Re: [ovirt-users] ovirt 4.2 upgrade questions

(Adding Ondra for the firewalld stuff. But I think it's probably easier to debug if you open a bug and attach logs there). On Tue, Jan 9, 2018 at 2:34 PM, Peter Hudec <phudec(a)cnc.sk <mailto:phudec@cnc.sk>> wrote: If I run host reinstall with custom firewall rules in /etc/ovirt-engine/ansible/ovirt-host-deploy-post-tasks.yml the task will fails due the firewalld is not running. The reinstall task will disable firewalld and enable iptables-services. I'm little bit confused ;( --- - name: Enable additional port on firewalld   firewalld:     port: "10050/tcp"     permanent: yes     immediate: yes     state: enabled 2018-01-09 13:27:30,103 p=13550 u=ovirt |  included: /etc/ovirt-engine/ansible/ovirt-host-deploy-post-tasks.yml for dipovirt01.cnc.sk <http://dipovirt01.cnc.sk> 2018-01-09 13:27:30,134 p=13550 u=ovirt |  TASK [Enable additional port on firewalld] ************************************* 2018-01-09 13:27:32,089 p=13550 u=ovirt |  fatal: [dipovirt01.cnc.sk <http://dipovirt01.cnc.sk>]: FAILED! => {"changed": false, "module_stderr": "Shared connection to dipovirt01.cnc.sk <http://dipovirt01.cnc.sk> closed.\r\n", "module_stdout": "Traceback (most recent call last):\r\n  File \"/tmp/ansible_2Ilnjq/ansible_module_firewalld.py\", line 936, in <module>\r\n    main()\r\n  File \"/tmp/ansible_2Ilnjq/ansible_module_firewalld.py\", line 788, in main\r\n    module.fail(msg='firewall is not currently running, unable to perform immediate actions without a running firewall daemon')\r\nAttributeError: 'AnsibleModule' object has no attribute 'fail'\r\n", "msg": "MODULE FAILURE", "rc": 0} 2018-01-09 13:27:32,095 p=13550 u=ovirt |  PLAY RECAP ********************************************************************* After reinstalation the status of firewalld is [PROD] root(a)dipovirt01.cnc.sk <mailto:root@dipovirt01.cnc.sk>: /var/log/vdsm # systemctl status firewalld ● firewalld.service - firewalld - dynamic firewall daemon    Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled; vendor preset: enabled)    Active: inactive (dead)      Docs: man:firewalld(1) So how could I switch to firewalld? package iptables-service could not be removed due the dependencies.         Peter On 09/01/2018 09:35, Yedidyah Bar David wrote: > >     1) firewalld >     after upgrade the hot server, the i needed to stop firewalld. It seems, >     that, the rules are not generated correctly. The engine was not able to >     connect to the host. How do I could fix it? > > > Please check/share relevant files from /var/log/ovirt-engine/ansible/ > and /var/log/ovirt-engine/host-deploy/ . Or perhaps file a bug and > attach them there. -- *Peter Hudec* Infraštruktúrny architekt phudec(a)cnc.sk <mailto:phudec@cnc.sk> <mailto:phudec@cnc.sk <mailto:phudec@cnc.sk>> *CNC, a.s.* Borská 6, 841 04 Bratislava Recepcia: +421 2  35 000 100 <tel:%2B421%202%C2%A0%2035%20000%20100> Mobil:+421 905 997 203 <tel:%2B421%C2%A0905%20997%20203> *www.cnc.sk <http://www.cnc.sk>* <http:///www.cnc.sk <http://www.cnc.sk>> -- Didi