- Users - oVirt List Archives

Unable to remove system roles from Everyone group
by miguel.garcia＠toshibagcs.com 02 May '20

02 May '20

I opened Everyone group and added system role UserRole and realized now that everybody can see all VMS which is not good. I tried to remove the role from the group but got the error "Error while executing action: It's not allowed to remove system permissions assigned to built-in Everyone group" Looking into Ovirt forums I see that this change should be made through the engine database but I was not able to reach that part. Can someone help me out how to remove the system role from Everyone group? or at least reset the group?

2 1

Running Host on sudo user
by carl langlois 30 Apr '20

30 Apr '20

Hi, I was wandering if it is possible to run ovirt node using a sudo user instead of the root user? Let says i want or need to disable root ssh login.. Thanks and regards. Carl

3 3

Can we agree on adding reference to version in help request email?
by Sandro Bonazzola 30 Apr '20

30 Apr '20

Hi, I was looking in the past 2 weeks email landing on this mailing list and a common thing I notice is that it's hard to understand which version of the involved software they're referring too. Can we agree on adding at the top of the message a couple of line like output of yum -q list installed centos-release ovirt-release\* ovirt-engine redhat-release vdsm glusterfs centos-release.x86_64 7-7.1908.0.el7.centos glusterfs.x86_64 6.8-1.el7 ovirt-engine.noarch 4.3.9.4-1.el7 ovirt-release43.noarch 4.3.9-1.el7 It will help understanding if the help request is something that may be already known, a regression, and so on. -- Sandro Bonazzola MANAGER, SOFTWARE ENGINEERING, EMEA R&D RHV Red Hat EMEA <https://www.redhat.com/> sbonazzo(a)redhat.com <https://www.redhat.com/>* <https://www.redhat.com/en/summit?sc_cid=7013a000002D2QxAAK>* *Red Hat respects your work life balance. Therefore there is no need to answer this email out of your office hours.*

3 2

Add custom Network Filter to oVirt
by Hendrik Peyerl 30 Apr '20

30 Apr '20

Hello all, can anyone give me a hint on where to find documentation on how to add custom created network filters through oVirt? Thanks, Hendrik

3 5

Re: Move Hosted Engine VM to a different storage domain
by Yedidyah Bar David 30 Apr '20

30 Apr '20

On Wed, Apr 29, 2020 at 8:42 AM Anton Louw <Anton.Louw(a)voxtelecom.co.za> wrote: > > > Hi, > > > > Thank you for the reply. I am building another environment today, so I > will run through the backup and restore again. I do recall one issue I had > with the restore was that it gave an error that one of the storage domains > were already in use. This was a new storage domain I added, with no VMs on. > > > > I just want to make sure, I probably cannot deploy the HE on a storage > domain that is in maintenance, correct? I will try and create a new storage > domain again, but remove it from the data center, and perhaps see if the HE > will deploy to it. > hosted-engine deploy does not require an "empty storage domain" (in maintenance or not), but one that "does not exist yet" - meaning, a path to storage that will be used as a storage domain, but in which a storage domain was not created yet. The deploy process itself will create the domain there. I hope this clarifies. > > > The main goal was to have no downtime, but if it is going to be too > complex, I think my next option will be to create a new HE, and attach the > current storage domains. Obviously it is going to take a bit of planning, > as I will need to configure all the networks etc. from scratch again. > Good luck and keep us updated! Best regards, > > > Thanks > > > > *Anton Louw* > *Cloud Engineer: Storage and Virtualization* at *Vox* > ------------------------------ > *T:* 087 805 0000 | *D:* 087 805 1572 > *M:* N/A > *E:* anton.louw(a)voxtelecom.co.za > *A:* Rutherford Estate, 1 Scott Street, Waverley, Johannesburg > www.vox.co.za > > [image: F] <https://www.facebook.com/voxtelecomZA> > [image: T] <https://www.twitter.com/voxtelecom> > [image: I] <https://www.instagram.com/voxtelecomza/> > [image: L] <https://www.linkedin.com/company/voxtelecom> > [image: Y] <https://www.youtube.com/user/VoxTelecom> > > *From:* Strahil Nikolov <hunter86_bg(a)yahoo.com> > *Sent:* 26 April 2020 08:55 > *To:* Yedidyah Bar David <didi(a)redhat.com>; Anton Louw < > Anton.Louw(a)voxtelecom.co.za> > *Cc:* users(a)ovirt.org > *Subject:* Re: [ovirt-users] Re: Move Hosted Engine VM to a different > storage domain > > > > On April 26, 2020 9:39:07 AM GMT+03:00, Yedidyah Bar David < > didi(a)redhat.com> wrote: > >On Fri, Apr 24, 2020 at 1:04 PM Anton Louw > ><Anton.Louw(a)voxtelecom.co.za> > >wrote: > > > >> > >> > >> Hi All, > >> > >> > >> > >> I know this question has been asked before, by myself included. I was > >> hoping that someone has run through the exercise of moving the hosted > >> engine VM to a different storage domain. I have tried many routes, > >but the > >> backup and restore does not work for me. > >> > > > >The "standard answer" is backup and restore. Why does it not work? > > > > > >> > >> > >> Is there anybody that can perhaps give me some guidelines or a > >process I > >> can follow? > >> > > > >I didn't try that myself. > > > >The best guidelines I can give you are: Try first on at a test system. > >Do > >the backup on the real machine, create some isolated VM (isolated so > >that > >it does not interfere with your hosts/storage) somewhere to be used as > >a > >test host (or a physical machine if you have one), some storage > >somewhere, > >and restore on it. Make it work. Document what you needed to do. Ask > >here > >with specific questions if/when you have them. Then do on the > >production > >setup. > > > >Also clarify your needs. Do you need no-downtime for the VMs? If so, > >that's > >more complex. If you don't, it might be enough/simpler to deploy a new > >setup and just import the existing storage. Do you have HA VMs? etc. > > > > > >> > >> > >> The reason I need to move the HE VM is because we are decommissioning > >the > >> current storage array where the HE VM is located. > >> > > > >Good luck! > > > >Best regards, > > > > > >> > >> > >> Thank you very much > >> > >> *Anton Louw* > >> *Cloud Engineer: Storage and Virtualization* at *Vox* > >> ------------------------------ > >> *T:* 087 805 0000 | *D:* 087 805 1572 > >> *M:* N/A > >> *E:* anton.louw(a)voxtelecom.co.za > >> *A:* Rutherford Estate, 1 Scott Street, Waverley, Johannesburg > >> www.vox.co.za > >> > >> [image: F] <https://www.facebook.com/voxtelecomZA> > >> [image: T] <https://www.twitter.com/voxtelecom> > >> [image: I] <https://www.instagram.com/voxtelecomza/> > >> [image: L] <https://www.linkedin.com/company/voxtelecom> > >> [image: Y] <https://www.youtube.com/user/VoxTelecom> > >> > >> [image: #VoxBrand] > >> <https://www.vox.co.za/fibre/fibre-to-the-home/?prod=HOME> > >> *Disclaimer* > >> > >> The contents of this email are confidential to the sender and the > >intended > >> recipient. Unless the contents are clearly and entirely of a personal > >> nature, they are subject to copyright in favour of the holding > >company of > >> the Vox group of companies. Any recipient who receives this email in > >error > >> should immediately report the error to the sender and permanently > >delete > >> this email from all storage devices. > >> > >> This email has been scanned for viruses and malware, and may have > >been > >> automatically archived by *Mimecast Ltd*, an innovator in Software as > >a > >> Service (SaaS) for business. Providing a *safer* and *more useful* > >place > >> for your human generated data. Specializing in; Security, archiving > >and > >> compliance. To find out more Click Here > >> <https://www.voxtelecom.co.za/security/mimecast/?prod=Enterprise>. > >> > >> > >> _______________________________________________ > >> Users mailing list -- users(a)ovirt.org > >> To unsubscribe send an email to users-leave(a)ovirt.org > >> Privacy Statement: https://www.ovirt.org/privacy-policy.html > >> oVirt Code of Conduct: > >> https://www.ovirt.org/community/about/community-guidelines/ > >> List Archives: > >> > > > https://lists.ovirt.org/archives/list/users@ovirt.org/message/V3PRBRZD7SLUQ… > >> > > If youchange the gluster volume you can use the 'hosted-engine' tool + > migration of the data ? > > The example is for Gluster, but also > hosted-engine --set-shared-config storage <server1>:/engine > > hosted-engine --set-shared-config mnt_options > backup-volfile-servers=<server2>:<server3> > > Best Regards, > Strahil Nikolov > > -- Didi

1 0

Failed to complete VM creation,help me!
by liug74＠sina.com 29 Apr '20

29 Apr '20

Storage domain usage is as follows： vgdisplay 3542ca36-747b-407c-aa5e-331510f81fd9 --- Volume group --- VG Name 3542ca36-747b-407c-aa5e-331510f81fd9 System ID Format lvm2 Metadata Areas 2 Metadata Sequence No 15998 VG Access read/write VG Status resizable MAX LV 0 Cur LV 1954 Open LV 0 Max PV 0 Cur PV 1 Act PV 1 VG Size 113.97 TiB PE Size 128.00 MiB Total PE 933647 Alloc PE / Size 64930 / <7.93 TiB Free PE / Size 868717 / 106.04 TiB VG UUID GiL1LL-ggO5-a6mX-62uc-q597-B3X9-6bzC93 __________________________________________________________ The following error occurred when I created the VM: VDSM H5 command HSMGetAllTasksStatusesVDS failed: Error creating a new volume: (u"Volume creation 62220be2-2781-4771-9373-84af5cc18f01 failed: (28, 'Sanlock resource write failure', 'No space left on device')",) Excuse me, what's the reason, thank you!

3 2

ovrt node ng 4.4 different fs layout and error if changed
by Gianluca Cecchi 29 Apr '20

29 Apr '20

Hello, In CentOS 7 default filesystem in anaconda was xfs, but in ovirt node ng 4.3.9 (based on CentOS 7) the default layout was set to ext4. In CentOS 8 again the default is xfs and I see that ovirt node ng 4.4 beta4 (based on CentOS 8.1) has now xfs for all filesystems, excluded /boot that is set to ext4. In general I have a preference for ext4. I notice that while in 4.3.9 I could somehow customize partition layout, even if not recommended, in 4.4 I always get error if I don't accept automatic partitioning. What I sometimes do: - select disk and custom layout - click done and the storage page appears - I click the button to create automatically and I get the automatic partitioning layout - and here I can change fs type and update settings button and/or change size of some filesystems (eg for /var/log if using Gluster) Even if I only set all filesystems automatically generated by installer to ext4, without changing any size, in the final stage of installation I get this error and installation aborts: " There was an error running the kickstart script at line 5. This is a fatal error and installation will be aborted. The details of this error are: 2020-04-19 10:37:50,451 [INFO] (MainThread) Trying to create a manageable base from '/' 2020-04-19 10:37:50,811 [ERROR] (MainThread) LVM Thin Provisioning partitioning scheme is required. For autoinstall via Kickstart with LVM Thin Provisioning check options: --thinpool and --grow. Please consult documentation for details Traceback (most recent call last): File "/usr/lib64/python3.6/runpy.py", line 193, in _run_module_as_main "__main__", mod_spec) File "/usr/lib64/python3.6/runpy.py", line 85, in _run_code exec(code, run_globals) File "/usr/lib/python3.6/site-packages/imgbased/__main__.py", line 53, in <module> CliApplication() File "/usr/lib/python3.6/site-packages/imgbased/__init__.py", line 82, in CliApplication app.hooks.emit("post-arg-parse", args) File "/usr/lib/python3.6/site-packages/imgbased/hooks.py", line 120, in emit cb(self.context, *args) File "/usr/lib/python3.6/site-packages/imgbased/plugins/core.py", line 171, in post_argparse layout.initialize(args.source, args.init_nvr) File "/usr/lib/python3.6/site-packages/imgbased/plugins/core.py", line 215, in initialize self.app.imgbase.init_layout_from(source, init_nvr) File "/usr/lib/python3.6/site-packages/imgbased/imgbase.py", line 293, in init_layout_from self.init_tags_on(existing_lv) File "/usr/lib/python3.6/site-packages/imgbased/imgbase.py", line 271, in init_tags_on pool = lv.thinpool() File "/usr/lib/python3.6/site-packages/imgbased/lvm.py", line 305, in thinpool raise MissingLvmThinPool() imgbased.lvm.MissingLvmThinPool " If I change nothing and choose automatic partitioning the installation completes. Tried different times with same results. Is it expected? In this case instead of specifying "recommended" it should be written sort of "mandatory"... Gianluca

2 1

Problem with multiple IP addresses and AWX
by Bernhard Dick 29 Apr '20

29 Apr '20

Hi, I've started to use awx shortly and I'd like to have an inventory based on their RHEV/oVirt-Plugin. Basically that works fine, however on machines that have multiple network interfaces or internal nets (like Docker) the first address in the IP list of the vm (which is used as ansible_host by AWX) is not an address that is reachable from the machine's outside and so those host entries are failing in my jobs. I found an issue at AWX, being like we won't fix first: https://github.com/ansible/awx/issues/1191 It also seems that there where issues related to this on oVirt: First this with a request for setting a primary IP: https://bugzilla.redhat.com/show_bug.cgi?id=1437145 And this one mentioning a way to ignore interfaces on ovirt-guest-agent, however it does no longer work due to the use of qemu-guest-agent: https://bugzilla.redhat.com/show_bug.cgi?id=1437145 Do you have any ideas how to circumvent this or is there some improvement alread in planning? Best regards Bernhard

1 0

Re: User Groups
by Lucie Leistnerova 29 Apr '20

29 Apr '20

On 4/29/20 9:35 AM, Anton Louw wrote: > > > Hi Paul, > > Thanks. Its just strange, because when I want to assign group > permissions to a VM for instance, I get the below: > > But when I check, Administration, Users then select Groups, I only see > the below: > These are the groups added to RHV manually (check button Add or Administration - Configure - System Permissions - Add) and Everyone (built-in group). So they can be used to assign permissions. > > Am I missing something? > > Thanks > > > *Anton Louw* > *Cloud Engineer: Storage and Virtualization* at *Vox* > ------------------------------------------------------------------------ > *T:* 087 805 0000 | *D:* 087 805 1572 > *M:* N/A > *E:* anton.louw(a)voxtelecom.co.za <mailto:anton.louw@voxtelecom.co.za> > *A:* Rutherford Estate, 1 Scott Street, Waverley, Johannesburg > www.vox.co.za <http://www.vox.co.za> > > F <https://www.facebook.com/voxtelecomZA> > > > T <https://www.twitter.com/voxtelecom> > > > I <https://www.instagram.com/voxtelecomza/> > > > L <https://www.linkedin.com/company/voxtelecom> > > > Y <https://www.youtube.com/user/VoxTelecom> > > > *From:*Staniforth, Paul <P.Staniforth(a)leedsbeckett.ac.uk> > *Sent:* 29 April 2020 09:28 > *To:* Anton Louw <Anton.Louw(a)voxtelecom.co.za>; users(a)ovirt.org > *Subject:* Re: User Groups > > Hello Anton, > > In the Administration->Users there is a groups > button. > > Regards, > > Paul S. > > ------------------------------------------------------------------------ > > *From:*Anton Louw <Anton.Louw(a)voxtelecom.co.za > <mailto:Anton.Louw@voxtelecom.co.za>> > *Sent:* 29 April 2020 06:36 > *To:* users(a)ovirt.org <mailto:users@ovirt.org> <users(a)ovirt.org > <mailto:users@ovirt.org>> > *Subject:* [ovirt-users] User Groups > > *Caution External Mail:* Do not click any links or open any > attachments unless you trust the sender and know that the content is safe. > > Hi Everybody, > > Is there a way to see My Groups through the Web UI? I have tried > looking around, but cannot see anything. Can this only be seen via the > backend in the HE? > > Thanks > > *Anton Louw* > > *Cloud Engineer: Storage and Virtualization*at *Vox* > > ------------------------------------------------------------------------ > > *T:*087 805 0000 | *D:*087 805 1572 > *M:*N/A > *E:*anton.louw@voxtelecom.co.za <mailto:anton.louw@voxtelecom.co.za> > *A:*Rutherford Estate, 1 Scott Street, Waverley, Johannesburg > www.vox.co.za > <https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.vox.co…> > > F > <https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.faceb…> > > > > T > <https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.twitt…> > > > > I > <https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.insta…> > > > > L > <https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.linke…> > > > > Y > <https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.youtu…> > > #VoxBrand > <https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.vox.c…> > > > *Disclaimer* > > The contents of this email are confidential to the sender and the > intended recipient. Unless the contents are clearly and entirely of a > personal nature, they are subject to copyright in favour of the > holding company of the Vox group of companies. Any recipient who > receives this email in error should immediately report the error to > the sender and permanently delete this email from all storage devices. > > This email has been scanned for viruses and malware, and may have been > automatically archived by *Mimecast Ltd*, an innovator in Software as > a Service (SaaS) for business. Providing a *safer* and *more useful* > place for your human generated data. Specializing in; Security, > archiving and compliance. To find out more Click Here > <https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.voxte…>. > > To view the terms under which this email is distributed, please go to:- > http://leedsbeckett.ac.uk/disclaimer/email/ > > > > _______________________________________________ > Users mailing list -- users(a)ovirt.org > To unsubscribe send an email to users-leave(a)ovirt.org > Privacy Statement: https://www.ovirt.org/privacy-policy.html > oVirt Code of Conduct: https://www.ovirt.org/community/about/community-guidelines/ > List Archives: https://lists.ovirt.org/archives/list/users@ovirt.org/message/EOORL4GYWM5XS… -- Lucie Leistnerova Senior Quality Engineer, QE Cloud, RHVM Red Hat EMEA IRC: lleistne @ #rhev-qe

1 0

Can't ping gluster interfaces for HCI setup
by Shareef Jalloq 29 Apr '20

29 Apr '20

Hi, I'm in the process of trying to set up an HCI 3 node cluster in my homelab to better understand the Gluster setup and have failed at the first hurdle. I've set up the node interfaces on the built in NIC and am using a PCI NIC for the Gluster traffic - at the moment this is 1Gb until I can upgrade - and I've assigned a static IP to both interfaces and also have both entries in my DNS. From any of the three nodes, I can ping the gateway, the other nodes, any external IP but I can't ping any of the Gluster NICs. What have I forgotten to do? Here's the relevant output of 'ip addr show'. em1 is the motherboard NIC and p1p1 is port 1 of an Intel NIC. The /etc/sysconfig/network-scripts/ifcfg-<if> scripts are identical aside from IPADDR, NAME, DEVICE and UUID fields. Thanks, Shareef. [root@ovirt-node-00 ~]# ip addr show 2: p1p1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000 link/ether a0:36:9f:1f:f9:78 brd ff:ff:ff:ff:ff:ff inet 10.0.0.34/24 brd 10.0.0.255 scope global noprefixroute p1p1 valid_lft forever preferred_lft forever inet6 fd4d:e9e3:6f5:1:a236:9fff:fe1f:f978/64 scope global mngtmpaddr dynamic valid_lft 7054sec preferred_lft 7054sec inet6 fe80::a236:9fff:fe1f:f978/64 scope link valid_lft forever preferred_lft forever 4: em1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000 link/ether 98:90:96:a1:16:ad brd ff:ff:ff:ff:ff:ff inet 10.0.0.31/24 brd 10.0.0.255 scope global noprefixroute em1 valid_lft forever preferred_lft forever inet6 fd4d:e9e3:6f5:1:9a90:96ff:fea1:16ad/64 scope global mngtmpaddr dynamic valid_lft 7054sec preferred_lft 7054sec inet6 fe80::9a90:96ff:fea1:16ad/64 scope link valid_lft forever preferred_lft forever

3 11

Re: User Groups
by Staniforth, Paul 29 Apr '20

29 Apr '20

Hi Anton, have you got an external authentication system? if you add the external groups with the correct roles to the correct object (e.g. datacenter) it will then show in the list of grpups. Regards, Paul S. ________________________________ From: Anton Louw <Anton.Louw(a)voxtelecom.co.za> Sent: 29 April 2020 08:35 To: Staniforth, Paul <P.Staniforth(a)leedsbeckett.ac.uk>; users(a)ovirt.org <users(a)ovirt.org> Subject: RE: User Groups Caution External Mail: Do not click any links or open any attachments unless you trust the sender and know that the content is safe. Hi Paul, Thanks. Its just strange, because when I want to assign group permissions to a VM for instance, I get the below: [cid:image003.png@01D61E09.7EB68C80] But when I check, Administration, Users then select Groups, I only see the below: [cid:image002.png@01D61E09.7EAC5350] Am I missing something? Thanks Anton Louw Cloud Engineer: Storage and Virtualization at Vox ________________________________ T: 087 805 0000 | D: 087 805 1572 M: N/A E: anton.louw(a)voxtelecom.co.za<mailto:anton.louw@voxtelecom.co.za> A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg www.vox.co.za<https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.vox.co…> [F]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.faceb…> [T]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.twitt…> [I]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.insta…> [L]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.linke…> [Y]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.youtu…> From: Staniforth, Paul <P.Staniforth(a)leedsbeckett.ac.uk> Sent: 29 April 2020 09:28 To: Anton Louw <Anton.Louw(a)voxtelecom.co.za>; users(a)ovirt.org Subject: Re: User Groups Hello Anton, In the Administration->Users there is a groups button. Regards, Paul S. ________________________________ From: Anton Louw <Anton.Louw(a)voxtelecom.co.za<mailto:Anton.Louw@voxtelecom.co.za>> Sent: 29 April 2020 06:36 To: users(a)ovirt.org<mailto:users@ovirt.org> <users(a)ovirt.org<mailto:users@ovirt.org>> Subject: [ovirt-users] User Groups Caution External Mail: Do not click any links or open any attachments unless you trust the sender and know that the content is safe. Hi Everybody, Is there a way to see My Groups through the Web UI? I have tried looking around, but cannot see anything. Can this only be seen via the backend in the HE? Thanks Anton Louw Cloud Engineer: Storage and Virtualization at Vox ________________________________ T: 087 805 0000 | D: 087 805 1572 M: N/A E: anton.louw(a)voxtelecom.co.za<mailto:anton.louw@voxtelecom.co.za> A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg www.vox.co.za<https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.vox.co…> [F]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.faceb…> [T]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.twitt…> [I]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.insta…> [L]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.linke…> [Y]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.youtu…> [#VoxBrand]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.vox.c…> Disclaimer The contents of this email are confidential to the sender and the intended recipient. Unless the contents are clearly and entirely of a personal nature, they are subject to copyright in favour of the holding company of the Vox group of companies. Any recipient who receives this email in error should immediately report the error to the sender and permanently delete this email from all storage devices. This email has been scanned for viruses and malware, and may have been automatically archived by Mimecast Ltd, an innovator in Software as a Service (SaaS) for business. Providing a safer and more useful place for your human generated data. Specializing in; Security, archiving and compliance. To find out more Click Here<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.voxte…>. To view the terms under which this email is distributed, please go to:- http://leedsbeckett.ac.uk/disclaimer/email/ To view the terms under which this email is distributed, please go to:- http://leedsbeckett.ac.uk/disclaimer/email/

1 0

Re: User Groups
by Lucie Leistnerova 29 Apr '20

29 Apr '20

Hi Anton, On 4/29/20 7:36 AM, Anton Louw wrote: > > > Hi Everybody, > > Is there a way to see My Groups through the Web UI? I have tried > looking around, but cannot see anything. Can this only be seen via the > backend in the HE? > All information about users you can see in Administration - Users and click on User name. I'm not aware of other information about the users in UI. > > Thanks > > > *Anton Louw* > *Cloud Engineer: Storage and Virtualization* at *Vox* > ------------------------------------------------------------------------ > *T:* 087 805 0000 | *D:* 087 805 1572 > *M:* N/A > *E:* anton.louw(a)voxtelecom.co.za <mailto:anton.louw@voxtelecom.co.za> > *A:* Rutherford Estate, 1 Scott Street, Waverley, Johannesburg > www.vox.co.za <http://www.vox.co.za> > > F <https://www.facebook.com/voxtelecomZA> > > > T <https://www.twitter.com/voxtelecom> > > > I <https://www.instagram.com/voxtelecomza/> > > > L <https://www.linkedin.com/company/voxtelecom> > > > Y <https://www.youtube.com/user/VoxTelecom> > > #VoxBrand <https://www.vox.co.za/fibre/fibre-to-the-home/?prod=HOME> > > > *Disclaimer* > > The contents of this email are confidential to the sender and the > intended recipient. Unless the contents are clearly and entirely of a > personal nature, they are subject to copyright in favour of the > holding company of the Vox group of companies. Any recipient who > receives this email in error should immediately report the error to > the sender and permanently delete this email from all storage devices. > > This email has been scanned for viruses and malware, and may have been > automatically archived by *Mimecast Ltd*, an innovator in Software as > a Service (SaaS) for business. Providing a *safer* and *more useful* > place for your human generated data. Specializing in; Security, > archiving and compliance. To find out more Click Here > <https://www.voxtelecom.co.za/security/mimecast/?prod=Enterprise>. > > > > > _______________________________________________ > Users mailing list -- users(a)ovirt.org > To unsubscribe send an email to users-leave(a)ovirt.org > Privacy Statement: https://www.ovirt.org/privacy-policy.html > oVirt Code of Conduct: https://www.ovirt.org/community/about/community-guidelines/ > List Archives: https://lists.ovirt.org/archives/list/users@ovirt.org/message/B2275QLUWDTKM… Best regards, -- Lucie Leistnerova Senior Quality Engineer, QE Cloud, RHVM Red Hat EMEA IRC: lleistne @ #rhev-qe

1 0

Re: User Groups
by Anton Louw 29 Apr '20

29 Apr '20

Hi Paul, Thanks. Its just strange, because when I want to assign group permissions to a VM for instance, I get the below: [cid:image003.png@01D61E09.7EB68C80] But when I check, Administration, Users then select Groups, I only see the below: [cid:image002.png@01D61E09.7EAC5350] Am I missing something? Thanks Anton Louw Cloud Engineer: Storage and Virtualization ______________________________________ D: 087 805 1572 | M: N/A A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg anton.louw(a)voxtelecom.co.za www.vox.co.za From: Staniforth, Paul <P.Staniforth(a)leedsbeckett.ac.uk> Sent: 29 April 2020 09:28 To: Anton Louw <Anton.Louw(a)voxtelecom.co.za>; users(a)ovirt.org Subject: Re: User Groups Hello Anton, In the Administration->Users there is a groups button. Regards, Paul S. ________________________________ From: Anton Louw <Anton.Louw(a)voxtelecom.co.za<mailto:Anton.Louw@voxtelecom.co.za>> Sent: 29 April 2020 06:36 To: users(a)ovirt.org<mailto:users@ovirt.org> <users(a)ovirt.org<mailto:users@ovirt.org>> Subject: [ovirt-users] User Groups Caution External Mail: Do not click any links or open any attachments unless you trust the sender and know that the content is safe. Hi Everybody, Is there a way to see My Groups through the Web UI? I have tried looking around, but cannot see anything. Can this only be seen via the backend in the HE? Thanks Anton Louw Cloud Engineer: Storage and Virtualization at Vox ________________________________ T: 087 805 0000 | D: 087 805 1572 M: N/A E: anton.louw(a)voxtelecom.co.za<mailto:anton.louw@voxtelecom.co.za> A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg www.vox.co.za<https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.vox.co…> [F]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.faceb…> [T]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.twitt…> [I]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.insta…> [L]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.linke…> [Y]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.youtu…> [#VoxBrand]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.vox.c…> Disclaimer The contents of this email are confidential to the sender and the intended recipient. Unless the contents are clearly and entirely of a personal nature, they are subject to copyright in favour of the holding company of the Vox group of companies. Any recipient who receives this email in error should immediately report the error to the sender and permanently delete this email from all storage devices. This email has been scanned for viruses and malware, and may have been automatically archived by Mimecast Ltd, an innovator in Software as a Service (SaaS) for business. Providing a safer and more useful place for your human generated data. Specializing in; Security, archiving and compliance. To find out more Click Here<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.voxte…>. To view the terms under which this email is distributed, please go to:- http://leedsbeckett.ac.uk/disclaimer/email/<http://leedsbeckett.ac.uk/disclaimer/email/>

1 0

Re: User Groups
by Staniforth, Paul 29 Apr '20

29 Apr '20

Hello Anton, In the Administration->Users there is a groups button. Regards, Paul S. ________________________________ From: Anton Louw <Anton.Louw(a)voxtelecom.co.za> Sent: 29 April 2020 06:36 To: users(a)ovirt.org <users(a)ovirt.org> Subject: [ovirt-users] User Groups Caution External Mail: Do not click any links or open any attachments unless you trust the sender and know that the content is safe. Hi Everybody, Is there a way to see My Groups through the Web UI? I have tried looking around, but cannot see anything. Can this only be seen via the backend in the HE? Thanks Anton Louw Cloud Engineer: Storage and Virtualization at Vox ________________________________ T: 087 805 0000 | D: 087 805 1572 M: N/A E: anton.louw(a)voxtelecom.co.za<mailto:anton.louw@voxtelecom.co.za> A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg www.vox.co.za<https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.vox.co…> [F]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.faceb…> [T]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.twitt…> [I]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.insta…> [L]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.linke…> [Y]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.youtu…> [#VoxBrand]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.vox.c…> Disclaimer The contents of this email are confidential to the sender and the intended recipient. Unless the contents are clearly and entirely of a personal nature, they are subject to copyright in favour of the holding company of the Vox group of companies. Any recipient who receives this email in error should immediately report the error to the sender and permanently delete this email from all storage devices. This email has been scanned for viruses and malware, and may have been automatically archived by Mimecast Ltd, an innovator in Software as a Service (SaaS) for business. Providing a safer and more useful place for your human generated data. Specializing in; Security, archiving and compliance. To find out more Click Here<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.voxte…>. To view the terms under which this email is distributed, please go to:- http://leedsbeckett.ac.uk/disclaimer/email/

1 0

Re: Move Hosted Engine VM to a different storage domain
by Yedidyah Bar David 29 Apr '20

29 Apr '20

On Fri, Apr 24, 2020 at 1:04 PM Anton Louw <Anton.Louw(a)voxtelecom.co.za> wrote: > > > Hi All, > > > > I know this question has been asked before, by myself included. I was > hoping that someone has run through the exercise of moving the hosted > engine VM to a different storage domain. I have tried many routes, but the > backup and restore does not work for me. > The "standard answer" is backup and restore. Why does it not work? > > > Is there anybody that can perhaps give me some guidelines or a process I > can follow? > I didn't try that myself. The best guidelines I can give you are: Try first on at a test system. Do the backup on the real machine, create some isolated VM (isolated so that it does not interfere with your hosts/storage) somewhere to be used as a test host (or a physical machine if you have one), some storage somewhere, and restore on it. Make it work. Document what you needed to do. Ask here with specific questions if/when you have them. Then do on the production setup. Also clarify your needs. Do you need no-downtime for the VMs? If so, that's more complex. If you don't, it might be enough/simpler to deploy a new setup and just import the existing storage. Do you have HA VMs? etc. > > > The reason I need to move the HE VM is because we are decommissioning the > current storage array where the HE VM is located. > Good luck! Best regards, > > > Thank you very much > > *Anton Louw* > *Cloud Engineer: Storage and Virtualization* at *Vox* > ------------------------------ > *T:* 087 805 0000 | *D:* 087 805 1572 > *M:* N/A > *E:* anton.louw(a)voxtelecom.co.za > *A:* Rutherford Estate, 1 Scott Street, Waverley, Johannesburg > www.vox.co.za > > [image: F] <https://www.facebook.com/voxtelecomZA> > [image: T] <https://www.twitter.com/voxtelecom> > [image: I] <https://www.instagram.com/voxtelecomza/> > [image: L] <https://www.linkedin.com/company/voxtelecom> > [image: Y] <https://www.youtube.com/user/VoxTelecom> > > [image: #VoxBrand] > <https://www.vox.co.za/fibre/fibre-to-the-home/?prod=HOME> > *Disclaimer* > > The contents of this email are confidential to the sender and the intended > recipient. Unless the contents are clearly and entirely of a personal > nature, they are subject to copyright in favour of the holding company of > the Vox group of companies. Any recipient who receives this email in error > should immediately report the error to the sender and permanently delete > this email from all storage devices. > > This email has been scanned for viruses and malware, and may have been > automatically archived by *Mimecast Ltd*, an innovator in Software as a > Service (SaaS) for business. Providing a *safer* and *more useful* place > for your human generated data. Specializing in; Security, archiving and > compliance. To find out more Click Here > <https://www.voxtelecom.co.za/security/mimecast/?prod=Enterprise>. > > > _______________________________________________ > Users mailing list -- users(a)ovirt.org > To unsubscribe send an email to users-leave(a)ovirt.org > Privacy Statement: https://www.ovirt.org/privacy-policy.html > oVirt Code of Conduct: > https://www.ovirt.org/community/about/community-guidelines/ > List Archives: > https://lists.ovirt.org/archives/list/users@ovirt.org/message/V3PRBRZD7SLUQ… > -- Didi

3 2

User Groups
by Anton Louw 29 Apr '20

29 Apr '20

Hi Everybody, Is there a way to see My Groups through the Web UI? I have tried looking around, but cannot see anything. Can this only be seen via the backend in the HE? Thanks Anton Louw Cloud Engineer: Storage and Virtualization ______________________________________ D: 087 805 1572 | M: N/A A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg anton.louw(a)voxtelecom.co.za www.vox.co.za

1 0

Can't deploy engine vm with ovirt-hosted-engine-setup
by Gabriel Bueno 28 Apr '20

28 Apr '20

Hi, I'm trying deploy an engine vm with ovirt-hosted-engine-setup. After the storage domain configuration, the setup exits with the error: [ ERROR ] fatal: [localhost]: FAILED! => {"ansible_facts": {"ovirt_vms": [{"affinity_labels": [], "applications": [], "bios": {"boot_menu": {"enabled": false}, "type": "i440fx_sea_bios"}, "cdroms": [], "cluster": {"href": "/ovirt-engine/api/clusters/8ef534f4-7820-11ea-82a4-00163e2c790d", "id": "8ef534f4-7820-11ea-82a4-00163e2c790d"}, "comment": "", "cpu": {"architecture": "x86_64", "topology": {"cores": 1, "sockets": 4, "threads": 1}}, "cpu_profile": {"href": "/ovirt-engine/api/cpuprofiles/58ca604e-01a7-003f-01de-000000000250", "id": "58ca604e-01a7-003f-01de-000000000250"}, "cpu_shares": 0, "creation_time": "2020-04-06 16:12:45.950000+00:00", "delete_protected": false, "description": "", "disk_attachments": [], "display": {"address": "127.0.0.1", "allow_override": false, "certificate": {"content": "-----BEGIN CERTIFICATE-----\n\n-----END CERTIFICATE-----\n", "organization": "xxx", "subject": "O=xxx,CN=xxx"}, "copy_paste_enabled": true, "disconnect_action": "LOCK_SCREEN", "file_transf er_enabled": true, "monitors": 1, "port": 5900, "single_qxl_pci": false, "smartcard_enabled": false, "type": "vnc"}, "fqdn": "xxx", "graphics_consoles": [], "guest_operating_system": {"architecture": "x86_64", "codename": "", "distribution": "CentOS Linux", "family": "Linux", "kernel": {"version": {"build": 0, "full_version": "3.10.0-1062.18.1.el7.x86_64", "major": 3, "minor": 10, "revision": 1062}}, "version": {"full_version": "7", "major": 7}}, "guest_time_zone": {"name": "UTC", "utc_offset": "+00:00"}, "high_availability": {"enabled": false, "priority": 0}, "host": {"href": "/ovirt-engine/api/hosts/80856993-d4d1-4609-9ad9-7c4bdd2903b6", "id": "80856993-d4d1-4609-9ad9-7c4bdd2903b6"}, "host_devices": [], "href": "/ovirt-engine/api/vms/e1b55569-5ae4-48c5-a2bf-f109fbdddd4e", "id": "e1b55569-5ae4-48c5-a2bf-f109fbdddd4e", "io": {"threads": 1}, "katello_errata": [], "large_icon": {"href": "/ovirt-engine/api/icons/290ffd7e-4bf3-4283-babc-86b675d7a35e", "id": "290ffd7e-4bf3-4283-babc-86b6 75d7a35e"}, "memory": 17179869184, "memory_policy": {"guaranteed": 17179869184, "max": 17179869184}, "migration": {"auto_converge": "inherit", "compressed": "inherit"}, "migration_downtime": -1, "multi_queues_enabled": true, "name": "external-HostedEngineLocal", "next_run_configuration_exists": false, "nics": [], "numa_nodes": [], "numa_tune_mode": "interleave", "origin": "external", "original_template": {"href": "/ovirt-engine/api/templates/00000000-0000-0000-0000-000000000000", "id": "00000000-0000-0000-0000-000000000000"}, "os": {"boot": {"devices": ["hd"]}, "type": "other"}, "permissions": [], "placement_policy": {"affinity": "migratable"}, "quota": {"id": "a80b336c-7820-11ea-b435-00163e2c790d"}, "reported_devices": [], "run_once": false, "sessions": [], "small_icon": {"href": "/ovirt-engine/api/icons/3d06eacd-f9d1-4c14-a228-b16ed454f7c8", "id": "3d06eacd-f9d1-4c14-a228-b16ed454f7c8"}, "snapshots": [], "sso": {"methods": [{"id": "guest_agent"}]}, "start_paused": false, "stateles s": false, "statistics": [], "status": "unknown", "storage_error_resume_behaviour": "auto_resume", "tags": [], "template": {"href": "/ovirt-engine/api/templates/00000000-0000-0000-0000-000000000000", "id": "00000000-0000-0000-0000-000000000000"}, "time_zone": {"name": "Etc/GMT"}, "type": "desktop", "usb": {"enabled": false}, "watchdogs": []}]}, "attempts": 24, "changed": false, "deprecations": [{"msg": "The 'ovirt_vm_facts' module has been renamed to 'ovirt_vm_info', and the renamed one no longer returns ansible_facts", "version": "2.13"}]} Certificate and sensible information has been deleted... Someone knows what could be wrong with my environment?? Kind Regards

3 3

[OT] windows 10 qemu-kvm latest stable drivers
by Gianluca Cecchi 28 Apr '20

28 Apr '20

Hello, I see that this link below, that should be the correct one for stable virtio drivers: https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/stable-vir… points to virtio-win-0.1.171-1 released on May 2019. The same pointed by the repo https://fedorapeople.org/groups/virt/virtio-win/virtio-win.repo Under https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/archive-vi… there are many new ones... Are so they all to be considered unstable? Thanks, Gianluca

2 1

Wrong CPU type recognized on a new Pentium G4560 Kaby Lake
by mleone87＠hotmail.com 28 Apr '20

28 Apr '20

Hi, I installed an ovirt node based on latest 4.3.9 iso on this hardware: CPU Intel Pentium G4560 Motherboard Asus P10S-i C232 Chipset Overall setup has no problem but I noticed that the CPU type is recognized as: Intel Westmere IBRS SSBD MDS Family The overall system info are: OS Version: RHEL - 7 - 7.1908.0.el7.centos OS Description: oVirt Node 4.3.9 Kernel Version: 3.10.0 - 1062.18.1.el7.x86_64 KVM Version: 2.12.0 - 33.1.el7_7.4 LIBVIRT Version: libvirt-4.5.0-23.el7_7.6 VDSM Version: vdsm-4.30.43-1.el7 SPICE Version: 0.14.0 - 7.el7 GlusterFS Version: glusterfs-6.8-1.el7 CEPH Version: librbd1-10.2.5-4.el7 Open vSwitch Version: openvswitch-2.11.0-4.el7 Kernel Features: PTI: 1, IBRS: 0, RETP: 1, SSBD: 3 VNC Encryption: Disabled Thats give me some problem on the cluster since I'm trying to join some notebooks to it(it's only a lab) and they are recognized ad Haswell CPUs, making them too new to be joined Any help on this? Thanks

2 1

[ANN] oVirt 4.3.10 Second Release Candidate is now available for testing
by Lev Veyde 28 Apr '20

28 Apr '20

The oVirt Project is pleased to announce the availability of oVirt 4.3.10 Second Release Candidate for testing as of April 28th, 2020. This update is the tenth in a series of stabilization updates to the 4.3 series. This release is available now on x86_64 architecture for: * Red Hat Enterprise Linux 7.7 or later (but < 8) * CentOS Linux (or similar) 7.7 or later (but < 8) This release supports Hypervisor Hosts on x86_64 and ppc64le architectures for: * Red Hat Enterprise Linux 7.7 or later (but < 8) * CentOS Linux (or similar) 7.7 or later (but < 8) * oVirt Node 4.3 (available for x86_64 only) See the release notes [1] for installation / upgrade instructions and a list of new features and bugs fixed. Notes: - oVirt Appliance is already available - oVirt Node is already available[2] Additional Resources: * Read more about the oVirt 4.3.10 release highlights: http://www.ovirt.org/release/4.3.10/ * Get more oVirt Project updates on Twitter: https://twitter.com/ovirt * Check out the latest project news on the oVirt blog: http://www.ovirt.org/blog/ [1] http://www.ovirt.org/release/4.3.10/ [2] http://resources.ovirt.org/pub/ovirt-4.3-pre/iso/ -- Lev Veyde Senior Software Engineer, RHCE | RHCVA | MCITP Red Hat Israel <https://www.redhat.com> lev(a)redhat.com | lveyde(a)redhat.com <https://red.ht/sig> TRIED. TESTED. TRUSTED. <https://redhat.com/trusted>

1 0

Info about openstack staging-ovirt driver connection not released
by Gianluca Cecchi 28 Apr '20

28 Apr '20

Hello, I'm setting up an Openstack Queens lab ( to best match OSP 13) using oVirt VMs as nodes. At this time only undercloud configured and 8 Openstack nodes (VMs) set as available for provisioning. I'm using staging-ovirt driver on director node in similar way as the vbmc one. I see from oVirt active user sessions page that every minute I have one connection for node (in my case 8) of the designated user (in my case ostackpm). But it seems they are never released. How can I check the problem? Director is CentOS 7 server and the staging-ovirt driver is provided by the package: [root@director ~]# rpm -q python-ovirt-engine-sdk4 python-ovirt-engine-sdk4-4.3.2-2.el7.x86_64 [root@director ~]# I didn't configure the oVirt repo but only installed the latest stable available for 4.3.9: wget https://resources.ovirt.org/pub/ovirt-4.3/rpm/el7/x86_64/python-ovirt-engin… sudo yum localinstall python-ovirt-engine-sdk4-4.3.2-2.el7.x86_64.rpm Anyone with experience on this? In the mean time any way to use a command using api to kill the stale (I think) sessions? Thanks, Gianluca

2 4

Virtual machine replica - DR
by ccesario＠blueit.com.br 28 Apr '20

28 Apr '20

Hello, Does someone know any tool/method to replicate the VMS from a "Production" Cluster to "Secondary" Cluster, to provide a DR solution without Storage replication dependency or Gluster Storage. Like Veeam, Zerto toosl do with other hypervisors. Is there anyway, tool, product to do it!? Regards Carlos

2 2

Custom ignition in cloud-init?
by Wesley Stewart 26 Apr '20

26 Apr '20

Before anyone tells me this is now included in 4.4.0, I saw this, but I don't think I'm willing to update my centos7 host to centos8 yet. (But perhaps that will be the answer). Currently on 4.3.9/Centos 7 I am trying to run fedora core is to test it out, and the ISO installer hangs on: "failed to isolate default target freezing" So I tried the QCOW2 image, but I'm looking at ways of running the ignition file. I see in the "run once" section i can deploy a custom unit script, and I was wondering is this filetype agnostic? If I generate a JSON ignition script and put it in there will it get passed through correctly ? Or will I need to update to 4.4.0? I also found: https://gerrit.ovirt.org/#/c/100008/ This was abondoned for a "better solution" last September. Was this referring to the changes in 4.4.0? Lastly has anyone who was running 4.3.9 upgrade their centos host to centos8 and then upgrade ovirt without any issues? I usually try and wait at least a couple of minor version changes before switching to a new major version. Thanks guys!

1 0

Ovirt vs lvm?
by csabany＠freemail.hu 26 Apr '20

26 Apr '20

Hi, Our production ovirt system looks like: standalone management server, vesion 4.3.9, 6 clusters, 28 nodes (v4.2, v4.3) , one storage domain, (FC SAN Storages), centos7 vm-s , and some windows vms. I have a returning problem. Sometime when i power off a vm and power on again , i get an error message our linux vm (when we use lvm of course): dracut: Read-only locking type set. Write locks are prohibited., dracut: Can't get lock for vg. I can repair only 70% of damaged vm. I tried to localize the problem, but a can`t. The error occured randomly every cluster, every storage on last 2 years. Has anyone ever encountered such a problem?

5 10

[ANN] oVirt 4.3.10 First Release Candidate is now available for testing
by Lev Veyde 24 Apr '20

24 Apr '20

The oVirt Project is pleased to announce the availability of oVirt 4.3.10 First Release Candidate for testing as of April 25th, 2020. This update is the tenth in a series of stabilization updates to the 4.3 series. This release is available now on x86_64 architecture for: * Red Hat Enterprise Linux 7.7 or later (but < 8) * CentOS Linux (or similar) 7.7 or later (but < 8) This release supports Hypervisor Hosts on x86_64 and ppc64le architectures for: * Red Hat Enterprise Linux 7.7 or later (but < 8) * CentOS Linux (or similar) 7.7 or later (but < 8) * oVirt Node 4.3 (available for x86_64 only) See the release notes [1] for installation / upgrade instructions and a list of new features and bugs fixed. Notes: - oVirt Appliance is already available - oVirt Node is already available[2] Additional Resources: * Read more about the oVirt 4.3.10 release highlights: http://www.ovirt.org/release/4.3.10/ * Get more oVirt Project updates on Twitter: https://twitter.com/ovirt * Check out the latest project news on the oVirt blog: http://www.ovirt.org/blog/ [1] http://www.ovirt.org/release/4.3.10/ [2] http://resources.ovirt.org/pub/ovirt-4.3-pre/iso/ -- Lev Veyde Senior Software Engineer, RHCE | RHCVA | MCITP Red Hat Israel <https://www.redhat.com> lev(a)redhat.com | lveyde(a)redhat.com <https://red.ht/sig> TRIED. TESTED. TRUSTED. <https://redhat.com/trusted>

1 0

How to force removal of old host from Engine
by Shareef Jalloq 24 Apr '20

24 Apr '20

Hi, I seem to have got a stale host in my engine that I can't remove. I recently reinstalled oVirt Node on this host and while trying to refresh the host in the engine, have got it in some state where I can't do anything. The host is listed as Status=Unassigned. Under the Management pull down I only have Restart and Stop options, both of which error if selected. The Remove button is not available. How do I force a removal of this host from the view so I can reload it? Shareef.

4 13

Move Hosted Engine VM to a different storage domain
by Anton Louw 24 Apr '20

24 Apr '20

Hi All, I know this question has been asked before, by myself included. I was hoping that someone has run through the exercise of moving the hosted engine VM to a different storage domain. I have tried many routes, but the backup and restore does not work for me. Is there anybody that can perhaps give me some guidelines or a process I can follow? The reason I need to move the HE VM is because we are decommissioning the current storage array where the HE VM is located. Thank you very much Anton Louw Cloud Engineer: Storage and Virtualization ______________________________________ D: 087 805 1572 | M: N/A A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg anton.louw(a)voxtelecom.co.za www.vox.co.za

1 0

VM disk I/O
by ozmen62＠hotmail.com 23 Apr '20

23 Apr '20

On oVirt 4.3. i installed w10_64 with q35 cpu. i've used vm optimizer for better performans for end-users. it seams good. But i need more performance guidelines. Ex. Our system has FC storage, is tere any options for better read/write performans, Hugepage, write through Like this, if you have any suggestions, could you share Thanks

3 3

Re: Safely disable firewalld [Ovirt 4.3]
by Strahil Nikolov 23 Apr '20

23 Apr '20

On April 22, 2020 10:45:49 PM GMT+03:00, Edson Richter <edsonrichter(a)hotmail.com> wrote: >De: Strahil Nikolov <hunter86_bg(a)yahoo.com> >Enviado: quarta-feira, 22 de abril de 2020 15:45 >Para: users(a)ovirt.org <users(a)ovirt.org>; Edson Richter ><edsonrichter(a)hotmail.com>; eevans(a)digitaldatatechs.com ><eevans(a)digitaldatatechs.com>; francesco(a)shellrent.com ><francesco(a)shellrent.com> >Assunto: Re: [ovirt-users] Re: Safely disable firewalld [Ovirt 4.3] > >On April 22, 2020 6:33:40 PM GMT+03:00, Edson Richter ><edsonrichter(a)hotmail.com> wrote: >>I'm in no way a ovirt expert. But as Linux administrator, I would say >>that firewalld and iptables are "front-end" to kernel internal >security >>tables, so, in the final of the day, will provide *almost* same >>functionality. >> >>Seems that firewalld is able to activate modules without restarting >>entire firewall infra-structure, which iptables is not capable of. >This >>leverage an advantage for firewalld, specially where you would not >have >>interruptions in existing stateful connections. >> >>I've used iptables *always* as replacement for firewalld because of >>almost 20 yrs using iptables - this is the first step in all about >>hundred Centos7 installations I've done past few years. I just can't >>throw away all my scripts that block hackers, provide 2 and 3 way >>"knock-knock" lockers, fail2ban customizations, nat rules, DMZ, and >>all, everytime a new "firewall" front end appears. I've seen at least >>two or three "iptables killers tech" in the past, and iptables still >is >>the king - at least for me. >> >>Again, repeating myself, I'm no ovirt specialist. Just a sazonal linux >>admin which will not jump from iptables train yet. >> >>Perhaps, I would not reccomend to completely deactivate all firewall >in >>any server! If it is the case, I would instead to advice to just >>replace firewalld with iptables-service (at least, in Centos7) - but >>only in case you have too much to loose without iptables (as am I). >> >>Regards, >> >>Edson >> >> >>________________________________ >>De: eevans(a)digitaldatatechs.com <eevans(a)digitaldatatechs.com> >>Enviado: quarta-feira, 22 de abril de 2020 12:18 >>Para: francesco(a)shellrent.com <francesco(a)shellrent.com>; >>users(a)ovirt.org <users(a)ovirt.org> >>Assunto: [ovirt-users] Re: Safely disable firewalld [Ovirt 4.3] >> >>If you log in to the cockpit, you can add services or custom ports >>easily. I would not disable the firewall. >><hostname:9090> for the cockpit. >> >>Eric Evans >>Digital Data Services LLC. >>304.660.9080 >> >> >>-----Original Message----- >>From: francesco(a)shellrent.com <francesco(a)shellrent.com> >>Sent: Tuesday, April 21, 2020 12:54 PM >>To: users(a)ovirt.org >>Subject: [ovirt-users] Safely disable firewalld [Ovirt 4.3] >> >>Hi all, >> >>I was wondering if it's "safe" disabling entirely the firewalld >service >>and manage the firewall only via iptables, on the host and on the >>hosted engine (a self-hosted engine). It would make a lot easier the >>managing the firewall rules for me because of many automatisms I >>created based on iptables. Did anyone manage to do this? Any >>contraindication for doing this or precaution that I have to take care >>of? >> >>Thanks for your time and help, >>Francesco >>_______________________________________________ >>Users mailing list -- users(a)ovirt.org >>To unsubscribe send an email to users-leave(a)ovirt.org Privacy >>Statement: >>https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ovirt… >>oVirt Code of Conduct: >>https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ovirt… >>List Archives: >>https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.ovi… >>_______________________________________________ >>Users mailing list -- users(a)ovirt.org >>To unsubscribe send an email to users-leave(a)ovirt.org >>Privacy Statement: >>https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ovirt… >>oVirt Code of Conduct: >>https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ovirt… >>List Archives: >>https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.ovi… > >Keep in mind that I had some issues with oVirt (was more than a year >ago - so don't ask for details) when either firewalld or SELINUX were >down. > >With so much experience in IPTABLES - it's understandable, but keep in >mind that in CentOS/RHEL 8 iptables command is just a translator to >nftables - with limited capability and I don't think that it was a >coincidence . With firewalld you can still achive 90-95% of what you >could do in IPTABLES while the rules are quite clear even for a new >admin. > >What I really like is that you can predefine the ports and protos for >a specific service and easily deploy it via salt or ansible. > >Best Regards, >Strahil Nikolov > > >Good to know! >When I have time to return to my oVirt tests, I"ll take a careull look >at it. >I'll also add a note into our Centos 8 migration plans that all >iptables scripts will have to be rewriten. > >Thanks, > >Edson Richter As you are not the only one with zillions of iptables rules - check the CentOS mailing list. Maybe they got a way to keep you on iptables. Best Regards, Sttrahil Nikolov

2 1

Re: oVirt and KeyCloak intergration
by Artur Socha 23 Apr '20

23 Apr '20

On Wed, 2020-04-22 at 12:28 +0000, Anton Louw wrote: > > > > Hi Artur, > > > > You are a champion! I can access oVirt now. Thank you so much. > You're welcome!I am happy it worked because I had no more ideas what to check next :) > One last question, can I create additional groups in ie. Read Only, etc? And > then will this be done in KeyCloak or in the oVIrt UI? This ovirt-administrator group is only for accessing(authentication & sso) ovirt engine admin panel and, as far as I understand it, it does restrict access to particular engine's admin functions. I think that proper authorization is done only at the engine's UI level. See 'User Authorization' under https://ovirt.org/documentation/admin-guide/chap-Users_and_Roles.html > > > Thank you > > > > > > Anton Louw > > > Cloud Engineer: Storage and Virtualization at Vox > > > > > > > T: 087 805 0000 | D: 087 805 1572 > M: N/A > > E: anton.louw(a)voxtelecom.co.za > A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg > > www.vox.co.za > > > > > > > > > > > > > > > > > > > > > > > > > From: Artur Socha <asocha(a)redhat.com> > > > Sent: 22 April 2020 13:21 > > To: Anton Louw <Anton.Louw(a)voxtelecom.co.za>; users(a)ovirt.org > > Subject: Re: [ovirt-users] oVirt and KeyCloak intergration > > > > On Wed, 2020-04-22 at 13:09 +0200, Artur Socha wrote: > > > On Wed, 2020-04-22 at 10:42 +0000, Anton Louw wrote: > > > > > > > > Ok so this is definitely looking better. I get an error, but at least now > it > > > > is saying : “The user admin@openidchttp is not authorized to perform > login” > > > > > > > > This is strange though, because admin in by default should be allowed > > > > access? > > > > > > Well, yes and no :) > > > > > > In order for user to be considered admin (for ovirt engine) it must belong > to > > > keycloak's ovirt-administrator group (in keycloak admin panel see Manage- > > > > Groups->Members) > > > > Small clarification: > > > > In keycloak admin panel see Manage-> Groups-> 'ovirt-administrator' -> Members > > > > Note that the group must have the exact name: ovirt-administrator > > > > > > > > > > I think you are very close to have it up-and-running. > > > > > > > > > > > > > > From: Anton Louw > > > > Sent: 22 April 2020 12:38 > > > > To: Artur Socha <asocha(a)redhat.com>; > users(a)ovirt.org > > > > Subject: RE: [ovirt-users] oVirt and KeyCloak intergration > > > > > > > > Perfect, I’ll test and let you know. > > > > > > > > Thanks > > > > > > > > From: Artur Socha <asocha(a)redhat.com> > > > > Sent: 22 April 2020 12:32 > > > > To: Anton Louw <Anton.Louw(a)voxtelecom.co.za>; > users(a)ovirt.org > > > > Subject: Re: [ovirt-users] oVirt and KeyCloak intergration > > > > > > > > + users(a)ovirt.org > > > > > > > > On Wed, 2020-04-22 at 09:57 +0000, Anton Louw wrote: > > > > > > > > > > > > > > > Hi Artur, > > > > > > > > > > I would just like to make sure I am following correctly, comparing your > > > > > entries against mine. > > > > > > > > > > Your setup: > > > > > ... > > > > > config.mapAuthRecord.regex.pattern = > > > > > ^(?<user>.*?)((\\\\(?<at>@)(?<suffix>.*?)@.*)|(?<realm>@.*))$ > > > > > ... > > > > > > > > > > > > > > > My setup: > > > > > … > > > > > config.mapAuthRecord.regex.pattern = > > > > > ^(?<user>.*?)((\\(?<at>@)(?<suffix>.*?)@.*)|(?<realm>@.*))$ > > > > > … > > > > > > > > > > Should I add the additional 2 “\\” in on my side? > > > > > > > > > > > > Yes, please try adding it. In my case I learned about this issue by > > > > debugging > > > > the code because the real exception generated by incorrect regexp syntax > was > > > > hidden behind generic error message giving no clues about the true cause. > > > > > > > > > > > > > > Your setup: > > > > > ... > > > > > <LocationMatch ^/ovirt-engine/sso/(interactive-login- > > > > > negotiate|oauth/token- > > > > > http-auth)|^/ovirt-engine/callback> > > > > > <If "req('Authorization') !~ /^(Bearer|Basic)/i"> > > > > > > > > > > Require valid-user > > > > > AuthType openid-connect > > > > > > > > > > ErrorDocument 401 "<html><meta http-equiv=\"refresh\"content=\"0; > > > > > url=/ovirt-engine/sso/login-unauthorized\"/><body><ahref=\"/ovirt- > > > > > engine/sso/login-unauthorized\">Here</a></body></html>" > > > > > </If> > > > > > </LocationMatch> > > > > > … > > > > > > > > > > My setup: > > > > > … > > > > > <LocationMatch ^/ovirt-engine/sso/(interactive-login- > > > > > negotiate|oauth/token- > > > > > http-auth)|^/ovirt-engine/callback> > > > > > <If "req('Authorization') !~ /^(Bearer|Basic)/i"> > > > > > > > > > > Require valid-user > > > > > AuthType openid-connect > > > > > > > > > > ErrorDocument 401 "<html><meta http-equiv='refresh' content='0; > > > > > url=/ovirt-engine/sso/login-unauthorized'/><body><a href='/ovirt- > > > > > engine/sso/login-unauthorized'>Here</a></body></html>" > > > > > </If> > > > > > </LocationMatch> > > > > > … > > > > > > > > > > I remember I had syntax errors, but mine was changed. > > > > > > > > > > Does this look fine to you? > > > > > > > > > > > > Yeah, your version looks good too. You have ' instead of " so that is ok. > > > > > > > > > > > > Anton Louw > > > > Cloud Engineer: Storage and Virtualization at Vox > > > > T: 087 805 0000 | D: 087 805 1572 > > > > M: N/A > > > > E: anton.louw(a)voxtelecom.co.za > > > > A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg > > > > > www.vox.co.za > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > Thanks > > > > > > > > > > > > > > > > > > > > Anton Louw > > > > > Cloud Engineer: Storage and Virtualization at Vox > > > > > T: 087 805 0000 | D: 087 805 1572 > > > > > M: N/A > > > > > E: anton.louw(a)voxtelecom.co.za > > > > > A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg > > > > > > www.vox.co.za > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > From: Anton Louw > > > > > Sent: 22 April 2020 10:07 > > > > > To: Artur Socha <asocha(a)redhat.com> > > > > > Subject: RE: [ovirt-users] oVirt and KeyCloak intergration > > > > > > > > > > Hi Artur, > > > > > > > > > > Great, I will try the below and let you know. I appreciate your efforts. > > > > > > > > > > Sure, you may report it, I was in such a rush that I only hit “reply” > and > > > > > not “Reply All” > > > > > > > > > > I do recall that I had to make some changes to the below as the it > > > > > complained about syntax errors: > > > > > > > > > > ErrorDocument 401 "<html><meta http-equiv=\"refresh\" > > > > > content=\"0; url=/ovirt-engine/sso/login-unauthorized\"/><body><a > > > > > href=\"/ovirt-engine/sso/login-unauthorized\">Here</a></body></html>" > > > > > </If> > > > > > </LocationMatch> > > > > > > > > > > I will let you know the outcome when I change the below as you > suggested. > > > > > > > > > > Cheers > > > > > > > > > > From: Artur Socha <asocha(a)redhat.com> > > > > > > Sent: 22 April 2020 09:51 > > > > > To: Anton Louw <Anton.Louw(a)voxtelecom.co.za> > > > > > Subject: Re: [ovirt-users] oVirt and KeyCloak intergration > > > > > > > > > > I checked your logs and I did not notice anything suspicious. > > > > > However, now I recall I made some changes compared to blog post > > > > > example: > > > > > > > > > > 1) /etc/ovirt-engine/extensions.d/openid-http-mapping.properties > > > > > I added escaping in regexp for '\' > > > > > ... > > > > > config.mapAuthRecord.regex.pattern = > > > > > ^(?<user>.*?)((\\\\(?<at>@)(?<suffix>.*?)@.*)|(?<realm>@.*))$ > > > > > ... > > > > > > > > > > 2) /etc/httpd/ovirt-openidc.conf > > > > > Escaping for '"' in error document snippet > > > > > ... > > > > > <LocationMatch ^/ovirt-engine/sso/(interactive-login- > > > > > negotiate|oauth/token-http-auth)|^/ovirt-engine/callback> > > > > > <If "req('Authorization') !~ /^(Bearer|Basic)/i"> > > > > > > > > > > Require valid-user > > > > > AuthType openid-connect > > > > > > > > > > ErrorDocument 401 "<html><meta http-equiv=\"refresh\" > > > > > content=\"0; url=/ovirt-engine/sso/login-unauthorized\"/><body><a > > > > > href=\"/ovirt-engine/sso/login-unauthorized\">Here</a></body></html>" > > > > > </If> > > > > > </LocationMatch> > > > > > > > > > > ... > > > > > > > > > > These two issues were most probably caused by the blog site rendering. > > > > > > > > > > > > > > > You might want to check engine.log (or server.log not really sure which > > > > > one was that) for aaa extension initialization logs. They should > > > > > appear at the beginning just after restarting engine. > > > > > > > > > > Unfortunately, at the moment I do not have running keycloak setup (I > > > > > used to have a local VM) but I will try to find some time to set it up > > > > > again once I'm done with another work item that actually consumes > > > > > almost entire disk space for my 2 machines) > > > > > > > > > > Please let me know if anything changes after applying these config > > > > > changes. It this works for you then I will request the blog post to be > > > > > updated. > > > > > > > > > > Do you mind if I keep(re-post) this discussion back to users@ovirt in > > > > > case other might have similar issues with keycloak integration? > > > > > > > > > > A. > > > > > > > > > > On Wed, 2020-04-22 at 06:35 +0000, Anton Louw wrote: > > > > > > > > > > > > Hi Artru, > > > > > > > > > > > > Thank you for the reply. The post [1] is actually the main source of > > > > > > information I worked from in order top get everything configured. In > > > > > > the post[1] I ran through the whole testing section, and everything > > > > > > works as expected. I can see the VMs etc when using the python > > > > > > script. > > > > > > > > > > > > In my case we are not using ldap as a provider, I tried using > > > > > > keycloak directly as a provider, I am not sure if that is where I am > > > > > > going wrong? > > > > > > > > > > > > I have attached the last part of the apache ssl_access_log when I > > > > > > tried logging in this morning. I have also attached the engine log. > > > > > > > > > > > > Thanks > > > > > > > > > > > > > > > > > > Anton Louw > > > > > > Cloud Engineer: Storage and Virtualization at Vox > > > > > > T: 087 805 0000 | D: 087 805 1572 > > > > > > M: N/A > > > > > > E: anton.louw(a)voxtelecom.co.za > > > > > > A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg > > > > > > > www.vox.co.za > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > From: Artru Socha <asocha(a)redhat.com> > > > > > > > Sent: 21 April 2020 15:20 > > > > > > To: Anton Louw <Anton.Louw(a)voxtelecom.co.za>; > users(a)ovirt.org > > > > > > Subject: Re: [ovirt-users] oVirt and KeyCloak intergration > > > > > > > > > > > > On Tue, 2020-04-21 at 12:48 +0000, Anton Louw wrote: > > > > > > > > > > > > > > Hi Everybody, > > > > > > > > > > > > > > > > > > > > Hi Anton, > > > > > > > > > > > > > Has anybody gone the route of using KeyCloak to login to oVirt? > > > > > > > KeyCloak has been configured and the neccesary configs have also > > > > > > been > > > > > > > done on the engine. It redirects perfectly from the oVirt Web Login > > > > > > > page to KeyCloak, but after logging into KeyCloak, I get redirected > > > > > > > back to the oVirt Web Login. When trying to login again, I get the > > > > > > > below error: > > > > > > > > > > > > > > > > > > > > > > > > > > > > server_error: Missing parameter: 'params' > > > > > > > > > > > > > > > > > > > Not so long ago I managed to setup ovirt engine with keyloack (using > > > > > > ldap as users provider). Hopefully, I would be able to help you with > > > > > > it. > > > > > > > > > > > > There is excellent blog post[1] available. You might also check > > > > > > keycloak+ldap post [2], however, when I was working on the > > > > > > integration > > > > > > I was not aware of if and did not test it. > > > > > > > > > > > > The error you mentioned does not really indicate what exactly is > > > > > > wrong > > > > > > but it might suggest that there is some sort of misconfiguration with > > > > > > apache (you need to install and configure mod_auth_openidc as > > > > > > described > > > > > > at [1]). At least that happened in my case. > > > > > > > > > > > > In case you have already gone through it you could probably check > > > > > > apache logs. > > > > > > > > > > > > Under [1] there is a python script that can be used to check api > > > > > > calls, > > > > > > please update username/password and test it against your environment. > > > > > > > > > > > > > > > > > > Would it be possible post relevant piece of apache logs together with > > > > > > engine.log ? > > > > > > > > > > > > > > > > > > [1] > > > > > > > > > > > > https://blogs.ovirt.org/2019/01/federate-ovirt-engine-authentication-to-ope… > > > > > > [2] > > > > > > > > > > > > https://blogs.ovirt.org/2018/08/ovirt-saml-with-keyloak-using-389ds-user-fe… > > > > > > Artur > > > > > > > > > > > > > > > > > > > > > > > > > I have checked all the logs, but nothing is telling me what exactly > > > > > > > the issue is. > > > > > > > > > > > > > > If anybody has any idea, please let me know. > > > > > > > > > > > > > > Thanks > > > > > > > > > > > > > > Anton Louw > > > > > > > Cloud Engineer: Storage and Virtualization at Vox > > > > > > > T: 087 805 0000 | D: 087 805 1572 > > > > > > > M: N/A > > > > > > > E: anton.louw(a)voxtelecom.co.za > > > > > > > A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg > > > > > > > > www.vox.co.za > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > Disclaimer > > > > > > > The contents of this email are confidential to the sender and the > > > > > > > intended recipient. Unless the contents are clearly and entirely of > > > > > > a > > > > > > > personal nature, they are subject to copyright in favour of the > > > > > > > holding company of the Vox group of companies. Any recipient who > > > > > > > receives this email in error should immediately report the error to > > > > > > > the sender and permanently delete this email from all storage > > > > > > > devices. > > > > > > > > > > > > > > This email has been scanned for viruses and malware, and may have > > > > > > > been automatically archived by Mimecast Ltd, an innovator in > > > > > > Software > > > > > > > as a Service (SaaS) for business. Providing a safer and more useful > > > > > > > place for your human generated data. Specializing in; Security, > > > > > > > archiving and compliance. To find out more Click Here. > > > > > > > > > > > > > > > > > > > > > _______________________________________________ > > > > > > > Users mailing list -- users(a)ovirt.org > > > > > > > To unsubscribe send an email to > users-leave(a)ovirt.org > > > > > > > Privacy Statement: > https://www.ovirt.org/privacy-policy.html > > > > > > > oVirt Code of Conduct: > > > > > > > > https://www.ovirt.org/community/about/community-guidelines/ > > > > > > > List Archives: > > > > > > > > > > > > > https://lists.ovirt.org/archives/list/users@ovirt.org/message/S4I2I3MID4A4A… > > > > > > > > > > > > > > >

2 2

Batch delete Snapshots
by Christian Reiss 22 Apr '20

22 Apr '20

Hey folks, quick question: Can this be made batch-able? # gluster snapshot delete all System contains 1 snapshot(s). Do you still want to continue and delete them? (y/n) So for a script I could do a snapshot, copy the contents and auto-remove all snapshots after. I could go with snapshot list and act on those, but this seems like it should be in the code? -Chris. -- with kind regards, mit freundlichen Gruessen, Christian Reiss

2 1

Re: Safely disable firewalld [Ovirt 4.3]
by Strahil Nikolov 22 Apr '20

22 Apr '20

On April 22, 2020 6:33:40 PM GMT+03:00, Edson Richter <edsonrichter(a)hotmail.com> wrote: >I'm in no way a ovirt expert. But as Linux administrator, I would say >that firewalld and iptables are "front-end" to kernel internal security >tables, so, in the final of the day, will provide *almost* same >functionality. > >Seems that firewalld is able to activate modules without restarting >entire firewall infra-structure, which iptables is not capable of. This >leverage an advantage for firewalld, specially where you would not have >interruptions in existing stateful connections. > >I've used iptables *always* as replacement for firewalld because of >almost 20 yrs using iptables - this is the first step in all about >hundred Centos7 installations I've done past few years. I just can't >throw away all my scripts that block hackers, provide 2 and 3 way >"knock-knock" lockers, fail2ban customizations, nat rules, DMZ, and >all, everytime a new "firewall" front end appears. I've seen at least >two or three "iptables killers tech" in the past, and iptables still is >the king - at least for me. > >Again, repeating myself, I'm no ovirt specialist. Just a sazonal linux >admin which will not jump from iptables train yet. > >Perhaps, I would not reccomend to completely deactivate all firewall in >any server! If it is the case, I would instead to advice to just >replace firewalld with iptables-service (at least, in Centos7) - but >only in case you have too much to loose without iptables (as am I). > >Regards, > >Edson > > >________________________________ >De: eevans(a)digitaldatatechs.com <eevans(a)digitaldatatechs.com> >Enviado: quarta-feira, 22 de abril de 2020 12:18 >Para: francesco(a)shellrent.com <francesco(a)shellrent.com>; >users(a)ovirt.org <users(a)ovirt.org> >Assunto: [ovirt-users] Re: Safely disable firewalld [Ovirt 4.3] > >If you log in to the cockpit, you can add services or custom ports >easily. I would not disable the firewall. ><hostname:9090> for the cockpit. > >Eric Evans >Digital Data Services LLC. >304.660.9080 > > >-----Original Message----- >From: francesco(a)shellrent.com <francesco(a)shellrent.com> >Sent: Tuesday, April 21, 2020 12:54 PM >To: users(a)ovirt.org >Subject: [ovirt-users] Safely disable firewalld [Ovirt 4.3] > >Hi all, > >I was wondering if it's "safe" disabling entirely the firewalld service >and manage the firewall only via iptables, on the host and on the >hosted engine (a self-hosted engine). It would make a lot easier the >managing the firewall rules for me because of many automatisms I >created based on iptables. Did anyone manage to do this? Any >contraindication for doing this or precaution that I have to take care >of? > >Thanks for your time and help, >Francesco >_______________________________________________ >Users mailing list -- users(a)ovirt.org >To unsubscribe send an email to users-leave(a)ovirt.org Privacy >Statement: >https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ovirt… >oVirt Code of Conduct: >https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ovirt… >List Archives: >https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.ovi… >_______________________________________________ >Users mailing list -- users(a)ovirt.org >To unsubscribe send an email to users-leave(a)ovirt.org >Privacy Statement: >https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ovirt… >oVirt Code of Conduct: >https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ovirt… >List Archives: >https://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.ovi… Keep in mind that I had some issues with oVirt (was more than a year ago - so don't ask for details) when either firewalld or SELINUX were down. With so much experience in IPTABLES - it's understandable, but keep in mind that in CentOS/RHEL 8 iptables command is just a translator to nftables - with limited capability and I don't think that it was a coincidence . With firewalld you can still achive 90-95% of what you could do in IPTABLES while the rules are quite clear even for a new admin. What I really like is that you can predefine the ports and protos for a specific service and easily deploy it via salt or ansible. Best Regards, Strahil Nikolov

2 1

Safely disable firewalld [Ovirt 4.3]
by francesco＠shellrent.com 22 Apr '20

22 Apr '20

Hi all, I was wondering if it's "safe" disabling entirely the firewalld service and manage the firewall only via iptables, on the host and on the hosted engine (a self-hosted engine). It would make a lot easier the managing the firewall rules for me because of many automatisms I created based on iptables. Did anyone manage to do this? Any contraindication for doing this or precaution that I have to take care of? Thanks for your time and help, Francesco

6 6

Re: oVirt and KeyCloak intergration
by Artur Socha 22 Apr '20

22 Apr '20

On Wed, 2020-04-22 at 10:42 +0000, Anton Louw wrote: > > > Ok so this is definitely looking better. I get an error, but at least now it > is saying : “The user admin@openidchttp is not authorized to perform login” > > This is strange though, because admin in by default should be allowed access? Well, yes and no :) In order for user to be considered admin (for ovirt engine) it must belong to keycloak's ovirt-administrator group (in keycloak admin panel see Manage- >Groups->Members) I think you are very close to have it up-and-running. > > From: Anton Louw > Sent: 22 April 2020 12:38 > To: Artur Socha <asocha(a)redhat.com>; users(a)ovirt.org > Subject: RE: [ovirt-users] oVirt and KeyCloak intergration > > Perfect, I’ll test and let you know. > > Thanks > > From: Artur Socha <asocha(a)redhat.com> > Sent: 22 April 2020 12:32 > To: Anton Louw <Anton.Louw(a)voxtelecom.co.za>; users(a)ovirt.org > Subject: Re: [ovirt-users] oVirt and KeyCloak intergration > > + users(a)ovirt.org > > On Wed, 2020-04-22 at 09:57 +0000, Anton Louw wrote: > > > > > > Hi Artur, > > > > I would just like to make sure I am following correctly, comparing your > > entries against mine. > > > > Your setup: > > ... > > config.mapAuthRecord.regex.pattern = > > ^(?<user>.*?)((\\\\(?<at>@)(?<suffix>.*?)@.*)|(?<realm>@.*))$ > > ... > > > > > > My setup: > > … > > config.mapAuthRecord.regex.pattern = > > ^(?<user>.*?)((\\(?<at>@)(?<suffix>.*?)@.*)|(?<realm>@.*))$ > > … > > > > Should I add the additional 2 “\\” in on my side? > > > Yes, please try adding it. In my case I learned about this issue by debugging > the code because the real exception generated by incorrect regexp syntax was > hidden behind generic error message giving no clues about the true cause. > > > > > Your setup: > > ... > > <LocationMatch ^/ovirt-engine/sso/(interactive-login-negotiate|oauth/token- > > http-auth)|^/ovirt-engine/callback> > > <If "req('Authorization') !~ /^(Bearer|Basic)/i"> > > > > Require valid-user > > AuthType openid-connect > > > > ErrorDocument 401 "<html><meta http-equiv=\"refresh\"content=\"0; > > url=/ovirt-engine/sso/login-unauthorized\"/><body><ahref=\"/ovirt- > > engine/sso/login-unauthorized\">Here</a></body></html>" > > </If> > > </LocationMatch> > > … > > > > My setup: > > … > > <LocationMatch ^/ovirt-engine/sso/(interactive-login-negotiate|oauth/token- > > http-auth)|^/ovirt-engine/callback> > > <If "req('Authorization') !~ /^(Bearer|Basic)/i"> > > > > Require valid-user > > AuthType openid-connect > > > > ErrorDocument 401 "<html><meta http-equiv='refresh' content='0; > > url=/ovirt-engine/sso/login-unauthorized'/><body><a href='/ovirt- > > engine/sso/login-unauthorized'>Here</a></body></html>" > > </If> > > </LocationMatch> > > … > > > > I remember I had syntax errors, but mine was changed. > > > > Does this look fine to you? > > > Yeah, your version looks good too. You have ' instead of " so that is ok. > > > Anton Louw > Cloud Engineer: Storage and Virtualization at Vox > T: 087 805 0000 | D: 087 805 1572 > M: N/A > E: anton.louw(a)voxtelecom.co.za > A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg > www.vox.co.za > > > > > > > > > > > > > > Thanks > > > > > > > > Anton Louw > > Cloud Engineer: Storage and Virtualization at Vox > > T: 087 805 0000 | D: 087 805 1572 > > M: N/A > > E: anton.louw(a)voxtelecom.co.za > > A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg > > www.vox.co.za > > > > > > > > > > > > > > > > > > > > > > > > > > From: Anton Louw > > Sent: 22 April 2020 10:07 > > To: Artur Socha <asocha(a)redhat.com> > > Subject: RE: [ovirt-users] oVirt and KeyCloak intergration > > > > Hi Artur, > > > > Great, I will try the below and let you know. I appreciate your efforts. > > > > Sure, you may report it, I was in such a rush that I only hit “reply” and > > not “Reply All” > > > > I do recall that I had to make some changes to the below as the it > > complained about syntax errors: > > > > ErrorDocument 401 "<html><meta http-equiv=\"refresh\" > > content=\"0; url=/ovirt-engine/sso/login-unauthorized\"/><body><a > > href=\"/ovirt-engine/sso/login-unauthorized\">Here</a></body></html>" > > </If> > > </LocationMatch> > > > > I will let you know the outcome when I change the below as you suggested. > > > > Cheers > > > > From: Artur Socha <asocha(a)redhat.com> > > Sent: 22 April 2020 09:51 > > To: Anton Louw <Anton.Louw(a)voxtelecom.co.za> > > Subject: Re: [ovirt-users] oVirt and KeyCloak intergration > > > > I checked your logs and I did not notice anything suspicious. > > However, now I recall I made some changes compared to blog post > > example: > > > > 1) /etc/ovirt-engine/extensions.d/openid-http-mapping.properties > > I added escaping in regexp for '\' > > ... > > config.mapAuthRecord.regex.pattern = > > ^(?<user>.*?)((\\\\(?<at>@)(?<suffix>.*?)@.*)|(?<realm>@.*))$ > > ... > > > > 2) /etc/httpd/ovirt-openidc.conf > > Escaping for '"' in error document snippet > > ... > > <LocationMatch ^/ovirt-engine/sso/(interactive-login- > > negotiate|oauth/token-http-auth)|^/ovirt-engine/callback> > > <If "req('Authorization') !~ /^(Bearer|Basic)/i"> > > > > Require valid-user > > AuthType openid-connect > > > > ErrorDocument 401 "<html><meta http-equiv=\"refresh\" > > content=\"0; url=/ovirt-engine/sso/login-unauthorized\"/><body><a > > href=\"/ovirt-engine/sso/login-unauthorized\">Here</a></body></html>" > > </If> > > </LocationMatch> > > > > ... > > > > These two issues were most probably caused by the blog site rendering. > > > > > > You might want to check engine.log (or server.log not really sure which > > one was that) for aaa extension initialization logs. They should > > appear at the beginning just after restarting engine. > > > > Unfortunately, at the moment I do not have running keycloak setup (I > > used to have a local VM) but I will try to find some time to set it up > > again once I'm done with another work item that actually consumes > > almost entire disk space for my 2 machines) > > > > Please let me know if anything changes after applying these config > > changes. It this works for you then I will request the blog post to be > > updated. > > > > Do you mind if I keep(re-post) this discussion back to users@ovirt in > > case other might have similar issues with keycloak integration? > > > > A. > > > > On Wed, 2020-04-22 at 06:35 +0000, Anton Louw wrote: > > > > > > > > > Hi Artru, > > > > > > Thank you for the reply. The post [1] is actually the main source of > > > information I worked from in order top get everything configured. In > > > the post[1] I ran through the whole testing section, and everything > > > works as expected. I can see the VMs etc when using the python > > > script. > > > > > > In my case we are not using ldap as a provider, I tried using > > > keycloak directly as a provider, I am not sure if that is where I am > > > going wrong? > > > > > > I have attached the last part of the apache ssl_access_log when I > > > tried logging in this morning. I have also attached the engine log. > > > > > > Thanks > > > > > > > > > Anton Louw > > > Cloud Engineer: Storage and Virtualization at Vox > > > T: 087 805 0000 | D: 087 805 1572 > > > M: N/A > > > E: anton.louw(a)voxtelecom.co.za > > > A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg > > > www.vox.co.za > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > From: Artru Socha <asocha(a)redhat.com> > > > Sent: 21 April 2020 15:20 > > > To: Anton Louw <Anton.Louw(a)voxtelecom.co.za>; users(a)ovirt.org > > > Subject: Re: [ovirt-users] oVirt and KeyCloak intergration > > > > > > On Tue, 2020-04-21 at 12:48 +0000, Anton Louw wrote: > > > > > > > > > > > > Hi Everybody, > > > > > > > > > > > Hi Anton, > > > > > > > Has anybody gone the route of using KeyCloak to login to oVirt? > > > > KeyCloak has been configured and the neccesary configs have also > > > been > > > > done on the engine. It redirects perfectly from the oVirt Web Login > > > > page to KeyCloak, but after logging into KeyCloak, I get redirected > > > > back to the oVirt Web Login. When trying to login again, I get the > > > > below error: > > > > > > > > > > > > > > > > server_error: Missing parameter: 'params' > > > > > > > > > > Not so long ago I managed to setup ovirt engine with keyloack (using > > > ldap as users provider). Hopefully, I would be able to help you with > > > it. > > > > > > There is excellent blog post[1] available. You might also check > > > keycloak+ldap post [2], however, when I was working on the > > > integration > > > I was not aware of if and did not test it. > > > > > > The error you mentioned does not really indicate what exactly is > > > wrong > > > but it might suggest that there is some sort of misconfiguration with > > > apache (you need to install and configure mod_auth_openidc as > > > described > > > at [1]). At least that happened in my case. > > > > > > In case you have already gone through it you could probably check > > > apache logs. > > > > > > Under [1] there is a python script that can be used to check api > > > calls, > > > please update username/password and test it against your environment. > > > > > > > > > Would it be possible post relevant piece of apache logs together with > > > engine.log ? > > > > > > > > > [1] > > > > > https://blogs.ovirt.org/2019/01/federate-ovirt-engine-authentication-to-ope… > > > [2] > > > > > https://blogs.ovirt.org/2018/08/ovirt-saml-with-keyloak-using-389ds-user-fe… > > > > > > Artur > > > > > > > > > > > > > I have checked all the logs, but nothing is telling me what exactly > > > > the issue is. > > > > > > > > If anybody has any idea, please let me know. > > > > > > > > Thanks > > > > > > > > Anton Louw > > > > Cloud Engineer: Storage and Virtualization at Vox > > > > T: 087 805 0000 | D: 087 805 1572 > > > > M: N/A > > > > E: anton.louw(a)voxtelecom.co.za > > > > A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg > > > > www.vox.co.za > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > Disclaimer > > > > The contents of this email are confidential to the sender and the > > > > intended recipient. Unless the contents are clearly and entirely of > > > a > > > > personal nature, they are subject to copyright in favour of the > > > > holding company of the Vox group of companies. Any recipient who > > > > receives this email in error should immediately report the error to > > > > the sender and permanently delete this email from all storage > > > > devices. > > > > > > > > This email has been scanned for viruses and malware, and may have > > > > been automatically archived by Mimecast Ltd, an innovator in > > > Software > > > > as a Service (SaaS) for business. Providing a safer and more useful > > > > place for your human generated data. Specializing in; Security, > > > > archiving and compliance. To find out more Click Here. > > > > > > > > > > > > _______________________________________________ > > > > Users mailing list -- users(a)ovirt.org > > > > To unsubscribe send an email to users-leave(a)ovirt.org > > > > Privacy Statement: https://www.ovirt.org/privacy-policy.html > > > > oVirt Code of Conduct: > > > > https://www.ovirt.org/community/about/community-guidelines/ > > > > List Archives: > > > > > > > > > https://lists.ovirt.org/archives/list/users@ovirt.org/message/S4I2I3MID4A4A… > > > > > > >

2 2

Re: oVirt and KeyCloak intergration
by Anton Louw 22 Apr '20

22 Apr '20

Ok so this is definitely looking better. I get an error, but at least now it is saying : “The user admin@openidchttp is not authorized to perform login” This is strange though, because admin in by default should be allowed access? Anton Louw Cloud Engineer: Storage and Virtualization ______________________________________ D: 087 805 1572 | M: N/A A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg anton.louw(a)voxtelecom.co.za www.vox.co.za From: Anton Louw Sent: 22 April 2020 12:38 To: Artur Socha <asocha(a)redhat.com>; users(a)ovirt.org Subject: RE: [ovirt-users] oVirt and KeyCloak intergration Perfect, I’ll test and let you know. Thanks From: Artur Socha <asocha(a)redhat.com<mailto:asocha@redhat.com>> Sent: 22 April 2020 12:32 To: Anton Louw <Anton.Louw(a)voxtelecom.co.za<mailto:Anton.Louw@voxtelecom.co.za>>; users(a)ovirt.org<mailto:users@ovirt.org> Subject: Re: [ovirt-users] oVirt and KeyCloak intergration + users(a)ovirt.org<mailto:users@ovirt.org> On Wed, 2020-04-22 at 09:57 +0000, Anton Louw wrote: Hi Artur, I would just like to make sure I am following correctly, comparing your entries against mine. Your setup: ... config.mapAuthRecord.regex.pattern = ^(?<user>.*?)((\\\\(?<at>@)(?<suffix>.*?)@.*)|(?<realm>@.*))$<file://(%3f%3cat%3e@)(%3f%3csuffix%3e.*%3f)@.*)(%3f%3crealm%3e@.*))$)$> ... My setup: … config.mapAuthRecord.regex.pattern = ^(?<user>.*?)((\\(?<at>@)(?<suffix>.*?)@.*)|(?<realm>@.*))$<file://(%3f%3cat%3e@)(%3f%3csuffix%3e.*%3f)@.*)(%3f%3crealm%3e@.*))$)$> … Should I add the additional 2 “\\” in on my side? Yes, please try adding it. In my case I learned about this issue by debugging the code because the real exception generated by incorrect regexp syntax was hidden behind generic error message giving no clues about the true cause. Your setup: ... <LocationMatch ^/ovirt-engine/sso/(interactive-login-negotiate|oauth/token-http-auth)|^/ovirt-engine/callback> <If "req('Authorization') !~ /^(Bearer|Basic)/i"> Require valid-user AuthType openid-connect ErrorDocument 401 "<html><meta http-equiv=\"refresh\"content=\"0; url=/ovirt-engine/sso/login-unauthorized\"/><body><ahref=\"/ovirt-engine/sso/login-unauthorized\">Here</a></body></html>" </If> </LocationMatch> … My setup: … <LocationMatch ^/ovirt-engine/sso/(interactive-login-negotiate|oauth/token-http-auth)|^/ovirt-engine/callback> <If "req('Authorization') !~ /^(Bearer|Basic)/i"> Require valid-user AuthType openid-connect ErrorDocument 401 "<html><meta http-equiv='refresh' content='0; url=/ovirt-engine/sso/login-unauthorized'/><body><a href='/ovirt-engine/sso/login-unauthorized'>Here</a></body></html>" </If> </LocationMatch> … I remember I had syntax errors, but mine was changed. Does this look fine to you? Yeah, your version looks good too. You have ' instead of " so that is ok. Thanks Anton Louw Cloud Engineer: Storage and Virtualization at Vox ________________________________ T: 087 805 0000 | D: 087 805 1572 M: N/A E: anton.louw(a)voxtelecom.co.za<mailto:anton.louw@voxtelecom.co.za> A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg www.vox.co.za<http://www.vox.co.za> [F]<https://www.facebook.com/voxtelecomZA> [T]<https://www.twitter.com/voxtelecom> [I]<https://www.instagram.com/voxtelecomza> [L]<https://www.linkedin.com/company/voxtelecom> [Y]<https://www.youtube.com/user/VoxTelecom> From: Anton Louw Sent: 22 April 2020 10:07 To: Artur Socha <asocha(a)redhat.com<mailto:asocha@redhat.com>> Subject: RE: [ovirt-users] oVirt and KeyCloak intergration Hi Artur, Great, I will try the below and let you know. I appreciate your efforts. Sure, you may report it, I was in such a rush that I only hit “reply” and not “Reply All” I do recall that I had to make some changes to the below as the it complained about syntax errors: ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0; url=/ovirt-engine/sso/login-unauthorized\"/><body><a href=\"/ovirt-engine/sso/login-unauthorized\">Here</a></body></html>" </If> </LocationMatch> I will let you know the outcome when I change the below as you suggested. Cheers From: Artur Socha <asocha(a)redhat.com<mailto:asocha@redhat.com>> Sent: 22 April 2020 09:51 To: Anton Louw <Anton.Louw(a)voxtelecom.co.za<mailto:Anton.Louw@voxtelecom.co.za>> Subject: Re: [ovirt-users] oVirt and KeyCloak intergration I checked your logs and I did not notice anything suspicious. However, now I recall I made some changes compared to blog post example: 1) /etc/ovirt-engine/extensions.d/openid-http-mapping.properties I added escaping in regexp for '\' ... config.mapAuthRecord.regex.pattern = ^(?<user>.*?)((\\\\(?<at>@)(?<suffix>.*?)@.*)|(?<realm>@.*))$<file://(%3f%3cat%3e@)(%3f%3csuffix%3e.*%3f)@.*)(%3f%3crealm%3e@.*))$)$> ... 2) /etc/httpd/ovirt-openidc.conf Escaping for '"' in error document snippet ... <LocationMatch ^/ovirt-engine/sso/(interactive-login- negotiate|oauth/token-http-auth)|^/ovirt-engine/callback> <If "req('Authorization') !~ /^(Bearer|Basic)/i"> Require valid-user AuthType openid-connect ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0; url=/ovirt-engine/sso/login-unauthorized\"/><body><a href=\"/ovirt-engine/sso/login-unauthorized\">Here</a></body></html>" </If> </LocationMatch> ... These two issues were most probably caused by the blog site rendering. You might want to check engine.log (or server.log not really sure which one was that) for aaa extension initialization logs. They should appear at the beginning just after restarting engine. Unfortunately, at the moment I do not have running keycloak setup (I used to have a local VM) but I will try to find some time to set it up again once I'm done with another work item that actually consumes almost entire disk space for my 2 machines) Please let me know if anything changes after applying these config changes. It this works for you then I will request the blog post to be updated. Do you mind if I keep(re-post) this discussion back to users@ovirt in case other might have similar issues with keycloak integration? A. On Wed, 2020-04-22 at 06:35 +0000, Anton Louw wrote: > > > Hi Artru, > > Thank you for the reply. The post [1] is actually the main source of > information I worked from in order top get everything configured. In > the post[1] I ran through the whole testing section, and everything > works as expected. I can see the VMs etc when using the python > script. > > In my case we are not using ldap as a provider, I tried using > keycloak directly as a provider, I am not sure if that is where I am > going wrong? > > I have attached the last part of the apache ssl_access_log when I > tried logging in this morning. I have also attached the engine log. > > Thanks > > > Anton Louw > Cloud Engineer: Storage and Virtualization at Vox > T: 087 805 0000 | D: 087 805 1572 > M: N/A > E: anton.louw(a)voxtelecom.co.za<mailto:anton.louw@voxtelecom.co.za> > A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg > www.vox.co.za<http://www.vox.co.za> > > > > > > > > > > > > > From: Artru Socha <asocha(a)redhat.com<mailto:asocha@redhat.com>> > Sent: 21 April 2020 15:20 > To: Anton Louw <Anton.Louw(a)voxtelecom.co.za<mailto:Anton.Louw@voxtelecom.co.za>>; users(a)ovirt.org<mailto:users@ovirt.org> > Subject: Re: [ovirt-users] oVirt and KeyCloak intergration > > On Tue, 2020-04-21 at 12:48 +0000, Anton Louw wrote: > > > > > > Hi Everybody, > > > > > Hi Anton, > > > Has anybody gone the route of using KeyCloak to login to oVirt? > > KeyCloak has been configured and the neccesary configs have also > been > > done on the engine. It redirects perfectly from the oVirt Web Login > > page to KeyCloak, but after logging into KeyCloak, I get redirected > > back to the oVirt Web Login. When trying to login again, I get the > > below error: > > > > > > > > server_error: Missing parameter: 'params' > > > > Not so long ago I managed to setup ovirt engine with keyloack (using > ldap as users provider). Hopefully, I would be able to help you with > it. > > There is excellent blog post[1] available. You might also check > keycloak+ldap post [2], however, when I was working on the > integration > I was not aware of if and did not test it. > > The error you mentioned does not really indicate what exactly is > wrong > but it might suggest that there is some sort of misconfiguration with > apache (you need to install and configure mod_auth_openidc as > described > at [1]). At least that happened in my case. > > In case you have already gone through it you could probably check > apache logs. > > Under [1] there is a python script that can be used to check api > calls, > please update username/password and test it against your environment. > > > Would it be possible post relevant piece of apache logs together with > engine.log ? > > > [1] > https://blogs.ovirt.org/2019/01/federate-ovirt-engine-authentication-to-ope…<https://blogs.ovirt.org/2019/01/federate-ovirt-engine-authentication-to-ope…> > [2] > https://blogs.ovirt.org/2018/08/ovirt-saml-with-keyloak-using-389ds-user-fe…<https://blogs.ovirt.org/2018/08/ovirt-saml-with-keyloak-using-389ds-user-fe…> > > Artur > > > > > I have checked all the logs, but nothing is telling me what exactly > > the issue is. > > > > If anybody has any idea, please let me know. > > > > Thanks > > > > Anton Louw > > Cloud Engineer: Storage and Virtualization at Vox > > T: 087 805 0000 | D: 087 805 1572 > > M: N/A > > E: anton.louw(a)voxtelecom.co.za<mailto:anton.louw@voxtelecom.co.za> > > A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg > > www.vox.co.za<http://www.vox.co.za> > > > > > > > > > > > > > > > > > > > > > > > > > > > > Disclaimer > > The contents of this email are confidential to the sender and the > > intended recipient. Unless the contents are clearly and entirely of > a > > personal nature, they are subject to copyright in favour of the > > holding company of the Vox group of companies. Any recipient who > > receives this email in error should immediately report the error to > > the sender and permanently delete this email from all storage > > devices. > > > > This email has been scanned for viruses and malware, and may have > > been automatically archived by Mimecast Ltd, an innovator in > Software > > as a Service (SaaS) for business. Providing a safer and more useful > > place for your human generated data. Specializing in; Security, > > archiving and compliance. To find out more Click Here. > > > > > > _______________________________________________ > > Users mailing list -- users(a)ovirt.org<mailto:users@ovirt.org> > > To unsubscribe send an email to users-leave(a)ovirt.org<mailto:users-leave@ovirt.org> > > Privacy Statement: https://www.ovirt.org/privacy-policy.html<https://www.ovirt.org/privacy-policy.html> > > oVirt Code of Conduct: > > https://www.ovirt.org/community/about/community-guidelines/<https://www.ovirt.org/community/about/community-guidelines> > > List Archives: > > > https://lists.ovirt.org/archives/list/users@ovirt.org/message/S4I2I3MID4A4A…<https://lists.ovirt.org/archives/list/users@ovirt.org/message/S4I2I3MID4A4A…> >

1 0

Re: oVirt and KeyCloak intergration
by Artur Socha 22 Apr '20

22 Apr '20

+ users(a)ovirt.org On Wed, 2020-04-22 at 09:57 +0000, Anton Louw wrote: > > > > Hi Artur, > > > > I would just like to make sure I am following correctly, comparing your > entries against mine. > > > > > Your setup: > > ... > > config.mapAuthRecord.regex.pattern = > ^(?<user>.*?)((\\\\(?<at>@)(?<suffix>.*?)@.*)|(?<realm>@.*))$ > > ... > > > > > > My setup: > > … > > config.mapAuthRecord.regex.pattern = > ^(?<user>.*?)((\\(?<at>@)(?<suffix>.*?)@.*)|(?<realm>@.*))$ > > … > > > > Should I add the additional 2 “\\” in on my side? Yes, please try adding it. In my case I learned about this issue by debugging the code because the real exception generated by incorrect regexp syntax was hidden behind generic error message giving no clues about the true cause. > > > Your setup: > > ... > > <LocationMatch ^/ovirt-engine/sso/(interactive-login-negotiate|oauth/token- > http-auth)|^/ovirt-engine/callback> > > <If "req('Authorization') !~ /^(Bearer|Basic)/i"> > > > > Require valid-user > > AuthType openid-connect > > > > ErrorDocument 401 "<html><meta http-equiv=\"refresh\"content=\"0; url=/ovirt- > engine/sso/login-unauthorized\"/><body><ahref=\"/ovirt-engine/sso/login- > unauthorized\">Here</a></body></html>" > > </If> > > </LocationMatch> > > … > > > > My setup: > > … > > <LocationMatch ^/ovirt-engine/sso/(interactive-login-negotiate|oauth/token- > http-auth)|^/ovirt-engine/callback> > > <If "req('Authorization') !~ /^(Bearer|Basic)/i"> > > > > Require valid-user > > AuthType openid-connect > > > > ErrorDocument 401 "<html><meta http-equiv='refresh' content='0; > url=/ovirt-engine/sso/login-unauthorized'/><body><a href='/ovirt- > engine/sso/login-unauthorized'>Here</a></body></html>" > > </If> > > </LocationMatch> > > … > > > > I remember I had syntax errors, but mine was changed. > > > > Does this look fine to you? > Yeah, your version looks good too. You have ' instead of " so that is ok. > Thanks > > > > > > > > Anton Louw > > > Cloud Engineer: Storage and Virtualization at Vox > > > > > > > T: 087 805 0000 | D: 087 805 1572 > M: N/A > > E: anton.louw(a)voxtelecom.co.za > A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg > > www.vox.co.za > > > > > > > > > > > > > > > > > > > > > > > > > From: Anton Louw > > > Sent: 22 April 2020 10:07 > > To: Artur Socha <asocha(a)redhat.com> > > Subject: RE: [ovirt-users] oVirt and KeyCloak intergration > > > > Hi Artur, > > Great, I will try the below and let you know. I appreciate your efforts. > > > Sure, you may report it, I was in such a rush that I only hit “reply” and not > “Reply All” > > I do recall that I had to make some changes to the below as the it complained > about syntax errors: > > ErrorDocument 401 "<html><meta http-equiv=\"refresh\" > > content=\"0; url=/ovirt-engine/sso/login-unauthorized\"/><body><a > > href=\"/ovirt-engine/sso/login-unauthorized\">Here</a></body></html>" > > </If> > > </LocationMatch> > > I will let you know the outcome when I change the below as you suggested. > > Cheers > > > > From: Artur Socha <asocha(a)redhat.com> > > > Sent: 22 April 2020 09:51 > > To: Anton Louw <Anton.Louw(a)voxtelecom.co.za> > > Subject: Re: [ovirt-users] oVirt and KeyCloak intergration > > > > I checked your logs and I did not notice anything suspicious. > > > However, now I recall I made some changes compared to blog post > > example: > > > > 1) /etc/ovirt-engine/extensions.d/openid-http-mapping.properties > > I added escaping in regexp for '\' > > ... > > config.mapAuthRecord.regex.pattern = > > ^(?<user>.*?)((\\\\(?<at>@)(?<suffix>.*?)@.*)|(?<realm>@.*))$ > > ... > > > > 2) /etc/httpd/ovirt-openidc.conf > > Escaping for '"' in error document snippet > > ... > > <LocationMatch ^/ovirt-engine/sso/(interactive-login- > > negotiate|oauth/token-http-auth)|^/ovirt-engine/callback> > > <If "req('Authorization') !~ /^(Bearer|Basic)/i"> > > > > Require valid-user > > AuthType openid-connect > > > > ErrorDocument 401 "<html><meta http-equiv=\"refresh\" > > content=\"0; url=/ovirt-engine/sso/login-unauthorized\"/><body><a > > href=\"/ovirt-engine/sso/login-unauthorized\">Here</a></body></html>" > > </If> > > </LocationMatch> > > > > ... > > > > These two issues were most probably caused by the blog site rendering. > > > > > > You might want to check engine.log (or server.log not really sure which > > one was that) for aaa extension initialization logs. They should > > appear at the beginning just after restarting engine. > > > > Unfortunately, at the moment I do not have running keycloak setup (I > > used to have a local VM) but I will try to find some time to set it up > > again once I'm done with another work item that actually consumes > > almost entire disk space for my 2 machines) > > > > Please let me know if anything changes after applying these config > > changes. It this works for you then I will request the blog post to be > > updated. > > > > Do you mind if I keep(re-post) this discussion back to users@ovirt in > > case other might have similar issues with keycloak integration? > > > > A. > > > > On Wed, 2020-04-22 at 06:35 +0000, Anton Louw wrote: > > > > > > > > > Hi Artru, > > > > > > Thank you for the reply. The post [1] is actually the main source of > > > information I worked from in order top get everything configured. In > > > the post[1] I ran through the whole testing section, and everything > > > works as expected. I can see the VMs etc when using the python > > > script. > > > > > > In my case we are not using ldap as a provider, I tried using > > > keycloak directly as a provider, I am not sure if that is where I am > > > going wrong? > > > > > > I have attached the last part of the apache ssl_access_log when I > > > tried logging in this morning. I have also attached the engine log. > > > > > > Thanks > > > > > > > > > Anton Louw > > > Cloud Engineer: Storage and Virtualization at Vox > > > T: 087 805 0000 | D: 087 805 1572 > > > M: N/A > > > E: anton.louw(a)voxtelecom.co.za > > > A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg > > > > www.vox.co.za > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > From: Artru Socha <asocha(a)redhat.com> > > > Sent: 21 April 2020 15:20 > > > To: Anton Louw <Anton.Louw(a)voxtelecom.co.za>; > users(a)ovirt.org > > > Subject: Re: [ovirt-users] oVirt and KeyCloak intergration > > > > > > On Tue, 2020-04-21 at 12:48 +0000, Anton Louw wrote: > > > > > > > > > > > > Hi Everybody, > > > > > > > > > > > Hi Anton, > > > > > > > Has anybody gone the route of using KeyCloak to login to oVirt? > > > > KeyCloak has been configured and the neccesary configs have also > > > been > > > > done on the engine. It redirects perfectly from the oVirt Web Login > > > > page to KeyCloak, but after logging into KeyCloak, I get redirected > > > > back to the oVirt Web Login. When trying to login again, I get the > > > > below error: > > > > > > > > > > > > > > > > server_error: Missing parameter: 'params' > > > > > > > > > > Not so long ago I managed to setup ovirt engine with keyloack (using > > > ldap as users provider). Hopefully, I would be able to help you with > > > it. > > > > > > There is excellent blog post[1] available. You might also check > > > keycloak+ldap post [2], however, when I was working on the > > > integration > > > I was not aware of if and did not test it. > > > > > > The error you mentioned does not really indicate what exactly is > > > wrong > > > but it might suggest that there is some sort of misconfiguration with > > > apache (you need to install and configure mod_auth_openidc as > > > described > > > at [1]). At least that happened in my case. > > > > > > In case you have already gone through it you could probably check > > > apache logs. > > > > > > Under [1] there is a python script that can be used to check api > > > calls, > > > please update username/password and test it against your environment. > > > > > > > > > Would it be possible post relevant piece of apache logs together with > > > engine.log ? > > > > > > > > > [1] > > > > https://blogs.ovirt.org/2019/01/federate-ovirt-engine-authentication-to-ope… > > > [2] > > > > https://blogs.ovirt.org/2018/08/ovirt-saml-with-keyloak-using-389ds-user-fe… > > > > > > Artur > > > > > > > > > > > > > I have checked all the logs, but nothing is telling me what exactly > > > > the issue is. > > > > > > > > If anybody has any idea, please let me know. > > > > > > > > Thanks > > > > > > > > Anton Louw > > > > Cloud Engineer: Storage and Virtualization at Vox > > > > T: 087 805 0000 | D: 087 805 1572 > > > > M: N/A > > > > E: anton.louw(a)voxtelecom.co.za > > > > A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg > > > > > www.vox.co.za > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > Disclaimer > > > > The contents of this email are confidential to the sender and the > > > > intended recipient. Unless the contents are clearly and entirely of > > > a > > > > personal nature, they are subject to copyright in favour of the > > > > holding company of the Vox group of companies. Any recipient who > > > > receives this email in error should immediately report the error to > > > > the sender and permanently delete this email from all storage > > > > devices. > > > > > > > > This email has been scanned for viruses and malware, and may have > > > > been automatically archived by Mimecast Ltd, an innovator in > > > Software > > > > as a Service (SaaS) for business. Providing a safer and more useful > > > > place for your human generated data. Specializing in; Security, > > > > archiving and compliance. To find out more Click Here. > > > > > > > > > > > > _______________________________________________ > > > > Users mailing list -- users(a)ovirt.org > > > > To unsubscribe send an email to users-leave(a)ovirt.org > > > > Privacy Statement: > https://www.ovirt.org/privacy-policy.html > > > > oVirt Code of Conduct: > > > > > https://www.ovirt.org/community/about/community-guidelines/ > > > > List Archives: > > > > > > > > https://lists.ovirt.org/archives/list/users@ovirt.org/message/S4I2I3MID4A4A… > > > > > > > > > > > > >

2 1

Mirror oVirt content
by adrianquintero＠gmail.com 21 Apr '20

21 Apr '20

Hello oVirt Community / infrastructure team, we would like to get guidance on how to mirror the oVirt content publicly. We replicate content using our own networks so we'd only be pulling the content from the oVirt content server from one location in Chicago. Please advise. Thank you, Adrian

4 4

Re: oVirt and KeyCloak intergration
by Artru Socha 21 Apr '20

21 Apr '20

On Tue, 2020-04-21 at 12:48 +0000, Anton Louw wrote: > > > Hi Everybody, > > Hi Anton, > Has anybody gone the route of using KeyCloak to login to oVirt? > KeyCloak has been configured and the neccesary configs have also been > done on the engine. It redirects perfectly from the oVirt Web Login > page to KeyCloak, but after logging into KeyCloak, I get redirected > back to the oVirt Web Login. When trying to login again, I get the > below error: > > > > server_error: Missing parameter: 'params' > Not so long ago I managed to setup ovirt engine with keyloack (using ldap as users provider). Hopefully, I would be able to help you with it. There is excellent blog post[1] available. You might also check keycloak+ldap post [2], however, when I was working on the integration I was not aware of if and did not test it. The error you mentioned does not really indicate what exactly is wrong but it might suggest that there is some sort of misconfiguration with apache (you need to install and configure mod_auth_openidc as described at [1]). At least that happened in my case. In case you have already gone through it you could probably check apache logs. Under [1] there is a python script that can be used to check api calls, please update username/password and test it against your environment. Would it be possible post relevant piece of apache logs together with engine.log ? [1] https://blogs.ovirt.org/2019/01/federate-ovirt-engine-authentication-to-ope… [2] https://blogs.ovirt.org/2018/08/ovirt-saml-with-keyloak-using-389ds-user-fe… Artur > I have checked all the logs, but nothing is telling me what exactly > the issue is. > > If anybody has any idea, please let me know. > > Thanks > > Anton Louw > Cloud Engineer: Storage and Virtualization at Vox > T: 087 805 0000 | D: 087 805 1572 > M: N/A > E: anton.louw(a)voxtelecom.co.za > A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg > www.vox.co.za > > > > > > > > > > > > > > Disclaimer > The contents of this email are confidential to the sender and the > intended recipient. Unless the contents are clearly and entirely of a > personal nature, they are subject to copyright in favour of the > holding company of the Vox group of companies. Any recipient who > receives this email in error should immediately report the error to > the sender and permanently delete this email from all storage > devices. > > This email has been scanned for viruses and malware, and may have > been automatically archived by Mimecast Ltd, an innovator in Software > as a Service (SaaS) for business. Providing a safer and more useful > place for your human generated data. Specializing in; Security, > archiving and compliance. To find out more Click Here. > > > _______________________________________________ > Users mailing list -- users(a)ovirt.org > To unsubscribe send an email to users-leave(a)ovirt.org > Privacy Statement: https://www.ovirt.org/privacy-policy.html > oVirt Code of Conduct: > https://www.ovirt.org/community/about/community-guidelines/ > List Archives: > https://lists.ovirt.org/archives/list/users@ovirt.org/message/S4I2I3MID4A4A…

1 0

oVirt and KeyCloak intergration
by Anton Louw 21 Apr '20

21 Apr '20

Hi Everybody, Has anybody gone the route of using KeyCloak to login to oVirt? KeyCloak has been configured and the neccesary configs have also been done on the engine. It redirects perfectly from the oVirt Web Login page to KeyCloak, but after logging into KeyCloak, I get redirected back to the oVirt Web Login. When trying to login again, I get the below error: [cid:ea1b2738-7e36-4cdb-8650-191d6992853c] server_error: Missing parameter: 'params' I have checked all the logs, but nothing is telling me what exactly the issue is. If anybody has any idea, please let me know. Thanks Anton Louw Cloud Engineer: Storage and Virtualization ______________________________________ D: 087 805 1572 | M: N/A A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg anton.louw(a)voxtelecom.co.za www.vox.co.za

1 0

Migrate engine to another storage domain without losing engine settings?
by Simon Nylund 21 Apr '20

21 Apr '20

Have been trying to figure out a simple way of migrating our hosted-engine to another storage domain, while keeping the data on the same domain. Is there any safe way of doing this? Fortunately I've only tested this in a dev environment, where I ended up with not being to able to restore the backup I did. The only way I got it to work was to deploy a fresh engine attached to the new storage domain, and then import the data storage domain containing the vms. The problem with that is that I lose all the settings I had in my hosted engine, and the hosts.

4 6

spice options hook
by ozmen62＠hotmail.com 21 Apr '20

21 Apr '20

Hi, We're using oVirt 4.3 and want to use spice streaming to better user experience, for example youtube etc. I've tried to use before_vm_start script, but lots of problems came out. 1 - on default environmet, hook script returns of no such file or directory, because python3 does not exist on the system if i install python3, vdsm stops working if change interpreter in the script, vdms retuns rc=0 error code hook=114 and it does not appear on the vm custom properties So, could you help me to run this hook properly we've tested https://github.com/oVirt/vdsm/tree/master/vdsm_hooks/spiceoptions Master and 4.3 branch returns same error code and nothing appeared on the "custom properties" is there anyone who is use it successfully 2 - for this experince is GPU neccessery (not vGPU) , our server has standard 8mb onboard gpu thanks

3 7

Correct workflow for modifying engine vm.conf file
by Gianluca Cecchi 21 Apr '20

21 Apr '20

Hello, I would like to know a way to interact and modify in a "supported"/working way the vm.conf file on shared storage that contains details for the engine vm and I think is the base to dynamically generate the /var/run/ovirt-hosted-engine-ha/vm.conf In the past it was possible to temporarily modify the file under /var/run (or copy to another location) and start engine with it, but now it seems it doesn't work and that the file is continuously updated/refreshed Eg on engine storage domain on a lab with oVirt 4.4. beta4 I have the tar file [root@novirt2 ~]# tar tvf /rhev/data-center/mnt/glusterSD/novirt2st.storage.local\:_engine/7c9397f5-859b-4fba-bcc5-4ecbd454a189/images/530490b0-935e-46a8-84f6-6cd6618c6f0d/2e0f414c-2589-4545-a0a4-3bfed24ef3fc -rw-r--r-- root/root 181 2020-04-19 15:04 broker.conf -rw-r--r-- root/root 2777 2020-04-19 15:04 fhanswers.conf -rw-r--r-- root/root 1076 2020-04-19 15:04 hosted-engine.conf -rw-r--r-- root/root 6 2020-04-19 15:04 version -rw-r--r-- root/root 1359 2020-04-19 15:04 vm.conf [root@novirt2 ~]# And its vm.conf has: cpuType=Cascadelake-Server,+md-clear,+mds-no,-hle,-rtm,+tsx-ctrl,+arch-capabilities I would like to modify it and remove the "+tsx-ctrl" flag. Is there anything in the database that generates modification in the file on shared storage and then on the directory under /var/run? Or how is all the workflow managed to generate at the end the xml file to use to start the engine vm? What is that initially determines how to populate the cpuType in vm.conf at all? Thanks, Gianluca

2 7

New VM disk - failed to create, state locked in UI, nothing in DB
by Strahil Nikolov 20 Apr '20

20 Apr '20

Hello All, did anyone observe the following behaviour: 1. Create a new disk from the VM -> disks UI tab 2. Disk creation failes , but stays in locked state 3. Gluster storage has no directory with that uuid 4. /usr/share/ovirt-engine/setup/dbutils/unlock_entity.sh doesn't find anything: [root@engine ~]# /usr/share/ovirt-engine/setup/dbutils/unlock_entity.sh -q -t all Locked VMs Locked templates Locked disks Locked snapshots Illegal images Should I just delete the entry from the DB or I have another option ? Best Regards, Strahil Nikolov

2 3

ovirt 4.4 beta4 HCI single host problem unknown CPU feature: tsx-ctrl
by Gianluca Cecchi 20 Apr '20

20 Apr '20

Hello, I'm trying what in subject as a nested environment. Physical is oVirt 4.3.9 I configured the VM that has to be the hypervisor with cpu passthrough. The local VM starts ok with these settings: usr/libexec/qemu-kvm -name guest=HostedEngineLocal,debug-threads=on -S -object secret,id=masterKey0,format=raw,file=/var/lib/libvirt/qemu/domain-1-HostedEngineLocal/master-key.aes -machine pc-q35-rhel8.1.0,accel=kvm,usb=off,dump-guest-core=off -cpu Cascadelake-Server,ss=on,hypervisor=on,tsc-adjust=on,umip=on,pku=on,md-clear=on,stibp=on,arch-capabilities=on,ibpb=on,rdctl-no=on,ibrs-all=on,skip-l1dfl-vmentry=on,mds-no=on,kvmclock=on When at final stage of deployment it tries to start the final engine VM it goes down due to this in vdsm.log: 2020-04-19 15:09:48,962+0200 ERROR (vm/22082519) [virt.vm] (vmId='22082519-70bb-476f-a373-45c2d402a870') The vm start process failed (vm:871) Traceback (most recent call last): File "/usr/lib/python3.6/site-packages/vdsm/virt/vm.py", line 801, in _startUnderlyingVm self._run() File "/usr/lib/python3.6/site-packages/vdsm/virt/vm.py", line 2608, in _run dom.createWithFlags(flags) File "/usr/lib/python3.6/site-packages/vdsm/common/libvirtconnection.py", line 131, in wrapper ret = f(*args, **kwargs) File "/usr/lib/python3.6/site-packages/vdsm/common/function.py", line 94, in wrapper return func(inst, *args, **kwargs) File "/usr/lib64/python3.6/site-packages/libvirt.py", line 1166, in createWithFlags if ret == -1: raise libvirtError ('virDomainCreateWithFlags() failed', dom=self) libvirt.libvirtError: unsupported configuration: unknown CPU feature: tsx-ctrl 2020-04-19 15:09:48,962+0200 INFO (vm/22082519) [virt.vm] (vmId='22082519-70bb-476f-a373-45c2d402a870') Changed state to Down: unsupported configuration: unknown CPU feature: tsx-ctrl (code=1) (vm:1629) 2020-04-19 15:09:48,965+0200 INFO (vm/22082519) [virt.vm] (vmId='22082519-70bb-476f-a373-45c2d402a870') Stopping connection (guestagent:441) The xml it tries to activate is: <cpu match="exact"> <model>Cascadelake-Server</model> <feature name="md-clear" policy="require"/> <feature name="mds-no" policy="require"/> <feature name="hle" policy="disable"/> <feature name="rtm" policy="disable"/> <feature name="tsx-ctrl" policy="require"/> <feature name="arch-capabilities" policy="require"/> <topology cores="2" sockets="16" threads="1"/> <numa> <cell cpus="0-31" id="0" memory="16777216"/> </numa> </cpu> <os> <type arch="x86_64" machine="pc-q35-rhel8.1.0">hvm</type> <smbios mode="sysinfo"/> <bios useserial="yes"/> </os> Similar nested env with 4.3.9 on the same physical hw completed ok and the final engine VM had only: -machine pc-i440fx-rhel7.6.0,accel=kvm,usb=off,dump-guest-core=off \ -cpu Skylake-Server,spec-ctrl=on,ssbd=on,md-clear=on \ The physical cpu is: Model name: Intel(R) Xeon(R) Platinum 8260L CPU @ 2.40GHz and between its flags I don't find tsx-ctrl: Flags: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc aperfmperf eagerfpu pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid dca sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch epb cat_l3 cdp_l3 invpcid_single intel_pt ssbd mba ibrs ibpb stibp ibrs_enhanced tpr_shadow vnmi flexpriority ept vpid fsgsbase tsc_adjust bmi1 hle avx2 smep bmi2 erms invpcid rtm cqm mpx rdt_a avx512f avx512dq rdseed adx smap clflushopt clwb avx512cd avx512bw avx512vl xsaveopt xsavec xgetbv1 cqm_llc cqm_occup_llc cqm_mbm_total cqm_mbm_local dtherm ida arat pln pts hwp hwp_act_window hwp_epp hwp_pkg_req pku ospke avx512_vnni md_clear spec_ctrl intel_stibp flush_l1d arch_capabilities any help on how to proceed and test? Thanks, Gianluca

2 2

Enabling VT-d causes hard lockup
by Shareef Jalloq 20 Apr '20

20 Apr '20

Hi, I've been trying to get an old machine setup for PCIe passthrough but am seeing kernel hangs when booting into oVirt. This is a Supermicro X10DAi with dual E5-2695 V4's I think. I had VT-d enabled and added SR-IOV. Don't think there's anything else I need to enable in the BIOS is there? I just updated to the latest version for this board too. It always seems to be CPU#18 too : https://photos.app.goo.gl/HG7NcyWwfuq646HeA Shareef.

3 3

Re: vm console problem
by David David 20 Apr '20

20 Apr '20

tested on four different workstations with: fedora20, fedora31 and windows10(remote-manager last vers) вс, 29 мар. 2020 г. в 12:39, Strahil Nikolov <hunter86_bg(a)yahoo.com>: > On March 29, 2020 9:47:02 AM GMT+03:00, David David <dd432690(a)gmail.com> > wrote: > >I did as you said: > >copied from engine /etc/ovirt-engine/ca.pem onto my desktop into > >/etc/pki/ca-trust/source/anchors and then run update-ca-trust > >it didn’t help, still the same errors > > > > > >пт, 27 мар. 2020 г. в 21:56, Strahil Nikolov <hunter86_bg(a)yahoo.com>: > > > >> On March 27, 2020 12:23:10 PM GMT+02:00, David David > ><dd432690(a)gmail.com> > >> wrote: > >> >here is debug from opening console.vv by remote-viewer > >> > > >> >2020-03-27 14:09 GMT+04:00, Milan Zamazal <mzamazal(a)redhat.com>: > >> >> David David <dd432690(a)gmail.com> writes: > >> >> > >> >>> yes i have > >> >>> console.vv attached > >> >> > >> >> It looks the same as mine. > >> >> > >> >> There is a difference in our logs, you have > >> >> > >> >> Possible auth 19 > >> >> > >> >> while I have > >> >> > >> >> Possible auth 2 > >> >> > >> >> So I still suspect a wrong authentication method is used, but I > >don't > >> >> have any idea why. > >> >> > >> >> Regards, > >> >> Milan > >> >> > >> >>> 2020-03-26 21:38 GMT+04:00, Milan Zamazal <mzamazal(a)redhat.com>: > >> >>>> David David <dd432690(a)gmail.com> writes: > >> >>>> > >> >>>>> copied from qemu server all certs except "cacrl" to my > >> >desktop-station > >> >>>>> into /etc/pki/ > >> >>>> > >> >>>> This is not needed, the CA certificate is included in console.vv > >> >and no > >> >>>> other certificate should be needed. > >> >>>> > >> >>>>> but remote-viewer is still didn't work > >> >>>> > >> >>>> The log looks like remote-viewer is attempting certificate > >> >>>> authentication rather than password authentication. Do you have > >> >>>> password in console.vv? It should look like: > >> >>>> > >> >>>> [virt-viewer] > >> >>>> type=vnc > >> >>>> host=192.168.122.2 > >> >>>> port=5900 > >> >>>> password=fxLazJu6BUmL > >> >>>> # Password is valid for 120 seconds. > >> >>>> ... > >> >>>> > >> >>>> Regards, > >> >>>> Milan > >> >>>> > >> >>>>> 2020-03-26 2:22 GMT+04:00, Nir Soffer <nsoffer(a)redhat.com>: > >> >>>>>> On Wed, Mar 25, 2020 at 12:45 PM David David > ><dd432690(a)gmail.com> > >> >>>>>> wrote: > >> >>>>>>> > >> >>>>>>> ovirt 4.3.8.2-1.el7 > >> >>>>>>> gtk-vnc2-1.0.0-1.fc31.x86_64 > >> >>>>>>> remote-viewer version 8.0-3.fc31 > >> >>>>>>> > >> >>>>>>> can't open vm console by remote-viewer > >> >>>>>>> vm has vnc console protocol > >> >>>>>>> when click on console button to connect to a vm, the > >> >remote-viewer > >> >>>>>>> console disappear immediately > >> >>>>>>> > >> >>>>>>> remote-viewer debug in attachment > >> >>>>>> > >> >>>>>> You an issue with the certificates: > >> >>>>>> > >> >>>>>> (remote-viewer:2721): gtk-vnc-DEBUG: 11:56:25.238: > >> >>>>>> ../src/vncconnection.c Set credential 2 libvirt > >> >>>>>> (remote-viewer:2721): gtk-vnc-DEBUG: 11:56:25.239: > >> >>>>>> ../src/vncconnection.c Searching for certs in /etc/pki > >> >>>>>> (remote-viewer:2721): gtk-vnc-DEBUG: 11:56:25.239: > >> >>>>>> ../src/vncconnection.c Searching for certs in /root/.pki > >> >>>>>> (remote-viewer:2721): gtk-vnc-DEBUG: 11:56:25.239: > >> >>>>>> ../src/vncconnection.c Failed to find certificate > >CA/cacert.pem > >> >>>>>> (remote-viewer:2721): gtk-vnc-DEBUG: 11:56:25.239: > >> >>>>>> ../src/vncconnection.c No CA certificate provided, using > >GNUTLS > >> >global > >> >>>>>> trust > >> >>>>>> (remote-viewer:2721): gtk-vnc-DEBUG: 11:56:25.239: > >> >>>>>> ../src/vncconnection.c Failed to find certificate CA/cacrl.pem > >> >>>>>> (remote-viewer:2721): gtk-vnc-DEBUG: 11:56:25.239: > >> >>>>>> ../src/vncconnection.c Failed to find certificate > >> >>>>>> libvirt/private/clientkey.pem > >> >>>>>> (remote-viewer:2721): gtk-vnc-DEBUG: 11:56:25.239: > >> >>>>>> ../src/vncconnection.c Failed to find certificate > >> >>>>>> libvirt/clientcert.pem > >> >>>>>> (remote-viewer:2721): gtk-vnc-DEBUG: 11:56:25.239: > >> >>>>>> ../src/vncconnection.c Waiting for missing credentials > >> >>>>>> (remote-viewer:2721): gtk-vnc-DEBUG: 11:56:25.239: > >> >>>>>> ../src/vncconnection.c Got all credentials > >> >>>>>> (remote-viewer:2721): gtk-vnc-DEBUG: 11:56:25.239: > >> >>>>>> ../src/vncconnection.c No CA certificate provided; trying the > >> >system > >> >>>>>> trust store instead > >> >>>>>> (remote-viewer:2721): gtk-vnc-DEBUG: 11:56:25.240: > >> >>>>>> ../src/vncconnection.c Using the system trust store and CRL > >> >>>>>> (remote-viewer:2721): gtk-vnc-DEBUG: 11:56:25.240: > >> >>>>>> ../src/vncconnection.c No client cert or key provided > >> >>>>>> (remote-viewer:2721): gtk-vnc-DEBUG: 11:56:25.240: > >> >>>>>> ../src/vncconnection.c No CA revocation list provided > >> >>>>>> (remote-viewer:2721): gtk-vnc-DEBUG: 11:56:25.241: > >> >>>>>> ../src/vncconnection.c Handshake was blocking > >> >>>>>> (remote-viewer:2721): gtk-vnc-DEBUG: 11:56:25.243: > >> >>>>>> ../src/vncconnection.c Handshake was blocking > >> >>>>>> (remote-viewer:2721): gtk-vnc-DEBUG: 11:56:25.251: > >> >>>>>> ../src/vncconnection.c Handshake was blocking > >> >>>>>> (remote-viewer:2721): gtk-vnc-DEBUG: 11:56:25.298: > >> >>>>>> ../src/vncconnection.c Handshake done > >> >>>>>> (remote-viewer:2721): gtk-vnc-DEBUG: 11:56:25.298: > >> >>>>>> ../src/vncconnection.c Validating > >> >>>>>> (remote-viewer:2721): gtk-vnc-DEBUG: 11:56:25.301: > >> >>>>>> ../src/vncconnection.c Error: The certificate is not trusted > >> >>>>>> > >> >>>>>> Adding people that may know more about this. > >> >>>>>> > >> >>>>>> Nir > >> >>>>>> > >> >>>>>> > >> >>>> > >> >>>> > >> >> > >> >> > >> > >> Hello, > >> > >> You can try to take the engine's CA (maybe it's useless) and put it > >on > >> your system in: > >> /etc/pki/ca-trust/source/anchors (if it's EL7 or a Fedora) and then > >run > >> update-ca-trust > >> > >> Best Regards, > >> Strahil Nikolov > >> > > Hey David, > > What is you workstation's OS ? > Also, have you tried from another workstation ? > > Best Regards, > Strahil Nikolov >

3 7

Re: command line vm start/stop
by Ali Gusainov 20 Apr '20

20 Apr '20

According to https://access.redhat.com/documentation/en-us/red_hat_virtualization/4.3/ht… trying to use curl --insecure -v -u admin@internal:password -H Content-type: application/xml -X POST https://FQDN/ovirt-engine/api/vms/VM_NAME/ACTION where ACTION start or stop Got following: * About to connect() to FQDN port 443 (#0) * Trying SERVER_IP... * Connected to FQDN (SERVER_IP) port 443 (#0) * Initializing NSS with certpath: sql:/etc/pki/nssdb * CAfile: /etc/pki/ovirt-engine/ca.pem CApath: none * SSL connection using TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 * Server certificate: * subject: CN=FQDN........ * start date: Jan 22 06:12:15 2020 GMT * expire date: Dec 27 06:12:15 2024 GMT * common name: FQDN * issuer: CN=FQDN......... * Server auth using Basic with user 'admin@internal' > POST /ovirt-engine/api/vms/VM_NAME/ACTION HTTP/1.1 > Authorization: Basic YWRtaW5AaW50ZXJuYWw6U3lzVGVhbTEzYw== > User-Agent: curl/7.29.0 > Host: FQDN > Accept: application/xml > < HTTP/1.1 404 Not Found < Date: Sun, 19 Apr 2020 00:20:04 GMT < Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips < Content-Length: 0 < Correlation-Id: 15e7a226-8982-47ff-9f68-7a2519705856 < * Connection #0 to host FQDN left intact -------------- tail -1000f /var/log/ovirt-engine/server.log: 2020-04-18 20:20:04,354-04 ERROR [org.jboss.resteasy.resteasy_jaxrs.i18n] (default task-385) RESTEASY002010: Failed to execute: javax.ws.rs.WebApplicationException: HTTP 404 Not Found at org.ovirt.engine.api.restapi.resource.AbstractBackendResource.asGuidOr404(AbstractBackendResource.java:355) [restapi-jaxrs.jar:] at org.ovirt.engine.api.restapi.resource.AbstractBackendSubResource.<init>(AbstractBackendSubResource.java:26) [restapi-jaxrs.jar:] at org.ovirt.engine.api.restapi.resource.AbstractBackendActionableResource.<init>(AbstractBackendActionableResource.java:39) [restapi-jaxrs.jar:] at org.ovirt.engine.api.restapi.resource.BackendVmResource.<init>(BackendVmResource.java:114) [restapi-jaxrs.jar:] at org.ovirt.engine.api.restapi.resource.BackendVmsResource.getVmResource(BackendVmsResource.java:164) [restapi-jaxrs.jar:] at sun.reflect.GeneratedMethodAccessor1357.invoke(Unknown Source) [:1.8.0_232] at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) [rt.jar:1.8.0_232] at java.lang.reflect.Method.invoke(Method.java:498) [rt.jar:1.8.0_232] at org.jboss.resteasy.core.ResourceLocatorInvoker.createResource(ResourceLocatorInvoker.java:69) [resteasy-jaxrs-3.7.0.Final.jar:3.7.0.Final] at org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:105) [resteasy-jaxrs-3.7.0.Final.jar:3.7.0.Final] at org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:132) [resteasy-jaxrs-3.7.0.Final.jar:3.7.0.Final] at org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:100) [resteasy-jaxrs-3.7.0.Final.jar:3.7.0.Final] at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:440) [resteasy-jaxrs-3.7.0.Final.jar:3.7.0.Final] at org.jboss.resteasy.core.SynchronousDispatcher.lambda$invoke$4(SynchronousDispatcher.java:229) [resteasy-jaxrs-3.7.0.Final.jar:3.7.0.Final] at org.jboss.resteasy.core.SynchronousDispatcher.lambda$preprocess$0(SynchronousDispatcher.java:135) [resteasy-jaxrs-3.7.0.Final.jar:3.7.0.Final] at org.jboss.resteasy.core.interception.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:355) [resteasy-jaxrs-3.7.0.Final.jar:3.7.0.Final] at org.jboss.resteasy.core.SynchronousDispatcher.preprocess(SynchronousDispatcher.java:138) [resteasy-jaxrs-3.7.0.Final.jar:3.7.0.Final] at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:215) [resteasy-jaxrs-3.7.0.Final.jar:3.7.0.Final] at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:227) [resteasy-jaxrs-3.7.0.Final.jar:3.7.0.Final] at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56) [resteasy-jaxrs-3.7.0.Final.jar:3.7.0.Final] at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51) [resteasy-jaxrs-3.7.0.Final.jar:3.7.0.Final] at javax.servlet.http.HttpServlet.service(HttpServlet.java:791) [jboss-servlet-api_4.0_spec-1.0.0.Final.jar:1.0.0.Final] at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:74) [undertow-servlet-2.0.21.Final.jar:2.0.21.Final] at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:81) [undertow-servlet-2.0.21.Final.jar:2.0.21.Final] at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62) [undertow-servlet-2.0.21.Final.jar:2.0.21.Final] at io.undertow.servlet.handlers.ServletChain$1.handleRequest(ServletChain.java:68) [undertow-servlet-2.0.21.Final.jar:2.0.21.Final] at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36) [undertow-servlet-2.0.21.Final.jar:2.0.21.Final] at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) [undertow-core-2.0.21.Final.jar:2.0.21.Final] at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) [undertow-core-2.0.21.Final.jar:2.0.21.Final] at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) [undertow-core-2.0.21.Final.jar:2.0.21.Final] at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:274) [undertow-servlet-2.0.21.Final.jar:2.0.21.Final] at io.undertow.servlet.handlers.ServletInitialHandler.dispatchToPath(ServletInitialHandler.java:209) [undertow-servlet-2.0.21.Final.jar:2.0.21.Final] at io.undertow.servlet.spec.RequestDispatcherImpl.forwardImpl(RequestDispatcherImpl.java:227) [undertow-servlet-2.0.21.Final.jar:2.0.21.Final] at io.undertow.servlet.spec.RequestDispatcherImpl.forwardImplSetup(RequestDispatcherImpl.java:149) [undertow-servlet-2.0.21.Final.jar:2.0.21.Final] at io.undertow.servlet.spec.RequestDispatcherImpl.forward(RequestDispatcherImpl.java:111) [undertow-servlet-2.0.21.Final.jar:2.0.21.Final] at org.ovirt.engine.api.restapi.invocation.VersionFilter.doFilter(VersionFilter.java:178) [restapi-jaxrs.jar:] at org.ovirt.engine.api.restapi.invocation.VersionFilter.doFilter(VersionFilter.java:98) [restapi-jaxrs.jar:] at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61) [undertow-servlet-2.0.21.Final.jar:2.0.21.Final] at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) [undertow-servlet-2.0.21.Final.jar:2.0.21.Final] at org.ovirt.engine.api.restapi.invocation.CurrentFilter.doFilter(CurrentFilter.java:117) [restapi-jaxrs.jar:] at org.ovirt.engine.api.restapi.invocation.CurrentFilter.doFilter(CurrentFilter.java:72) [restapi-jaxrs.jar:] at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61) [undertow-servlet-2.0.21.Final.jar:2.0.21.Final] at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) [undertow-servlet-2.0.21.Final.jar:2.0.21.Final] at org.ovirt.engine.core.aaa.filters.RestApiSessionMgmtFilter.doFilter(RestApiSessionMgmtFilter.java:78) [aaa.jar:] at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61) [undertow-servlet-2.0.21.Final.jar:2.0.21.Final] at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) [undertow-servlet-2.0.21.Final.jar:2.0.21.Final] at org.ovirt.engine.core.aaa.filters.EnforceAuthFilter.doFilter(EnforceAuthFilter.java:42) [aaa.jar:] at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61) [undertow-servlet-2.0.21.Final.jar:2.0.21.Final] at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) [undertow-servlet-2.0.21.Final.jar:2.0.21.Final] at org.ovirt.engine.core.aaa.filters.SsoRestApiNegotiationFilter.doFilter(SsoRestApiNegotiationFilter.java:84) [aaa.jar:] at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61) [undertow-servlet-2.0.21.Final.jar:2.0.21.Final] at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) [undertow-servlet-2.0.21.Final.jar:2.0.21.Final] at org.ovirt.engine.core.aaa.filters.SsoRestApiAuthFilter.doFilter(SsoRestApiAuthFilter.java:47) [aaa.jar:] at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61) [undertow-servlet-2.0.21.Final.jar:2.0.21.Final] at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) [undertow-servlet-2.0.21.Final.jar:2.0.21.Final] at org.ovirt.engine.core.aaa.filters.SessionValidationFilter.doFilter(SessionValidationFilter.java:59) [aaa.jar:] at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61) [undertow-servlet-2.0.21.Final.jar:2.0.21.Final] at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) [undertow-servlet-2.0.21.Final.jar:2.0.21.Final] at org.ovirt.engine.core.aaa.filters.RestApiSessionValidationFilter.doFilter(RestApiSessionValidationFilter.java:35) [aaa.jar:] at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61) [undertow-servlet-2.0.21.Final.jar:2.0.21.Final] at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) [undertow-servlet-2.0.21.Final.jar:2.0.21.Final] at org.ovirt.engine.api.restapi.security.CSRFProtectionFilter.doFilter(CSRFProtectionFilter.java:111) [restapi-jaxrs.jar:] at org.ovirt.engine.api.restapi.security.CSRFProtectionFilter.doFilter(CSRFProtectionFilter.java:102) [restapi-jaxrs.jar:] at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61) [undertow-servlet-2.0.21.Final.jar:2.0.21.Final] at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) [undertow-servlet-2.0.21.Final.jar:2.0.21.Final] at org.ovirt.engine.core.utils.servlet.CORSSupportFilter.doFilter(CORSSupportFilter.java:283) [utils.jar:] at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61) [undertow-servlet-2.0.21.Final.jar:2.0.21.Final] at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) [undertow-servlet-2.0.21.Final.jar:2.0.21.Final] at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84) [undertow-servlet-2.0.21.Final.jar:2.0.21.Final] at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62) [undertow-servlet-2.0.21.Final.jar:2.0.21.Final] at io.undertow.servlet.handlers.ServletChain$1.handleRequest(ServletChain.java:68) [undertow-servlet-2.0.21.Final.jar:2.0.21.Final] at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36) [undertow-servlet-2.0.21.Final.jar:2.0.21.Final] at org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) [undertow-core-2.0.21.Final.jar:2.0.21.Final] at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:132) [undertow-servlet-2.0.21.Final.jar:2.0.21.Final] at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57) [undertow-servlet-2.0.21.Final.jar:2.0.21.Final] at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) [undertow-core-2.0.21.Final.jar:2.0.21.Final] at io.undertow.security.handlers.AuthenticationConstraintHandler.handleRequest(AuthenticationConstraintHandler.java:53) [undertow-core-2.0.21.Final.jar:2.0.21.Final] at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46) [undertow-core-2.0.21.Final.jar:2.0.21.Final] at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64) [undertow-servlet-2.0.21.Final.jar:2.0.21.Final] at io.undertow.servlet.handlers.security.ServletSecurityConstraintHandler.handleRequest(ServletSecurityConstraintHandler.java:59) [undertow-servlet-2.0.21.Final.jar:2.0.21.Final] at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60) [undertow-core-2.0.21.Final.jar:2.0.21.Final] at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77) [undertow-servlet-2.0.21.Final.jar:2.0.21.Final] at io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50) [undertow-core-2.0.21.Final.jar:2.0.21.Final] at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43) [undertow-core-2.0.21.Final.jar:2.0.21.Final] at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) [undertow-core-2.0.21.Final.jar:2.0.21.Final] at org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) [undertow-core-2.0.21.Final.jar:2.0.21.Final] at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) [undertow-core-2.0.21.Final.jar:2.0.21.Final] at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:292) [undertow-servlet-2.0.21.Final.jar:2.0.21.Final] at io.undertow.servlet.handlers.ServletInitialHandler.access$100(ServletInitialHandler.java:81) [undertow-servlet-2.0.21.Final.jar:2.0.21.Final] at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:138) [undertow-servlet-2.0.21.Final.jar:2.0.21.Final] at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:135) [undertow-servlet-2.0.21.Final.jar:2.0.21.Final] at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48) [undertow-servlet-2.0.21.Final.jar:2.0.21.Final] at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43) [undertow-servlet-2.0.21.Final.jar:2.0.21.Final] at org.wildfly.extension.undertow.security.SecurityContextThreadSetupAction.lambda$create$0(SecurityContextThreadSetupAction.java:105) at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502) at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502) at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502) at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:272) [undertow-servlet-2.0.21.Final.jar:2.0.21.Final] at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81) [undertow-servlet-2.0.21.Final.jar:2.0.21.Final] at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:104) [undertow-servlet-2.0.21.Final.jar:2.0.21.Final] at io.undertow.server.Connectors.executeRootHandler(Connectors.java:364) [undertow-core-2.0.21.Final.jar:2.0.21.Final] at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:830) [undertow-core-2.0.21.Final.jar:2.0.21.Final] at org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35) at org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1982) at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1486) at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1377) at java.lang.Thread.run(Thread.java:748) [rt.jar:1.8.0_232]

2 1

oVirt 4.3.7 + Gluster 6.6 unsynced entries
by adrianquintero＠gmail.com 19 Apr '20

19 Apr '20

Hello, I am having the following issue, it has been a few days and healing never finishes, any ideas on how to fix the unsynced entries? [root@host1 vmstore]# gluster vol heal vmstore info --------------------------------------------------- Brick host1:/gluster_bricks/vmstore/vmstore <gfid:5aeb168c-b8e3-4581-97f9-eafc33f2f318> <gfid:9a7483d9-0d68-4fcd-89b7-d281f6132506> <gfid:a3830550-5158-4cf9-af15-19faf5e51db0> Status: Connected Number of entries: 3 Brick host2:/gluster_bricks/vmstore/vmstore /.shard/9dbd7ab9-3d1c-4eed-908e-852eec1ce3b1.1240 /.shard/9dbd7ab9-3d1c-4eed-908e-852eec1ce3b1.1241 /.shard/9dbd7ab9-3d1c-4eed-908e-852eec1ce3b1.1242 Status: Connected Number of entries: 3 host3:/gluster_bricks/vmstore/vmstore Status: Connected Number of entries: 0 --------------------------------------------------- Thanks, Adrian

3 9

Re: disk snapshot in illegal status
by David David 19 Apr '20

19 Apr '20

snapshots in UI: Disk Snapshot ID ===================================================== 5a58466b-1547-4346-a550-8590880b379e - "Active VM" - has status "OK" f447cd4f-9ab3-489d-8c2a-b2e69456496f - "Auto-generated" - has status "Illegal" ====================================================== the "Disk Snapshot ID" with id 5a58466b-1547-4346-a550-8590880b379e actually not present in LV error screenshot attached чт, 16 апр. 2020 г. в 18:20, Shani Leviim <sleviim(a)redhat.com>: > Hi David, > Can you share a screenshot of the error you're getting? > And how the snapshots are presented on the ui? > > > *Regards,* > > *Shani Leviim* > > > On Thu, Apr 16, 2020 at 4:38 PM David David <dd432690(a)gmail.com> wrote: > >> hi >> >> attempt to remove snapshot from UI results in an error >> >> I looked the LV through the lvs and did't find active snapshot ID, only >> the base snapshot ID is present >> >> ovirt in database see 2 snapshots, but i have only one base image on >> storage >> >> so, i must remove the active snapshot ID from db not the base image Id ? >> >> чт, 16 апр. 2020 г. в 13:58, Shani Leviim <sleviim(a)redhat.com>: >> >>> Hi David, >>> Sorry for the late reply. >>> the volume_dump returned 1 occurrence of that image, while the query >>> returned 2 occurrences. >>> >>> It seems that there's an image id with a description of 'Auto-generated >>> for Live Storage Migration' which wasn't removed from the DB. >>> Can you try to remove it from the UI? >>> (If you claimed to remove it, try to remove it from the DB). >>> >>> >>> *Regards,* >>> >>> *Shani Leviim* >>> >>> >>> On Tue, Apr 7, 2020 at 7:45 PM David David <dd432690(a)gmail.com> wrote: >>> >>>> vdsm-tool dump-volume-chains d17aa967-f7f7-4d9f-98e4-7022854da4f5 >>>> >>>> engine=# select * from images_storage_domain_view where >>>> image_group_id='1844873e-45ef-4a2b-a991-2df6e92a3e2d'; >>>> >>>> output attached >>>> >>>> вт, 7 апр. 2020 г. в 19:47, Shani Leviim <sleviim(a)redhat.com>: >>>> >>>>> Hi David, >>>>> First, we need to compare the chain as it is seen by the engine and >>>>> the host and see if there's a difference. >>>>> Can you please share the output of the following? >>>>> >>>>> On the host: >>>>> vdsm-tool dump-volume-chains <sd_id> >>>>> >>>>> On the engine: >>>>> SELECT * >>>>> FROM images_storage_domain_view images_storage_domain_view >>>>> WHERE image_group_id = <image_group_id>; >>>>> >>>>> >>>>> *Regards,* >>>>> >>>>> *Shani Leviim* >>>>> >>>>> >>>>> On Tue, Apr 7, 2020 at 5:28 PM David David <dd432690(a)gmail.com> wrote: >>>>> >>>>>> hello >>>>>> >>>>>> after removing "auto generated" snapshot, the vm snapshot became to >>>>>> illegal status and in the "snapshot" tab also marked in illegal status >>>>>> >>>>>> now my vm is not booting >>>>>> >>>>>> but "vdsm-client Volume getInfo" shows the snapshot status is legal >>>>>> >>>>>> vdsm-client Volume getInfo \ >>>>>> storagepoolID=00000000-0000-0000-0000-000000000000 \ >>>>>> storagedomainID=d17aa967-f7f7-4d9f-98e4-7022854da4f5 \ >>>>>> imageID=1844873e-45ef-4a2b-a991-2df6e92a3e2d \ >>>>>> volumeID=f447cd4f-9ab3-489d-8c2a-b2e69456496f >>>>>> >>>>>> { >>>>>> "status": "OK", >>>>>> "lease": { >>>>>> "path": "/dev/d17aa967-f7f7-4d9f-98e4-7022854da4f5/leases", >>>>>> "owners": [], >>>>>> "version": null, >>>>>> "offset": 132120576 >>>>>> }, >>>>>> "domain": "d17aa967-f7f7-4d9f-98e4-7022854da4f5", >>>>>> "capacity": "21474836480", >>>>>> "voltype": "LEAF", >>>>>> "description": "None", >>>>>> "parent": "00000000-0000-0000-0000-000000000000", >>>>>> "format": "RAW", >>>>>> "generation": 1, >>>>>> "image": "1844873e-45ef-4a2b-a991-2df6e92a3e2d", >>>>>> "uuid": "f447cd4f-9ab3-489d-8c2a-b2e69456496f", >>>>>> "disktype": "DATA", >>>>>> "legality": "LEGAL", >>>>>> "mtime": "0", >>>>>> "apparentsize": "21474836480", >>>>>> "truesize": "21474836480", >>>>>> "type": "PREALLOCATED", >>>>>> "children": [], >>>>>> "pool": "", >>>>>> "ctime": "1530472945" >>>>>> } >>>>>> >>>>>> how to fix the problem? >>>>>> _______________________________________________ >>>>>> Users mailing list -- users(a)ovirt.org >>>>>> To unsubscribe send an email to users-leave(a)ovirt.org >>>>>> Privacy Statement: https://www.ovirt.org/privacy-policy.html >>>>>> oVirt Code of Conduct: >>>>>> https://www.ovirt.org/community/about/community-guidelines/ >>>>>> List Archives: >>>>>> https://lists.ovirt.org/archives/list/users@ovirt.org/message/JSYMY4QG2HSPV… >>>>>> >>>>>

2 1

Re: VM's in status unknown
by Arik Hadas 19 Apr '20

19 Apr '20

I would start by querying the database with: select vm_name, status, run_on_vds from vms where vm_name in ('<name of vm1>', '<name of vm2>'); Their status should be '7' in that case. The more interesting part though is their 'run_on_vds' field - If it's non-empty and points to the host the VMs ran on, it probably means there's an issue in the communication between the engine and that host, so restarting the engine/vdsm can solve it. Otherwise, it would require a deeper look at the log to see why the engine lost track of the host they run on. On Fri, Apr 17, 2020 at 12:12 PM Staniforth, Paul < P.Staniforth(a)leedsbeckett.ac.uk> wrote: > I don't think the status is reported via the agent but vdsm on the host. > > Try restarting the engine service. > > use vdsm-client on the host to see if the VM running and shut it down if > needed. > > https://www.ovirt.org/develop/developer-guide/vdsm/vdsm-client.html > > on the host restart vdsmd ( you may want to migrate other VMs first) > > systemctl restart vdsmd > > If this doesn't work alter the database > > Regards, > Paul S. > > ------------------------------ > *From:* Jayme <jaymef(a)gmail.com> > *Sent:* 16 April 2020 19:07 > *To:* eevans(a)digitaldatatechs.com <eevans(a)digitaldatatechs.com> > *Cc:* kim.kargaard(a)noroff.no <kim.kargaard(a)noroff.no>; users < > users(a)ovirt.org> > *Subject:* [ovirt-users] Re: VM's in status unknown > > > *Caution External Mail:* Do not click any links or open any attachments > unless you trust the sender and know that the content is safe. > Do you have the guest agent installed on the VMs? > > On Thu, Apr 16, 2020 at 2:55 PM <eevans(a)digitaldatatechs.com> wrote: > > Are you getting any errors in the engine log or > /var/log/libvirt/qemu/<vm_name>.log? > I have Windows 10 and haven't experienced that. You can't shut it down in > the UI? Even after you try to shut it down inside Windows? > I will assume you have the latest guest tools installed. > > Eric Evans > Digital Data Services LLC. > 304.660.9080 > > > -----Original Message----- > From: kim.kargaard(a)noroff.no <kim.kargaard(a)noroff.no> > Sent: Thursday, April 16, 2020 8:23 AM > To: users(a)ovirt.org > Subject: [ovirt-users] VM's in status unknown > > Hi, > > We have a few Windows 10 VM's running on our ovirt 4.3, where when you > shutdown the VM from within Windows, that VM does not shut down but gets a > status of unknown in ovirt and one cannot do anything to the machines > within the web gui. This seems to specfically be related to that Windows 10 > template that we have created. Any ideas? Also, any ideas on how one can > shut these machines down? > > Thanks > > Kim > _______________________________________________ > Users mailing list -- users(a)ovirt.org > To unsubscribe send an email to users-leave(a)ovirt.org Privacy Statement: > https://www.ovirt.org/privacy-policy.html > <https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ovirt…> > oVirt Code of Conduct: > https://www.ovirt.org/community/about/community-guidelines/ > <https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ovirt…> > List Archives: > https://lists.ovirt.org/archives/list/users@ovirt.org/message/UM26TABUTG373… > <https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.ovi…> > _______________________________________________ > Users mailing list -- users(a)ovirt.org > To unsubscribe send an email to users-leave(a)ovirt.org > Privacy Statement: https://www.ovirt.org/privacy-policy.html > <https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ovirt…> > oVirt Code of Conduct: > https://www.ovirt.org/community/about/community-guidelines/ > <https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ovirt…> > List Archives: > https://lists.ovirt.org/archives/list/users@ovirt.org/message/M4LITHLIZXJDT… > <https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.ovi…> > > To view the terms under which this email is distributed, please go to:- > http://leedsbeckett.ac.uk/disclaimer/email/ > > _______________________________________________ > Users mailing list -- users(a)ovirt.org > To unsubscribe send an email to users-leave(a)ovirt.org > Privacy Statement: https://www.ovirt.org/privacy-policy.html > oVirt Code of Conduct: > https://www.ovirt.org/community/about/community-guidelines/ > List Archives: > https://lists.ovirt.org/archives/list/users@ovirt.org/message/E73FVYRYWVNAW… >

1 0