On Wednesday, April 20, 2016 08:39:14 AM Robert Story wrote:
Yesterday I had to re-install a host node in my 3.5.6 cluster. After
a fresh
install of CentOS 7.2, attempts to re-install failed, as did removing and
re-adding the node. Here is a log excerpt from the engine:
2016-04-19 18:22:01,100 INFO
[org.ovirt.vdsm.jsonrpc.client.reactors.ReactorClient] (SSL Stomp Reactor)
Connecting to eclipse.localdomain/10.71.10.249 2016-04-19 18:22:01,116 WARN
[org.ovirt.vdsm.jsonrpc.client.utils.retry.Retryable] (SSL Stomp Reactor)
Retry failed 2016-04-19 18:22:01,129 ERROR
[org.ovirt.vdsm.jsonrpc.client.reactors.ReactorClient]
(DefaultQuartzScheduler_Worker-38) Exception during connection 2016-04-19
18:22:01,208 ERROR
[org.ovirt.engine.core.vdsbroker.vdsbroker.GetCapabilitiesVDSCommand]
(DefaultQuartzScheduler_Worker-38) Command
GetCapabilitiesVDSCommand(HostName = eclipse, HostId =
37a4a1c2-4906-489e-947c-1ef9fb828bc5,
vds=Host[eclipse,37a4a1c2-4906-489e-947c-1ef9fb828bc5]) execution failed.
Exception: VDSNetworkException: java.net.NoRouteToHostException: No route
to host 2016-04-19 18:22:01,209 WARN
[org.ovirt.engine.core.vdsbroker.VdsManager]
(DefaultQuartzScheduler_Worker-38) Host eclipse is not responding. It will
stay in Connecting state for a grace period of 120 seconds and after that
an attempt to fence the host will be issued. 2016-04-19 18:22:01,938 ERROR
[org.ovirt.engine.core.vdsbroker.VdsUpdateRunTimeInfo]
(DefaultQuartzScheduler_Worker-38) Failure to refresh Vds runtime info:
org.ovirt.engine.core.vdsbroker.vdsbroker.VDSNetworkException:
java.net.NoRouteToHostException: No route to host at
org.ovirt.engine.core.vdsbroker.vdsbroker.VdsBrokerCommand.createNetworkExc
eption(VdsBrokerCommand.java:126) [vdsbroker.jar:]
Luckily seeing SSL+java in the log tickled my memory about java disabling
SSLv3, and google helped me find this workaround:
- edit /usr/lib/jvm/java/jre/lib/security/java.security
- look for jdk.tls.disabledAlgorithms
- remove SSLv3 from the list
- service ovirt-engine restart
Google also tells me that this should be an issue for 3.5, and there is a
vdsm setting, VdsmSSLProtocol, that can be set to use TLS, but I can't find
how to change/set it. Anyone know the secret?
Pretty much everything engine related can be configured with engine-config.
engine-config -l will give you a list of all the options. engine-config -g <key>
will get the current value, engine-config -s <key>=<value> will set it. A
quick
grep indicates that you are looking for the VdsmSSLProtocol key.
Robert