[ovirt-users] Re: hosted-engine --deploy --restore-from-file fails on oVirt node 4.5.1.3

On Sun, Aug 7, 2022 at 6:34 AM P F <pat(a)patfruth.com&gt; wrote: Can you check/share all of /var/log/ovirt-engine and /var/log/httpd? I am not an expert on how this should work. Adding Martin. In any case, this sounds like a bug to me, even though not sure it's possible/easy to fix - would you like to create one? Seems so. Most likely this is a result of enabling keycloak integration. Perhaps you can try again and answer 'No' to 'Configure Keycloak integration on the engine'. If this works, it might be the simplest way for now - you can enable keycloak integration later if you want. I am just guessing here, not knowing anything about openidc. Perhaps it does not like being accessed as a different hostname and/or port. The engine does not like this either, but we "convince" it: [1] https://github.com/oVirt/ovirt-ansible-collection/blob/master/roles/hoste... - name: Allow the webadmin UI to be accessed over the first host block: - name: Saving original value ansible.builtin.replace: path: /etc/ovirt-engine/engine.conf.d/11-setup-sso.conf regexp: '^(SSO_ALTERNATE_ENGINE_FQDNS=.*)' replace: '#\1 # pre hosted-engine-setup' - name: Adding new SSO_ALTERNATE_ENGINE_FQDNS line ansible.builtin.lineinfile: path: /etc/ovirt-engine/engine.conf.d/11-setup-sso.conf line: 'SSO_ALTERNATE_ENGINE_FQDNS="{{ he_host_address }}" # hosted-engine-setup' But this isn't mandatory, it's just a convenience we added at some point. Instead, you can do something similar to what we do to allow access on port 6900: [2] https://github.com/oVirt/ovirt-ansible-collection/blob/master/roles/hoste... - name: Open a port on firewalld ansible.builtin.command: firewall-cmd --zone=public --add-port {{ he_webui_forward_port }}/tcp changed_when: true - name: Expose engine VM webui over a local port via ssh port forwarding ansible.builtin.command: >- sshpass -e ssh -tt -o ServerAliveInterval=5 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -g -L {{ he_webui_forward_port }}:{{ he_fqdn }}:443 {{ he_fqdn }} environment: "{{ he_cmd_lang | combine( { 'SSHPASS': he_appliance_password } ) }}" changed_when: true async: 86400 poll: 0 register: sshpf But instead of opening the port on firewalld from the host, do the entire tunnelling from your laptop (or where you run the web browser): 1. Add the engine VM's name to your /etc/hosts, to the line of '127.0.0.1' 2. Find the (temporary, local) IP address of the engine VM, in your case that's '192.168.222.3' 3. Create an ssh tunnel - something like: # ssh -L443:192.168.222.3:443 root(a)ovirt-node04.internal.net Then you can access the engine (and keycloak) web UI via the "real" FQDN: https://ovirt-engine.internal.net/ovirt-engine/ Good luck and best regards, -- Didi