Source: HOST `/tmp/HOST.csr` Dest: ENGINE `/etc/pki/ovirt-engine/requests/full.hostname.com.req` ########### On the ENGINE HOST ########### # Now sign it: /usr/share/ovirt-engine/bin/pki-enroll-request.sh --name=full.hostname.com # NB -- adding --san results in an error: --san=host.na.me (So no Subject Alternate Names) Now you need to copy the new Certificate file over to the host: Source: ENGINE /etc/pki/ovirt-engine/certs/full.hostname.com.cer Dest: HOST /tmp/new-cert.pem ########### On the oVirt Host ########### (see bellow the written script) #!/bin/bash #set -x set -e mydate="$(date +"%Y%m%d%H%M%S")" echo "[.] reference ${mydate}" for x in /tmp/new-ca.pem /tmp/new-cert.pem ; do echo -n "[.] checking $x" if [ ! -e "$x" ]; then echo "[not found]" exit else echo "[found]" fi done for x in /etc/pki/libvirt/clientcert.pem /etc/pki/vdsm/certs/vdsmcert.pem /etc/pki/vdsm/libvirt-migrate/server-cert.pem /etc/pki/vdsm/libvirt-spice/server-cert.pem /etc/pki/vdsm/libvirt-vnc/server-cert.pem; do echo -n "copying $x to ${x}.${mydate}" /bin/mv -n $x ${x}.${mydate} echo "[done]"; echo -n "[.] copying /tmp/new-cert.pem to $x" /bin/cp /tmp/new-cert.pem ${x} echo "[done]" echo -n "[.] setting permissions to $x 644 root:kvm" chmod 644 ${x} chown root:kvm ${x} echo "[done]" done for x in /etc/pki/vdsm/libvirt-migrate/ca-cert.pem /etc/pki/vdsm/certs/cacert.pem /etc/pki/vdsm/libvirt-vnc/ca-cert.pem /etc/pki/vdsm/libvirt-spice/ca-cert.pem /etc/pki/CA/cacert.pem; do echo -n "copying $x to ${x}.${mydate}" /bin/mv -n $x ${x}.${mydate} echo "[done]" echo -n "[.] copying /tmp/new-ca.pem to $x" /bin/cp /tmp/new-ca.pem ${x} echo "[done]"; echo -n "[.] setting permissions to $x 644 root:kvm" chmod 644 ${x} chown root:kvm ${x} echo "[done]" done for x in /etc/pki/vdsm/keys/vdsmkey.pem; do echo -n "copying $x to ${x}.${mydate}" /bin/mv -n $x ${x}.${mydate} echo "[done]" echo -n "[.] copying /etc/pki/libvirt/private/clientkey.pem to $x" /bin/cp /etc/pki/libvirt/private/clientkey.pem ${x} echo "[done]"; echo -n "[.] setting permissions to $x 644 root:kvm" chmod 644 ${x} chown root:kvm ${x} echo "[done]" done echo "[.] Checks " openssl x509 -in /etc/pki/libvirt/clientcert.pem -noout -dates openssl x509 -in /etc/pki/vdsm/certs/cacert.pem -noout -dates openssl x509 -in /etc/pki/vdsm/certs/vdsmcert.pem -noout -dates openssl x509 -in /etc/pki/vdsm/libvirt-migrate/ca-cert.pem -noout -dates openssl x509 -in /etc/pki/vdsm/libvirt-migrate/client-cert.pem -noout -dates openssl x509 -in /etc/pki/vdsm/libvirt-migrate/server-cert.pem -noout -dates openssl x509 -in /etc/pki/vdsm/libvirt-spice/ca-cert.pem -noout -dates openssl x509 -in /etc/pki/vdsm/libvirt-spice/server-cert.pem -noout -dates ```` Note: I whould backup the entire pki folder on both node and engine.

1 0

snapshot solution: Existing snapshots that were taken after this one will be erased.
by dhanaraj.ramesh＠yahoo.com 29 Jan '25

29 Jan '25

Hi Team, when I want to commit the older snapshots I'm getting warning stating " Existing snapshots that were taken after this one will be erased.". is there any way we can retain the latest snapshots as is in the chain? I knew cloning and template export options are there to secure that latest snapshot data but these are will consume additional space in storage and take time.

4 3

Re: [External] : Re: Unable to migrate vm with 4 (500g) disks from vmware to ovirt.
by dushyantk.sun＠gmail.com 24 Jan '25

24 Jan '25

Hi Marcos and Simon, Provided document was helpful. Thank you.

1 0

Re: [External] : Re: Unable to migrate vm with 4 (500g) disks from vmware to ovirt.
by dushyantk.sun＠gmail.com 23 Jan '25

23 Jan '25

Currently linux vm which i am trying to migrate has 4 (500GB) disk. All disks on same datastore. It is iscsi datastore. Do we have any configuration where we can enabled verbose mode while migration is going on to see what is happening as currently unable to identify failure. Also is there any limitation if vms with multiple disk is not possible to migrate?

2 2

Unable to migrate vm with 4 (500g) disks from vmware to ovirt.
by dushyantk.sun＠gmail.com 23 Jan '25

23 Jan '25

I have vm with multiple disk attached to it. While migrating vm from vmware to ovirt, it started but gets failed after 5-6 hours. However vms with single disk migrated successfully. Following ovirt UI to migrate vm. Please let me know if any one come across such scenario

4 6

oVirt Translations & Future
by Jean-Louis Dupond 23 Jan '25

23 Jan '25

Hi, We've setup some alternative for the (dead) Zanata translation project for oVirt. You can find the Weblate setup on the following location: https://translate.ovirt.tech/projects/ovirt-engine/ So if somebody wants to add translations, feel free! :) Will try to add translations for the other projects the coming days. Next to that, we are working hard to get oVirt better! If you want to help, feel free to open PR's or send me an mail. A lot can be done, so you won't get bored. Some things that we are looking into: - Java updates - Wildfly update - AlmaLinux 10 / CentOS Stream 10 support Feel free to contact me if you have further questions. Jean-Louis

6 7

Re: [External] : OLVM/ovirt 4.5 support for 5th Gen Intel Xeon Gold (Emerald Rapids)
by Simon Coter 23 Jan '25

23 Jan '25

Hi Hassan, we internally fixed it by reverting our patch and use the oVirt community one: <https://github.com/oVirt/ovirt-engine/pull/978> [978.png] core: Introduce new Intel, AMD and IBM CPU's by JasperB-TeamBlue · Pull Request #978 · oVirt/ovirt-engine<https://github.com/oVirt/ovirt-engine/pull/978> github.com<https://github.com/oVirt/ovirt-engine/pull/978> This will be released as part of the next Errata for OLVM. Simon On Jan 23, 2025, at 9:44 AM, Hassan Shabbir <hshabbir315(a)gmail.com> wrote: Hello Simon, Thank you for the response, what about 5th Gen Emerald Rapids? correct me if i'm wrong: support for 4th Gen Sapphire Rapids is already in place in OLVM. Regards, On Thu, Jan 23, 2025, 1:32 PM Simon Coter <simon.coter(a)oracle.com<mailto:simon.coter@oracle.com>> wrote: We introduced a patch to address the Sapphire Rapids family support on OLVM 4.5.5 We recently synced our patch with the one had been pushed by the oVirt community and should be out quite soon. Simon > On Jan 19, 2025, at 9:28 PM, hshabbir315(a)gmail.com<mailto:hshabbir315@gmail.com> wrote: > > Hi Guys, > > Can someone please confirm if 5th Gen Intel Gold (Emerald Rapids) CPUs are compatible with OLVM/ovirt 4.5.5.x? We have a OLVM/ovirt 4.5.5.x test lab setup cluster running on older hardware (Intel(R) Xeon(R) CPU E5-2660 v3 @ 2.60GHz - Haswell Family) with compatibility version 4.7. While going through the engine db backup we observed that there are no entries in the vdc_options table for Emerald Rapids family of Intel CPUs. Does this mean that these CPUs are not supported by ovirt 4.5.5.x? or these CPUs are supported but the extra features/instruction sets offered by these CPUs over Sapphire Rapids family of Intel CPUs will not be available to the VMs? > > Regards, > _______________________________________________ > Users mailing list -- users(a)ovirt.org<mailto:users@ovirt.org> > To unsubscribe send an email to users-leave(a)ovirt.org<mailto:users-leave@ovirt.org> > Privacy Statement: https://urldefense.com/v3/__https://www.ovirt.org/privacy-policy.html__;!!A… > oVirt Code of Conduct: https://urldefense.com/v3/__https://www.ovirt.org/community/about/community… > List Archives: https://urldefense.com/v3/__https://lists.ovirt.org/archives/list/users@ovi…

1 0

OLVM/ovirt 4.5 support for 5th Gen Intel Xeon Gold (Emerald Rapids)
by hshabbir315＠gmail.com 23 Jan '25

23 Jan '25

Hi Guys, Can someone please confirm if 5th Gen Intel Gold (Emerald Rapids) CPUs are compatible with OLVM/ovirt 4.5.5.x? We have a OLVM/ovirt 4.5.5.x test lab setup cluster running on older hardware (Intel(R) Xeon(R) CPU E5-2660 v3 @ 2.60GHz - Haswell Family) with compatibility version 4.7. While going through the engine db backup we observed that there are no entries in the vdc_options table for Emerald Rapids family of Intel CPUs. Does this mean that these CPUs are not supported by ovirt 4.5.5.x? or these CPUs are supported but the extra features/instruction sets offered by these CPUs over Sapphire Rapids family of Intel CPUs will not be available to the VMs? Regards,

2 1

Re: [External] : The KVM Host Status Stucking in Connecting
by natchawi28＠gmail.com 22 Jan '25

22 Jan '25

Hi, What about the version differences between the Engine and the KVM host? Does it matter? Engine: Oracle Linux 8.10 Kernel 5.15.0-302.167.6.el8uek.x86_64 KVM Host: Oracle Linux 8.6 Kernel 5.4.17-2136.311.6.1.el8uek.x86_64 I checked the Cluster Compatibility Version, and it appears to be compatible. Thank you,

2 1

ovirtmgmt claims no defroute after RHEL upgrade from 8.10 to 9.5
by Austin Coppock 22 Jan '25

22 Jan '25

First off apologies, I am unable to post log files as my oVirt servers have no access to the Internet. I have several oVirt clusters, all were running oVirt 4.5 on RHEL 8.10. I am in the process of upgrading them to RHEL 9.5. with a few minor updates of oVirt packages. The steps I used to do this are: • Backup up the standalone engine DB • Rebuild the engine to RHEL 9.5, reinstall oVirt, restore the DB • Log back in to the engine, place first hypervisor into maintenance and rebuild to RHEL 9.5. • Remove old hypervisor via the engine GUI and add back in to the cluster • Repeat for each hypervisor until all are upgraded. This has worked perfectly, everything seems to be normal, but I then noticed that if I select the “Network Interfaces” tab on a hypervisor it shows my bonded interface as “Out-of-sync”, clicking the “Sync All Networks” does nothing. If I click on “Setup Host Networks” and hover the mouse over the ovirtmgmt interface I see the message “Default Route. Host: false DC: true” If I run the command “vdsm-client Host getNetworkCapabilities” on the hypervisor, it shows that the {bridges: ovirtmgmt: ipv4defaultroute false} and {networks: ovirtmgmt: ipv4defaultroute false } on my clusters that are still on RHEL 8.10 the above command shows ipv4defaultroute true. Running the command “ip route show” shows that my default route IS on device ovirtmgmt I am not experiencing any network issues, but getting rid of this out-of-sync message would be nice. Is this a bug or a bad status issue? Or do I have some obscure setting not correct? For both RHEL 8.10 and RHEL 9.5 builds we have used Ansible to perform the tasks, (with minor tweaks). So, the same procedure has been used for both.

1 1

The KVM Host Status Stucking in Connecting
by natchawi28＠gmail.com 21 Jan '25

21 Jan '25

Please help me, I found that my Cluster is in Non-responsive status. When I look at the Host menu page, I see that the status is Connecting and it has been stuck for a long time and I can't do anything. Has anyone experienced this and how do I fix it? https://img5.pic.in.th/file/secure-sv1/Screenshot-2025-01-21-151647.png

2 1

additional language
by ebugaev＠itkey.com 20 Jan '25

20 Jan '25

Are there instructions on how to add an additional language to ovirt-engine? What needs to be done so that an additional language appears in the language selection list on the main page of the engine?

1 0

Renewal of VDSM certificate in one node cluster
by ikbal.charen＠kepler-technologies.com 20 Jan '25

20 Jan '25

Hello, I have a single-node cluster running Hosted Engine, version 4.4.10. While I'm able to renew the engine certificate, I'm unable to renew the VDSM certificate because I cannot put the host into maintenance mode (since it is running the Hosted Engine VM). What steps can I take to resolve this? Best regards,

1 0

Host reboot take an awful lot of time
by duparchy＠esrf.fr 20 Jan '25

20 Jan '25

KVM host is upgraded then rebooted. It seems OK (ssh available, no particular activity) but it takes an awful lot of time for the manager to acknowledge it and let us activating the host. This makes the upgrade process of a whole infrastructure (several hosts) very very long. Is it just us ? (oVirt 4.5 "Oracle" flavor)

3 2

Help With CPU Type
by Daniel Martins 20 Jan '25

20 Jan '25

Hi There, Please may you assist me with the below? I need to remove an oVirt host within a cluster that is using CPU Type Intel Westmere IBRS SSBD Family. Once the host is removed i need to change the CPU type to Intel Broadwell which the remaining hosts Use. So my question is will there need to be down time on the Virtual machines to change this? Regards, [cid:image001.png@01DB6B29.AA668C00]

1 0

Re: [External] : Really weird ! Image IO / browser upload only working on 1 cluster (out of many) - anyone got any advice ? (network access, certs seem fine.)
by morgan cox 17 Jan '25

17 Jan '25

Hi Marcos. Thanks for taking the time to respond... In reference to your questions : Are you using a single Engine deployment to manage all DCs/Clusters : Yes Which browser are you using to upload the image : I have tried 2 Firefox and Chrome (note it works on one cluster - the one that hosts1/2 are connected to) Can you try the upload process from a different browser or desktop/laptop?: Tired a different browser, cannot try different laptop - I have network access to the engine . Also - everything else seems ok - in NoVNC, Serial , etc just image io Any suggestions where to look into this ? Thanks

3 2

Intel CPUs supported by OLVM/ovirt 4.5
by Syed Hassan Shabbir 17 Jan '25

17 Jan '25

Hi, Guys, can someone plz guide me regarding ovirt support for the following CPUs: 1- Intel® Xeon® Gold 5520+ Processor 52.5M Cache, 2.20 GHz (Emerald Rapids) 2- Intel® Xeon® Gold 6526Y Processor 37.5M Cache, 2.80 GHz (Emerald Rapids) 3- Intel® Xeon® Gold 6426Y Processor 37.5M Cache, 2.50 GHz (Sapphire Rapids) 4- Intel® Xeon® Gold 5420+ Processor 52.5M Cache, 2.00 GHz (Sapphire Rapids) 5- Intel® Xeon® Silver 4510 Processor 30M Cache, 2.40 GHz (Sapphire Rapids) I want to deploy OLVM on these servers but couldn't find any entries in the vdc_options table for 5th Gen 'Emerald Rapids'. I am testing with ovirt version 4.5. Regards, Hassan

1 0

Welcome Jean-Louis Dupond to the oVirt Board
by Sandro Bonazzola 17 Jan '25

17 Jan '25

On behalf of the oVirt Board I’m thrilled to announce an exciting new addition: Jean-Louis Dupond. Jean-Louis brings a wealth of experience, expertise, and passion for open-source virtualization, making him an exceptional fit for the oVirt community. Read the full announce on the oVirt blog at https://blogs.ovirt.org/2025/01/welcome-jean-louis-dupond-to-the-ovirt-boar… -- Sandro Bonazzola

4 3

Managing Users with Keycloak WebUI
by Vladislav Solovei 16 Jan '25

16 Jan '25

Hello! I have a question about managing users through the Keycloak WebUI. With oVirt 4.5. Can I do this? Is it the right approach? Or should I avoid doing it? For example, if I want to create a user with 2FA (OTP)

1 0

Really weird ! Image IO / browser upload only working on 1 cluster (out of many) - anyone got any advice ? (network access, certs seem fine.)
by morgan cox 16 Jan '25

16 Jan '25

One for the mystery van .. I am running OLVM/ Ovirt 4.5 (engine) - hosts presently mised 4.4.x and 4.5.x - however version doesn't seen to be the issue We have muliple DC's/Clusters each cluster has 2 hosts and then have access to different fc SAN volumes - each san vol is a sperate storaqe domain I,e host 1 + host 2 --> San 1 host 3 + host 4 --> San 2 , etc SAN connection for the hosts/clusters generally is working fine and I can also upload to any SAN volume using the upload script - /usr/share/doc/python3-ovirt-engine-sdk4/examples/upload_disk.py However imageio via browser ... We have a major issue. I am not able to upload (via browser) any files to any storage domain apart from 1... (say San 1) Yes, I have imported the CA to browser, and All storage domains pass the 'test connection' -> "Connection to ovirt-imageio was successful." However I can see what the issue is (but not why there is this issue..) In the upload image section of all domains the available host to use (to piggyback connection) as the same - host 1 + host 2 But those hosts only have access to one SAN not all of them i.e for San 2 I should be able to choose host 3 + 4 ... (but only host 1/2 are showning in all domains..) If I use the upload script it uses correct host and successfully upload - but not via browser.. I have checked and /etc/ovirt-imageio/conf.d/60-vdsm.conf is the same for ALL hosts. Certs seem ok all a I can telnet to all hosts from engine on port 54322 Can anyone give me any ideas how to troubleshoot this ? Thanks

2 1

EOL glusterFS
by Olivier 16 Jan '25

16 Jan '25

Hello, GlusterFS seems to be EOL. At least no more dev from Red Hat, the github doesn't record any move from more than one year. Is there a plan to use another FS on oVirt instead of glusterFS ?

9 9

zanata.ovirt.org
by ebugaev＠itkey.com 15 Jan '25

15 Jan '25

hello, I would like to translate into Russian help me get an account https://zanata.ovirt.org/ to translate the interface, thank you)

3 3

Changing Disk Alocation Policy
by suporte＠logicworks.pt 13 Jan '25

13 Jan '25

Hi, It's possible to change a thin-provision disk to a preallocated disk? Storages are ISCSI Thanks -- Jose Ferradeira http://www.logicworks.pt

4 4