12:48 a.m.
Good evening all,
I have a three host installation with a separate dedicated bare metal
system for the engine, running Ovirt 4.5.2.4-1.el8.
This afternoon, the engine lost communication with one of the hosts. The
engine log says the certificate is expired.
The official solution appears to be to put the host into maintenance mode
then re-enroll it.
Unfortunately, because the certificate is expired, the engine cannot switch
to maintenance mode or control the VM's to shut them down.
Error while executing action: Cannot switch Host to Maintenance mode.
Host still has running VMs on it and is in Non Responsive state.
See log excerpt below
What is the correct way to update/reinstate a certificate in a running
cluster when the engine does not acknowledge the host is operational due to
an expired certificate?
Thank you.
*David Johnson*
Log excerpt:
2023-07-20 16:27:46,904-05 INFO
[org.ovirt.vdsm.jsonrpc.client.reactors.ReactorClient] (SSL Stomp Reactor)
[] Connecting to /192.168.2.18
2023-07-20 16:27:46,904-05 INFO
[org.ovirt.vdsm.jsonrpc.client.reactors.ReactorClient] (SSL Stomp Reactor)
[] *Connected to /192.168.2.18:54321 <http://192.168.2.18:54321>*
2023-07-20 16:27:46,912-05 ERROR
[org.ovirt.vdsm.jsonrpc.client.reactors.Reactor] (SSL Stomp Reactor) [] *Unable
to process messages Received fatal alert: certificate_expired*
2023-07-20 16:27:46,914-05 ERROR
[org.ovirt.engine.core.vdsbroker.monitoring.HostMonitoring]
(EE-ManagedScheduledExecutorService-engineScheduledThreadPool-Thread-52) []
Unable to RefreshCapabilities: VDSNetworkException: VDSGenericException:
VDSNetworkException: Received fatal alert: certificate_expired
2023-07-20 16:27:47,356-05 ERROR
[org.ovirt.engine.core.vdsbroker.monitoring.HostMonitoring]
(EE-ManagedScheduledExecutorService-engineScheduledThreadPool-Thread-34) []
Unable to RefreshCapabilities: ClientConnectionException: SSL session is
invalid
2023-07-20 16:27:47,356-05 WARN
[org.ovirt.engine.core.bll.lock.InMemoryLockManager]
(EE-ManagedScheduledExecutorService-engineScheduledThreadPool-Thread-34) []
Trying to release exclusive lock which does not exist, lock key:
'f69d35b2-7666-4ac6-8645-2f119cf2ce1cVDS_INIT'
2023-07-20 16:27:47,356-05 INFO
[org.ovirt.engine.core.vdsbroker.vdsbroker.GetCapabilitiesAsyncVDSCommand]
(EE-ManagedScheduledExecutorService-engineScheduledThreadPool-Thread-34) []
Command
'org.ovirt.engine.core.vdsbroker.vdsbroker.GetCapabilitiesAsyncVDSCommand'
return value
'org.ovirt.engine.core.vdsbroker.vdsbroker.VDSInfoReturn@7d03f4f0'
2023-07-20 16:27:47,356-05 INFO
[org.ovirt.engine.core.vdsbroker.vdsbroker.GetCapabilitiesAsyncVDSCommand]
(EE-ManagedScheduledExecutorService-engineScheduledThreadPool-Thread-34) []
HostName = ovirt-host-03
2023-07-20 16:27:47,356-05 ERROR
[org.ovirt.engine.core.vdsbroker.vdsbroker.GetCapabilitiesAsyncVDSCommand]
(EE-ManagedScheduledExecutorService-engineScheduledThreadPool-Thread-34) []
Command 'GetCapabilitiesAsyncVDSCommand(HostName = ovirt-host-03,
VdsIdAndVdsVDSCommandParametersBase:{hostId='f69d35b2-7666-4ac6-8645-2f119cf2ce1c',
vds='Host[ovirt-host-03,f69d35b2-7666-4ac6-8645-2f119cf2ce1c]'})' execution
failed: org.ovirt.vdsm.jsonrpc.client.ClientConnectionException: *SSL
session is invalid*