[ovirt-users] Re: Certificate expiration w/o warning on all clients. Cluster in zombie state
On Tue, Dec 27, 2022 at 6:18 PM Gilboa Davara <gilboad(a)gmail.com> wrote:
Hello,
On Tue, Dec 27, 2022 at 8:40 AM Yedidyah Bar David <didi(a)redhat.com> wrote:
>
> > Add issue https://github.com/oVirt/ovirt-engine/issues/784
>
> Sorry, I do not follow. Is your immediate obstacle being that
> engine-setup refuses to continue, saying "Hosted Engine HA is in
> Global Maintenance mode."?
>
> You can cause it to ignore this test by passing
> 'OVESETUP_CONFIG/continueSetupOnHEVM=bool:True' (in the answer file or
> --otopi-environment).
>
> We recently added an option 'engine-setup
> --show-environment-documentation', exactly for this env key, see also:
>
> https://bugzilla.redhat.com/show_bug.ccontinueSetupOnHEVM=bool:Truegi?id=...
>
> Best regards,
> --
> Didi
>
I actually managed to bypass the check by editing he.py and deleting the
"raise" statement, preventing hosted-engine from bombing out because it
wasn't able to connect to the nodes.
From there I managed to renew the certificates (see second mail), and even connected two
of the 3 nodes successfully (I had to create new temporary vdsm certificates, get them
semi-connected to the engine, and then "re-enroll certificates" from the UI.
Once I had a limping cluster up, I shut everything down cleanly, and... and redeployed the
cluster from scratch. (with all the failed attempts, my HE was completely busted).
That said, I wonder if having to short circuit the environment variable isn't a bit
over-complicated, given the considerable number of cert related issues.
I do not think it's "over complicated" in any technical sense - just
one command line to copy/paste from somewhere. I'd say it's mainly
that knowing that this is the solution to your exact problem is the
hard thing.
But thanks for the heads-up.
Q: I'm willing to try and document all the steps I did, in my semi-success attempt to
save my cluster.
I think that would be great.
That said, I rather not document wrong / broken steps. Can anyone @RH
review my writeup?
Sure! But consider how you intend to publish it. If as something like
a blog post (on ovirt.org or your own blog or whatever), that's less
"authoritative" and understandably more local/specific. If you
consider integrating it into the official guides, that's more
delicate.
--
Didi