3:06 p.m.
I have an environment where the engine wouldn’t start and the certificate expiry dates
were as follows.
Host1 - 25th Sep 2022
Host2 - 11th Aug 2022
Host3 - 11th Aug 2022
I copied the vdsm certs from Host1 to Host2 & Host3
Engine then started on Host1 and then backed up.
Engine cert expiry 11th Aug 2022
I put the cluster into Global Maintenance mode and then tried:
‘engine-setup —offline’
Which failed as the validation check said the engine wasn’t in Global Maintenance mode
even though ‘hosted-engine —vm-status said it was.
None of the Hosts are ‘GREEN’ (can’t remember what the status was as I’m writing this from
memory) but their status is ’RED’.
There are VMs running on the 3 Hosts and I’m reluctant to restart anything at the moment.
Is there a way to refresh the engine certificate to get past this or do I need to restart
vdsm service on each host to bring them back online as far as the engine is concerned?
The environment is currently at 4.4.6 and is to be upgraded to 4.5.2 next month.
Any help as always will be greatly appreciated.
Kind regards
Simon
3:24 p.m.
Hi,
I hope you have not erased old certificates which you must restore back.
You can't copy certificates from one host to another, it will not work.
Try restore old certificates and simply run again engine-setup.
On 9/6/22 23:06, simon(a)justconnect.ie wrote:
I have an environment where the engine wouldn’t start and the
certificate expiry dates were as follows.
Host1 - 25th Sep 2022
Host2 - 11th Aug 2022
Host3 - 11th Aug 2022
I copied the vdsm certs from Host1 to Host2 & Host3
Engine then started on Host1 and then backed up.
Engine cert expiry 11th Aug 2022
I put the cluster into Global Maintenance mode and then tried:
‘engine-setup —offline’
Which failed as the validation check said the engine wasn’t in Global Maintenance mode
even though ‘hosted-engine —vm-status said it was.
None of the Hosts are ‘GREEN’ (can’t remember what the status was as I’m writing this
from memory) but their status is ’RED’.
There are VMs running on the 3 Hosts and I’m reluctant to restart anything at the
moment.
Is there a way to refresh the engine certificate to get past this or do I need to restart
vdsm service on each host to bring them back online as far as the engine is concerned?
The environment is currently at 4.4.6 and is to be upgraded to 4.5.2 next month.
Any help as always will be greatly appreciated.
Kind regards
Simon
_______________________________________________
Users mailing list -- users(a)ovirt.org
To unsubscribe send an email to users-leave(a)ovirt.org
Privacy Statement: https://www.ovirt.org/privacy-policy.html
oVirt Code of Conduct: https://www.ovirt.org/community/about/community-guidelines/
List Archives:
https://lists.ovirt.org/archives/list/users@ovirt.org/message/SKGWY5ZIBAG...
3:54 p.m.
I made a backup of the /etc/pki/ directory and subfolders prior to overwriting the certs.
Copying an indate cert was the only way I couldget the engine started.
Is there a commandline procedure to do the same task as 'Enroll Certificates' via
the WebUI?
Shimme
4:36 p.m.
I tried your 'Try restore old certificates and simply run again engine-setup' but
the validation fails with:
---------------------------------------------------------------------------------------------------------------------------------------------------------
[ ERROR ] It seems that you are running your engine inside of the hosted-engine VM and are
not in "Global Maint
enance" mode.
In that case you should put the system into the "Global Maintenance"
mode before running engine-setup,
or the hosted-engine HA agent might kill the machine, which might
corrupt your data.
[ ERROR ] Failed to execute stage 'Setup validation': Hosted Engine setup
detected, but Global Maintenance is n
ot set.
---------------------------------------------------------------------------------------------------------------------------------------------------------
even though I have placed it into Global Maintenance mode.
The problem is that all 3 hosts are currently 'Non Responsive'
FYI - In another environment where the vdsm certificates had expired on one of 2 clusters,
copying the certs from a host in the other cluster allowed the hosts to become responsive
so I could 'Enroll certificates'.
Shimme
2:26 a.m.
Hi,
OK, I see you running hosted engine.
I have slightly different setup, engine runs on dedicated VM outside oVirt.
On 7 Sep 2022, at 00:36, simon(a)justconnect.ie wrote:
I tried your 'Try restore old certificates and simply run again engine-setup' but
the validation fails with:
---------------------------------------------------------------------------------------------------------------------------------------------------------
[ ERROR ] It seems that you are running your engine inside of the hosted-engine VM and
are not in "Global Maint
enance" mode.
In that case you should put the system into the "Global Maintenance"
mode before running engine-setup,
or the hosted-engine HA agent might kill the machine, which might
corrupt your data.
[ ERROR ] Failed to execute stage 'Setup validation': Hosted Engine setup
detected, but Global Maintenance is n
ot set.
---------------------------------------------------------------------------------------------------------------------------------------------------------
even though I have placed it into Global Maintenance mode.
The problem is that all 3 hosts are currently 'Non Responsive'
FYI - In another environment where the vdsm certificates had expired on one of 2
clusters, copying the certs from a host in the other cluster allowed the hosts to become
responsive so I could 'Enroll certificates'.
Shimme
_______________________________________________
Users mailing list -- users(a)ovirt.org
To unsubscribe send an email to users-leave(a)ovirt.org
Privacy Statement: https://www.ovirt.org/privacy-policy.html
oVirt Code of Conduct: https://www.ovirt.org/community/about/community-guidelines/
List Archives:
https://lists.ovirt.org/archives/list/users@ovirt.org/message/6DEEYA6DPKG...
2:33 a.m.
On Wed, Sep 7, 2022 at 12:37 AM <simon(a)justconnect.ie> wrote:
I tried your 'Try restore old certificates and simply run again engine-setup' but
the validation fails with:
---------------------------------------------------------------------------------------------------------------------------------------------------------
[ ERROR ] It seems that you are running your engine inside of the hosted-engine VM and
are not in "Global Maint
enance" mode.
In that case you should put the system into the "Global Maintenance"
mode before running engine-setup,
or the hosted-engine HA agent might kill the machine, which might
corrupt your data.
[ ERROR ] Failed to execute stage 'Setup validation': Hosted Engine setup
detected, but Global Maintenance is n
ot set.
---------------------------------------------------------------------------------------------------------------------------------------------------------
even though I have placed it into Global Maintenance mode.
The problem is that all 3 hosts are currently 'Non Responsive'
FYI - In another environment where the vdsm certificates had expired on one of 2
clusters, copying the certs from a host in the other cluster allowed the hosts to become
responsive so I could 'Enroll certificates'.
I guess that the engine failed to notice the move to global
maintenance, due to the expired certs.
If you are certain that indeed all hosts see that they are in global
maintenance - check with 'hosted-engine --vm-status' - you can update
the engine DB directly, e.g. with something like:
https://lists.ovirt.org/archives/list/users@ovirt.org/thread/7KAHVACMATMW...
/usr/share/ovirt-engine/dbscripts/engine-psql.sh -c 'update
vds_statistics set ha_global_maintenance=f'
If all you want is to enforce engine-setup to skip this check, you can
try instead:
engine-setup --otopi-environment=OVESETUP_CONFIG/continueSetupOnHEVM=bool:True
Good luck and best regards,
--
Didi
2:36 a.m.
Also:
Considering that many people now have oVirt setups that are old enough
to start having expired certs, and also the changes done in recent
years around certs longevity, it would be nice if we have a doc page
on the web site about how to handle this situation, as we see more
such cases on the list.
Any volunteers to start such a page? Or at least create a github issue
with the details you currently know? Even such an open github issue is
often easier to find and use (and link) than searching the mailing
list.
Best regards,
On Wed, Sep 7, 2022 at 10:33 AM Yedidyah Bar David <didi(a)redhat.com> wrote:
On Wed, Sep 7, 2022 at 12:37 AM <simon(a)justconnect.ie> wrote:
>
> I tried your 'Try restore old certificates and simply run again
engine-setup' but the validation fails with:
>
---------------------------------------------------------------------------------------------------------------------------------------------------------
> [ ERROR ] It seems that you are running your engine inside of the hosted-engine VM
and are not in "Global Maint
enance" mode.
> In that case you should put the system into the "Global
Maintenance" mode before running engine-setup,
or the hosted-engine HA agent might kill the
machine, which might corrupt your data.
>
> [ ERROR ] Failed to execute stage 'Setup validation': Hosted Engine setup
detected, but Global Maintenance is n
ot set.
>
---------------------------------------------------------------------------------------------------------------------------------------------------------
> even though I have placed it into Global Maintenance mode.
>
> The problem is that all 3 hosts are currently 'Non Responsive'
>
> FYI - In another environment where the vdsm certificates had expired on one of 2
clusters, copying the certs from a host in the other cluster allowed the hosts to become
responsive so I could 'Enroll certificates'.
I guess that the engine failed to notice the move to global
maintenance, due to the expired certs.
If you are certain that indeed all hosts see that they are in global
maintenance - check with 'hosted-engine --vm-status' - you can update
the engine DB directly, e.g. with something like:
https://lists.ovirt.org/archives/list/users@ovirt.org/thread/7KAHVACMATMW...
/usr/share/ovirt-engine/dbscripts/engine-psql.sh -c 'update
vds_statistics set ha_global_maintenance=f'
If all you want is to enforce engine-setup to skip this check, you can
try instead:
engine-setup --otopi-environment=OVESETUP_CONFIG/continueSetupOnHEVM=bool:True
Good luck and best regards,
--
Didi
--
Didi
3:57 a.m.
Many thanks Didi,
I presume the above command can be used with the --offline option
'engine-setup --offline
--otopi-environment=OVESETUP_CONFIG/continueSetupOnHEVM=bool:True'
Kind regards
Simon...
9:40 p.m.
Thanks Didi,
All certificates updated and oVirt environment 100% healthy.
Regards
Simon...
604
days inactive
606
days old
9 comments
3 participants
participants (3)
-
Andrei Verovski -
simon＠justconnect.ie -
Yedidyah Bar David