Ovirtmgmt, webinterfaces and VLANs
--=_3a566eec-e693-4569-8838-2970ac73adac Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Hi, In the way Ovirt is currently designed, is there a way to separate the following elements in different VLANs : 1) Communication betweem nodes (hypervisors) and engine (manager) 2) Access to webadmin interface 3) access to user web interface It seems that the following elements all rely on ovirtmgmt, right ? Regards, Alexis --=_3a566eec-e693-4569-8838-2970ac73adac Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable <html><body><div style=3D"font-family: arial, helvetica, sans-serif; font-s= ize: 12pt; color: #000000"><div>Hi,<br data-mce-bogus=3D"1"></div><div><br = data-mce-bogus=3D"1"></div><div><br data-mce-bogus=3D"1"></div><div>In the = way Ovirt is currently designed, is there a way to separate the following e= lements in different VLANs :<br data-mce-bogus=3D"1"></div><div><br data-mc= e-bogus=3D"1"></div><div>1) Communication betweem nodes (hypervisors) and e= ngine (manager)<br data-mce-bogus=3D"1"></div><div>2) Access to webadmin in= terface<br data-mce-bogus=3D"1"></div><div>3) access to user web interface<= br data-mce-bogus=3D"1"></div><div><br data-mce-bogus=3D"1"></div><div>It s= eems that the following elements all rely on ovirtmgmt, right ? <br data-mc= e-bogus=3D"1"></div><div><br data-mce-bogus=3D"1"></div><div><br data-mce-b= ogus=3D"1"></div><div>Regards,<br data-mce-bogus=3D"1"></div><div>Alexis<br= data-mce-bogus=3D"1"></div></div></body></html> --=_3a566eec-e693-4569-8838-2970ac73adac--
On 24 August 2017 at 15:39, Alexis HAUSER <alexis.hauser@imt-atlantique.fr> wrote:
In the way Ovirt is currently designed, is there a way to separate the following elements in different VLANs :
1) Communication betweem nodes (hypervisors) and engine (manager) 2) Access to webadmin interface 3) access to user web interface
It seems that the following elements all rely on ovirtmgmt, right ?
Only #1. #2 and #3 could be changed AFAIK, depending on where and how you run the engine (Fir e.g. if you run it on a separate host, you could attach other interfaces with other VLANs to it). -- Barak Korren RHV DevOps team , RHCE, RHCi Red Hat EMEA redhat.com | TRIED. TESTED. TRUSTED. | redhat.com/trusted
--=_96ea490d-6118-4146-9d6a-bd5f5c0a2a6b Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Using self-hosted engine. I thought about using several interfaces on the engine VM. The reason why I want to do that : I would like the users accessing the web interface not to be on the same network that ovirt is using to communicate betweem hosts and engine. But it would mean that 2 different FQDN are necessary, right ? I heard HA requires to access to the engine FQDN... Do you have any idea how to solve this situation ? Alexis On 24 August 2017 at 15:39, Alexis HAUSER <alexis.hauser@imt-atlantique.fr> wrote:
In the way Ovirt is currently designed, is there a way to separate the following elements in different VLANs :
1) Communication betweem nodes (hypervisors) and engine (manager) 2) Access to webadmin interface 3) access to user web interface
It seems that the following elements all rely on ovirtmgmt, right ?
<div><br data-mce-bogus=3D"1"></div><div><br data-mce-bogus=3D"1"></div><d= iv><br data-mce-bogus=3D"1"></div><div data-marker=3D"__QUOTED_TEXT__">On 2= 4 August 2017 at 15:39, Alexis HAUSER<br><alexis.hauser@imt-atlantique.f= r> wrote:<br>><br>> In the way Ovirt is currently designed, is the= re a way to separate the<br>> following elements in different VLANs :<br= ><br>> 1) Communication betweem nodes (hypervisors) and engine (mana= ger)<br>> 2) Access to webadmin interface<br>> 3) access to user web = interface<br>><br>> It seems that the following elements all rely on = ovirtmgmt, right ?<br><br>Only #1. #2 and #3 could be changed AFAIK, depend= ing on where and how<br>you run the engine (Fir e.g. if you run it on a sep= arate host, you<br>could attach other interfaces with other VLANs to it).<b= r><br><br>-- <br>Barak Korren<br>RHV DevOps team , RHCE, RHCi<br>Red Hat EM= EA<br>redhat.com | TRIED. TESTED. TRUSTED. | redhat.com/trusted<br></div></=
Only #1. #2 and #3 could be changed AFAIK, depending on where and how you run the engine (Fir e.g. if you run it on a separate host, you could attach other interfaces with other VLANs to it). -- Barak Korren RHV DevOps team , RHCE, RHCi Red Hat EMEA redhat.com | TRIED. TESTED. TRUSTED. | redhat.com/trusted --=_96ea490d-6118-4146-9d6a-bd5f5c0a2a6b Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable <html><body><div style=3D"font-family: arial, helvetica, sans-serif; font-s= ize: 12pt; color: #000000"><div><div>Using self-hosted engine.<br></div><di= v>I thought about using several interfaces on the engine VM.</div><div><br>= </div><div>The reason why I want to do that : I would like the users access= ing the web interface not to be on the same network that ovirt is using to = communicate betweem hosts and engine.</div><div>But it would mean that 2 di= fferent FQDN are necessary, right ? I heard HA requires to access to the en= gine FQDN...</div><div><br></div><div>Do you have any idea how to solve thi= s situation ?</div><div><br></div><div><br></div><div>Alexis</div><br></div= div></body></html> --=_96ea490d-6118-4146-9d6a-bd5f5c0a2a6b--
Barak Korren bkorren@redhat.com RHCE, RHCi, RHV-DevOps Team https://ifireball.wordpress.com/ בתאריך 25 באוג׳ 2017 01:05 PM, "Alexis HAUSER" < alexis.hauser@imt-atlantique.fr> כתב: Using self-hosted engine. I thought about using several interfaces on the engine VM. The reason why I want to do that : I would like the users accessing the web interface not to be on the same network that ovirt is using to communicate betweem hosts and engine. But it would mean that 2 different FQDN are necessary, right ? I heard HA requires to access to the engine FQDN... Do you have any idea how to solve this situation ? AFAIK the main issue would be with the SSL certificate for the UI/API. But you can add more FQDNs to it during the installation. I'm not an HA expert but I think it would probably only need acccess to the engine port that is connected to the ovirtmgmt network.
participants (2)
-
Alexis HAUSER -
Barak Korren