On Tue, May 10, 2022 at 8:37 PM <louisb@ameritech.net> wrote:

I greatly appreciate the response, however, following you instructions I’m still not able to upload an ISO via the GUI.

When try an upload using the GUI I follow the instruction below:

• In the pane on the left hand side of the screen, I select “Storage”.

• Select “Disks”.

• Where I get the screen “Storage > Disks”.

• On the top right hand side of the screen, I select “Upload”.

• From the pull down menu I select “Start”.

• I choose the file/ISO I want to upload, in this case its “CENTOS-Stream” version 9.

• At the bottom of the screen I click the “Test Connection” button.

• The following messages appears: Connection to “ovirt-imageio-service” has failed. Ensure the “ovirt certificate” is registered as a valid CA in the browser.

• I click/select the “ovirt certificate” which is highlighted in blue on my screen.

• It displays the option to save the certificate or view it in the browser. My browser is Firefox 91.9.0.

• I save the certificate which I later import into my browser (following your instruction). The certificate is accepted by the browser with no errors encountered.

• I then restart the upload process again and “Test Connection”. The same message is displayed: Connection to “ovirt-imageio-service” has failed. Ensure the “ovirt certificate” is registered as a valid CA in the browser. The same message as earlier in the process.

Great, the issue is clear now - your browser cannot access ovirt-imageio service since the browser likey does not have the certificate, or maybe ovirt-imageio is misconfigured in some way. To make sure you imported the certificate in the browser - when you access the engine, do you get a warning about an insecure site? For example in my Firefox (100.0, Fedora 35) I see a secure connection, see screenshots. If you have the certificate, we need to understand why the browser cannot connect to imageio service. One reason is installing ovirt on a single host, and adding the *same* host to engine a hypervisor. This setup was called "all-in-one" and was deprecated few years ago and is not officially supported - but it can work if you modify engine configuration. If you have this kind of installation, you need to disable the imageio proxy in engine configuration: engine-config -s ImageTransferProxyEnabled=false And restart ovirt-engine service. Upload should work after this change. If your engine is not running on your single host, we need to understand why the imageio service does not recognize the certificate. Please share output of: ovirt-imageio --show-config ls -lh /etc/pki/ovirt-engine/apache-ca.pem Here are example values from my system - regular engine install using defaults: $ ovirt-imageio --show-config ... "control": { "port": 54324, "prefer_ipv4": true, "remove_timeout": 60, "socket": "/run/ovirt-imageio/sock", "transport": "tcp" }, ... "remote": { "host": "::", "port": 54323 }, "tls": { "ca_file": "/etc/pki/ovirt-engine/apache-ca.pem", "cert_file": "/etc/pki/ovirt-engine/certs/apache.cer", "enable": true, "enable_tls1_1": false, "key_file": "/etc/pki/ovirt-engine/keys/apache.key.nopass" } ... $ ls -lh /etc/pki/ovirt-engine/apache-ca.pem lrwxrwxrwx. 1 root root 28 Apr 18 00:21 /etc/pki/ovirt-engine/apache-ca.pem -> /etc/pki/ovirt-engine/ca.pem Nir

On Wed, May 11, 2022 at 1:29 AM <louisb@ameritech.net> wrote:

Made the suggestion that you made earlier I continued to get the same results. Sharing the files/things you requested below:

ovirt-imageio --show-config

...

"control": { "port": 54324, "prefer_ipv4": true, "remove_timeout": 60, "socket": "/run/ovirt-imageio/sock", "transport": "unix" },

So your ovirt-imageio service is configured for vdsm. This confirms that your engine host is also used a hypervisor (all-in-one deprecated configuration). ...

}, "remote": { "host": "::", "port": 54322 },

Since the ovirt-imageio service listen on port 54322, engine UI should not try to connect to the proxy (port 54323). This is done by disabling the proxy as I explained in the previous email.

"tls": { "ca_file": "/etc/pki/vdsm/certs/cacert.pem", "cert_file": "/etc/pki/vdsm/certs/vdsmcert.pem", "enable": true, "enable_tls1_1": false, "key_file": "/etc/pki/vdsm/keys/vdsmkey.pem" } }

Using vdsm pki, works for all-in-one setup. Did you run engine-config as root? Did you restart ovirt-engine after disabling the proxy? Just to be sure - do this and share the output: sudo engine-config -s ImageTransferProxyEnabled=false sudo engine-config -g ImageTransferProxyEnabled sudo systemctl restart ovirt-engine engine-config should report: ImageTransferProxyEnabled: false version: general After the engine is restarted, try the "Test connection" again from the upload UI. If it works, upload should also work. If not, we will have to dig deeper. Nir

I also started to receive the error message below after making the suggested changes: VDSM ovirtdl380gen10 command HSMGetAllTasksStatusesVDS failed: Not SPM: () On my browser it indicates that there is no tracking, verified by my domain, You have granted this website additional permission. Thanks

I started to investigate based on your question regarding a secure connection. From that investigation this what I’ve found: When viewing he certificate the AIA section shows the following: Authority Info (AIA) Location: http://ovirtdl380gen10.cscd.net:80/ovirt-engine/services/pki-resource?resource=ca-certificate&format=X509-PEM-CA Method: CA Issuers It appears that the certificate is being issue/released on port 80, could this be the reason no connection can be established with the “ovirt imageio” service; since the service is looking for a connection on a secured port such as 443? How can or what should be done to correct this. If this is the issue I suspect that I need to have a certificate that is from port 443 or some other secured connection. Thanks

On Wed, May 11, 2022 at 6:42 PM <louisb@ameritech.net> wrote:

I started to investigate based on your question regarding a secure connection. From that investigation this what I’ve found:

When viewing he certificate the AIA section shows the following:

Authority Info (AIA) Location: http://ovirtdl380gen10.cscd.net:80/ovirt-engine/services/pki-resource?resource=ca-certificate&format=X509-PEM-CA

Method: CA Issuers

It appears that the certificate is being issue/released on port 80, could this be the reason no connection can be established with the “ovirt imageio” service; since the service is looking for a connection on a secured port such as 443?

How can or what should be done to correct this. If this is the issue I suspect that I need to have a certificate that is from port 443 or some other secured connection.

So you are accessing the engine via http:? I don't think this can work for image upload. We support only https. Access engine at: https://ovirtdl380gen10.cscd.net/ You should get a secure connection - if not download the certificate and install it, and make sure the proxy is disabled, and upload should work. Trying your engine address: https://ovirtdl380gen10.cscd.net/ I get unrelated site (24th Judicial District Community ...). You may need to fix the web server setup so engine can be accessed using https. Also having engine accessible on the web is not a good idea, it is better to make it available only inside a closed network. Nir

On Wed, May 11, 2022 at 9:58 PM <louisb@ameritech.net> wrote:

I checked the network configuration on both the Client & Server I found network proxy turned off. However, during the installation of ovirt there is a question regarding proxy. The question is as follows:

Configure WebSocket Proxy on this machine? (Yes, No) [Yes]:

I took the default above could this my issue?

No, the web socket proxy is not related.

On Wed, May 11, 2022 at 6:42 PM <louisb@ameritech.net> wrote:

I started to investigate based on your question regarding a secure connection. From that investigation this what I’ve found:

When viewing he certificate the AIA section shows the following:

Authority Info (AIA) Location: http://ovirtdl380gen10.cscd.net:80/ovirt-engine/services/pki-resource?resource=ca-certificate&format=X509-PEM-CA

Which certificate? I suppose you mean the https certificate. The CA certificate should not have AIA. Are you sure you imported the CA cert to your browser correctly?

Method: CA Issuers

It appears that the certificate is being issue/released on port 80, could this be the reason no connection can be established with the “ovirt imageio” service; since the service is looking for a connection on a secured port such as 443?

It's _available_ via both 80 and 443, bug advertised on 80 - otherwise, you run into a chicken-and-egg problem: You want to securely get the CA cert, but to do that, you need the CA cert... But that's unrelated to your issue, IMO.

How can or what should be done to correct this. If this is the issue I suspect that I need to have a certificate that is from port 443 or some other secured connection.

Again: Please ignore AIA. You should _manually_ get the CA cert and import it into your browser, as Nir detailed. If you are unsure whether you got the correct cert, you can also copy it from the engine machine with ssh, from /etc/pki/ovirt-engine/ca.pem . Good luck and best regards, -- Didi

On Sat, May 14, 2022 at 12:53 AM <louisb@ameritech.net> wrote:

I’ve tried your suggestion and continue to get the same results.

It will be more helpful if you describe in detail what you tried and what the results were.

Based on continuing investigation I’ve found on the Red Hat Knowledge base a resolution to this issue, the following link references the solution: https://access.redhat.com/solutions/354255.

This URL does not exist.

However, I’ve run across another issue, since the creation of a new host within ovirt

Based on the output of "ovirt-imageio --show-config" you had an all-in-one setup, when the engine host is added to the engine as a hypervisor. This setup is not supported but works, but adding more hosts to this kind of setup will not work with image transfer, and it is a really bad idea to have multiple hosts and run engine on one of them. For example, engine can stop a host using host power management API. If this is the host running engine you don't have a way to start your engine unless you have access to the host power management console. If have more than one host, your engine should not run on any of the hosts, and you must enable the imageio proxy (this is the default): engine-config -s ImageTransferProxyEnabled=true And restart engine: systemctl restart ovirt-engine

I’ve not been able to access the internet or reach the host/server remotely. Therefore, I’m unable to try the solution provide via the Red Hat Knowledge Base.

I’ve reviewed the kernel routing table displayed below:

ip route show default via 20.10.20.1 dev eno5 proto static metric 100 default via 20.10.20.1 dev eno6 proto static metric 101 default via 20.10.20.1 dev eno7 proto static metric 102 default via 20.10.20.1 dev ovirtmgmt proto static metric 425 20.10.20.0/24 dev eno5 proto kernel scope link src 20.10.20.65 metric 100 20.10.20.0/24 dev eno6 proto kernel scope link src 20.10.20.66 metric 101 20.10.20.0/24 dev eno7 proto kernel scope link src 20.10.20.67 metric 102 20.10.20.0/24 dev ovirtmgmt proto kernel scope link src 20.10.20.68 metric 425

Is it normal behavior for the host to sever all connection when a “Host” machine is added to ovirt? Is there a solution to this issue? I’ve recognize the risks of having the host exposed to the internet, how would I keep the OS/RHEL 8.6 & ovirt current?

It is hard to tell what's going on when we don't know which hosts do you have and what is their ip address. Please confirm that you access engine using https:// and that when you access the host your browser reports a secure connection without warnings (meaning that engine CA certificate was added to the browser). Nir

Thank you very much for your response and I agree with you based on everything I've read. But below are the steps that I've followed: I greatly appreciate the response, however, following you instructions I’m still not able to upload an ISO via the GUI. When try an upload using the GUI I follow the instruction below: • In the pane on the left hand side of the screen, I select “Storage”. • Select “Disks”. • Where I get the screen “Storage > Disks”. • On the top right hand side of the screen, I select “Upload”. • From the pull down menu I select “Start”. • I choose the file/ISO I want to upload, in this case its “CENTOS-Stream” version 9. • At the bottom of the screen I click the “Test Connection” button. • The following messages appears: Connection to “ovirt-imageio-service” has failed. Ensure the “ovirt certificate” is registered as a valid CA in the browser. • I click/select the “ovirt certificate” which is highlighted in blue on my screen. • It displays the option to save the certificate or view it in the browser. My browser is Firefox 91.9.0. • I save the certificate which I later import into my browser (following your instruction). The certificate is accepted by the browser with no errors encountered. • I then restart the upload process again and “Test Connection”. The same message is displayed: Connection to “ovirt-imageio-service” has failed. Ensure the “ovirt certificate” is registered as a valid CA in the browser. The same message as earlier in the process. Is there some place other place I should be looking for more information or something else I should be doing?