On Fri, 22 Mar 2019 14:37:49 +0100 Gianluca Cecchi <gianluca.cecchi@gmail.com> wrote:
On Fri, Mar 22, 2019 at 12:20 PM Dominik Holler <dholler@redhat.com> wrote: [snip]
Tried also this as detailed by Dominik, renewing certificates: https://www.mail-archive.com/users@ovirt.org/msg53697.html
Not understood what to do in step 2. Use the SSO_CLIENT_SECRET from the outfile produced by the previous command in /etc/ovirt-provider-ovn/conf.d/10-setup-ovirt-provider-ovn.conf "Use" in which way???
use as <my_secret_omitted> in
[OVIRT] ovirt-sso-client-secret=<my_secret_omitted>
OK. I misunderstood/misread behavior of the command /usr/share/ovirt-engine/bin/ovirt-register-sso-client-tool.sh
I thought it directly wrote /etc/ovirt-provider-ovn/conf.d/10-setup-ovirt-provider-ovn.conf Instead it writes a temporary/transient file such as /var/tmp/ovirt-engine/99_sso_client_1553259220210.conf now I put the value of this generated file "SSO_CLIENT_SECRET=" inside my 10-setup-ovirt-provider-ovn.conf and follow the other steps and I'm able to successfully test the OVN connection
It seems I have not completely understood the link between SSO and admin@internal as a user for OVN authentication....
The ovirt-sso-client-id and ovirt-sso-client-secret is required, to allow the ovirt-provider-ovn to connect to Engine's SSO for checking to user visible username, e.g. admin@internal, and password.
I guess you are already aware of the doc in https://github.com/oVirt/ovirt-provider-ovn/#section-ovirt
ovirt-provider-ovn does not store neither the user, e.g. admin@internal password nor the session token, it is just forwarded to Engine's SSO to check for validity.
If you are interested in the details, the session token is generated by _get_sso_token in
https://github.com/oVirt/ovirt-provider-ovn/blob/master/provider/auth/plugin... and validated by another method in
https://github.com/oVirt/ovirt-provider-ovn/blob/master/provider/auth/plugin... where the ovirt-sso-client-id and ovirt-sso-client-secret are used as client_id, client_secret.
In your case _get_sso_token is already failing, which does not use the ovirt-sso-client-secret.
To solve this praticular issue, the provider in oVirt web admin ui should use the usual oVirt password for admin@internal.
Thanks for all the corollary information! Now I was also able to create two ovn networks (ovn172 and ovn192) with one subnet each and on engine I have:
[root@ovmgr1 log]# ovn-nbctl show switch fc2fc4e8-ff71-4ec3-ba03-536a870cd483 (ovirt-ovn192-1e252228-ade7-47c8-acda-5209be358fcf) port 84c78095-744c-4415-805f-5f739af3d4d3 addresses: ["00:1a:4a:17:01:53 dynamic"] switch 9e77163a-c4e4-4abf-a554-0388e6b5e4ce (ovirt-ovn172-4ac7ba24-aad5-432d-b1d2-672eaeea7d63) port 899809f2-3ee8-4121-9fff-5e55bb0d5d8b addresses: ["00:1a:4a:17:01:54 dynamic"] [root@ovmgr1 log]#
I'm now able to create/attach an ovn based nic to a VM, but if I try to power on this VM I get an error in web admin gui
Failed to run VM p2vorasvi11
and in engine.log:
2019-03-22 14:30:34,498+01 ERROR [org.ovirt.engine.core.dal.dbbroker.auditloghandling.AuditLogDirector] (ForkJoinPool-1-worker-5) [] EVENT_ID: VM_DOWN_ERROR(119), VM p2vorasvi11 is down with error. Exit message: Hook Error: ('',).
If I put a standard nic the VM is able to start without problem. Full log in engine.log during startup here: https://drive.google.com/file/d/1vDY64QaRkb8LWHJ9gD16bsJlyovISNwr/view?usp=s...
Can you please share the relevant part of vdsm.log, too?
BTW: one strange thing I see in dumped xml in engine.log during startup is:
<graphics type="spice" port="-1" autoport="yes" passwd="*****" passwdValidTo="1970-01-01T00:00:01" tlsPort="-1">
Gianluca