- Devel - oVirt List Archives

noVNC not working when FIPS is enabled
by Milan Zamazal 20 Sep '21

20 Sep '21

Hi, we had to disable VNC OST test some time ago because it started failing. I looked at why it fails and the reason provided by ovirt-websocket-proxy is do_vencrypt_handshake:187 Server supports the following subtypes: 263 Server does not support X509VNC. OvirtProxy only supports X509VNC This happens only when FIPS is enabled and is reproducible outside OST. The only thing that seems to have influence on whether it works or not is the value of `fips' kernel command line parameter -- when it's changed to fips=0 then noVNC console works without any other changes. So it looks like some change in QEMU. I'm not an expert in this area and don't know what those protocols are about, why the proxy supports only X509VNC and why the mismatch in expectations on both the ends happens when FIPS is enabled. Can anybody help clarify it and provide an idea how to resolve the problem? Thanks, Milan

2 4

oVirt Node - master - CentOS Stream 9 based ISO available for testing
by Sandro Bonazzola 17 Sep '21

17 Sep '21

Hi, I'm still working on it but I have a first ISO ready for giving a first run at https://resources.ovirt.org/pub/ovirt-master-snapshot-static/iso/ovirt-node… Known limitations: - No hosted engine setup available - No ansible available - No collectd support - No cinderlib support Everything else should be there but it's totally untested. Help giving it a try and providing feedback is appreciated. Thanks -- Sandro Bonazzola MANAGER, SOFTWARE ENGINEERING, EMEA R&D RHV Red Hat EMEA <https://www.redhat.com/> sbonazzo(a)redhat.com <https://www.redhat.com/> *Red Hat respects your work life balance. Therefore there is no need to answer this email out of your office hours.*

3 7

VDSM test failures on CentOS Stream 9
by Sandro Bonazzola 15 Sep '21

15 Sep '21

[2021-09-15T07:51:34.718Z] ssl_test.py .............. [100 %]/home/jenkins/workspace/vdsm_standard-check-patch/vdsm/lib/vdsm/rpc/Bridge.py: 214: SyntaxWarning: "is not" with a literal. Did you mean "!="? [2021-09-15T07:51:34.718Z] if key is not 'status']) [2021-09-15T07:51:49.765Z] [2021-09-15T07:51:49.765Z] [2021-09-15T07:51:49.765Z] =================================== FAILURES =================================== [2021-09-15T07:51:49.765Z] ______________________ TestTerminating.test_poll_failure _______________________ [2021-09-15T07:51:49.765Z] [2021-09-15T07:51:49.765Z] self = <utils_test.TestTerminating testMethod=test_poll_failure> [2021-09-15T07:51:49.765Z] [2021-09-15T07:51:49.765Z] def tearDown(self): [2021-09-15T07:51:49.765Z] if self.proc_poll() is None: [2021-09-15T07:51:49.765Z] > self.proc_kill() [2021-09-15T07:51:49.765Z] [2021-09-15T07:51:49.765Z] lib/utils_test.py:88: [2021-09-15T07:51:49.765Z] _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ [2021-09-15T07:51:49.765Z] /usr/lib64/python3.9/subprocess.py:2080: in kill [2021-09-15T07:51:49.765Z] self.send_signal(signal.SIGKILL) [2021-09-15T07:51:49.765Z] /usr/lib64/python3.9/subprocess.py:2058: in send_signal [2021-09-15T07:51:49.765Z] self.poll() [2021-09-15T07:51:49.765Z] _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ [2021-09-15T07:51:49.765Z] [2021-09-15T07:51:49.765Z] def fail(): [2021-09-15T07:51:49.765Z] > raise ExpectedFailure("Fake poll failure") [2021-09-15T07:51:49.765Z] E utils_test.ExpectedFailure: Fake poll failure [2021-09-15T07:51:49.765Z] [2021-09-15T07:51:49.765Z] lib/utils_test.py:122: ExpectedFailure [2021-09-15T07:51:49.765Z] ------------------------------ Captured log call ------------------------------- [2021-09-15T07:51:49.765Z] 03:50:38,141 DEBUG (MainThread) [common.commands] /usr/bin/taskset --cpu-list 0-1 /usr/bin/sleep 2 (cwd None) (commands:153) [2021-09-15T07:51:49.765Z] _____________ TestExecCmdAffinity.testResetAffinityWhenConfigured ______________ [2021-09-15T07:51:49.765Z] [2021-09-15T07:51:49.765Z] a = (<utils_test.TestExecCmdAffinity testMethod=testResetAffinityWhenConfigured>,) [2021-09-15T07:51:49.765Z] kw = {}, r = 13, w = 14, pid = 440223 [2021-09-15T07:51:49.765Z] e = AssertionError('Items in the first set but not the second:\n1'), _ = 440223 [2021-09-15T07:51:49.765Z] status = 256 [2021-09-15T07:51:49.765Z] [2021-09-15T07:51:49.765Z] @functools.wraps(f) [2021-09-15T07:51:49.765Z] def wrapper(*a, **kw): [2021-09-15T07:51:49.765Z] r, w = os.pipe() [2021-09-15T07:51:49.765Z] try: [2021-09-15T07:51:49.765Z] pid = os.fork() [2021-09-15T07:51:49.765Z] if pid == 0: [2021-09-15T07:51:49.765Z] try: [2021-09-15T07:51:49.765Z] f(*a, **kw) [2021-09-15T07:51:49.765Z] os._exit(0) [2021-09-15T07:51:49.765Z] except Exception as e: [2021-09-15T07:51:49.765Z] os.write(w, pickle.dumps(e)) [2021-09-15T07:51:49.765Z] os._exit(1) [2021-09-15T07:51:49.765Z] else: [2021-09-15T07:51:49.765Z] _, status = osutils.uninterruptible(os.waitpid, pid, 0) [2021-09-15T07:51:49.765Z] if status != 0: [2021-09-15T07:51:49.765Z] e = pickle.loads(os.read(r, 4006)) [2021-09-15T07:51:49.765Z] > raise e [2021-09-15T07:51:49.765Z] E AssertionError: Items in the first set but not the second: [2021-09-15T07:51:49.765Z] E 1 [2021-09-15T07:51:49.765Z] [2021-09-15T07:51:49.765Z] testlib.py:570: AssertionError [2021-09-15T07:51:49.765Z] =============================== warnings summary =============================== [2021-09-15T07:51:49.765Z] ../../../../../../usr/lib/python3.9/site-packages/nose/importer.py:12 [2021-09-15T07:51:49.765Z] /usr/lib/python3.9/site-packages/nose/importer.py:12: DeprecationWarning: the imp module is deprecated in favour of importlib; see the module's documentation for alternative uses [2021-09-15T07:51:49.765Z] from imp import find_module, load_module, acquire_lock, release_lock [2021-09-15T07:51:49.765Z] [2021-09-15T07:51:49.765Z] ../lib/vdsm/rpc/Bridge.py:214 [2021-09-15T07:51:49.765Z] /home/jenkins/workspace/vdsm_standard-check-patch/vdsm/lib/vdsm/rpc/Bridge.py: 214: SyntaxWarning: "is not" with a literal. Did you mean "!="? [2021-09-15T07:51:49.765Z] if key is not 'status']) [2021-09-15T07:51:49.765Z] [2021-09-15T07:51:49.765Z] -- Docs: https://docs.pytest.org/en/stable/warnings.html [2021-09-15T07:51:49.765Z] Any chance someone can investigate them? https://jenkins.ovirt.org/blue/organizations/jenkins/vdsm_standard-check-pa… -- Sandro Bonazzola MANAGER, SOFTWARE ENGINEERING, EMEA R&D RHV Red Hat EMEA <https://www.redhat.com/> sbonazzo(a)redhat.com <https://www.redhat.com/> *Red Hat respects your work life balance. Therefore there is no need to answer this email out of your office hours.*

3 5

ovirt-engine has been tagged (ovirt-engine-4.4.9)
by Sandro Bonazzola 15 Sep '21

15 Sep '21

ovirt-engine has been tagged (ovirt-engine-4.4.9) -- Sandro Bonazzola MANAGER, SOFTWARE ENGINEERING, EMEA R&D RHV Red Hat EMEA <https://www.redhat.com/> sbonazzo(a)redhat.com <https://www.redhat.com/> *Red Hat respects your work life balance. Therefore there is no need to answer this email out of your office hours.*

1 0

ovirt-engine-extension-aaa-ldap broken, if using CNAME for LDAP server DNS
by Erdősi Péter 15 Sep '21

15 Sep '21

Hello! We're started the upgrade one of our oVirt clusters to the recent 4.4 minor version (4.4.8.5-1.el8) and we found a bug in the recent change of the aaa-ldap plugin. This bug came along after the IPv4/IPv6 selection introduced in ovirt-engine-extension-aaa-ldap 1.4.4 We've dig down in the rabbit hole, and it looks like, our DNS solution is just not compatible with the plugin after this commit: https://github.com/oVirt/ovirt-engine-extension-aaa-ldap/commit/4c0f2e72df8… I don't know, how the industry actually use CNAME records, but we have a rule, that we use independet DNS names for services, and machines itself. This become handy, when you migrate/upgrade services, like LDAP to another machine, and I think, this should be supported. Our LDAP server service domain is actually ldap-master.niif.hu and ldap.niif.hu, but in real, there are two servers, which actually have their own FQDNs. The actual DNS structure: host -t CNAME ldap-master.niif.hu ldap-master.niif.hu is an alias for elm.niif.hu. host -t CNAME ldap.niif.hu ldap.niif.hu is an alias for holly.ldap.einfra.hu. host elm.niif.hu elm.niif.hu has address 193.225.14.175 elm.niif.hu has IPv6 address 2001:738:0:701::3 host holly.ldap.einfra.hu holly.ldap.einfra.hu has address 193.224.92.6 holly.ldap.einfra.hu has IPv6 address 2001:738:0:431::6 The commit above (as far as I understand) only tries to resolve A and AAAA records in DNS, and drop the connection if it not found. Of course, the certificate only have ldap-master and ldap.niif.hu in it, so using holly end elm does not solve the problem (also, if the service will be migrated, the service domain will be kept, but not the machine's FQDN, since we cannot afford to shut down one of our LDAP server for a migration windows. We've tried to downgrade the package to 1.4.3, which is works fine. The actual error looks like this (engine.log) 2021-09-07 15:53:09,833+02 WARN [org.ovirt.engine.extension.aaa.ldap.AuthnExtension] (default task-1) [] [ovirt-engine-extension-aaa-ldap.authn::NIIFLdap-authn] Cannot initialize LDAP framework, deferring initialization. Error: An error occurred while attempting to connect to server ldap-master.niif.hu:636: IOException(LDAPException(resultCode=91 (connect error), errorMessage='An error occurred while attempting to establish a connection to server ldap-master.niif.hu/193.225.14.175:636: UnknownHostException(ldap-master.niif.hu), ldapSDKVersion=4.0.14, revision=c0fb784eebf9d36a67c736d0428fb3577f2e25bb')) 2021-09-07 15:53:09,833+02 ERROR [org.ovirt.engine.core.sso.servlets.InteractiveAuthServlet] (default task-1) [] Internal Server Error: An error occurred while attempting to connect to server ldap-master.niif.hu:636: IOException(LDAPException(resultCode=91 (connect error), errorMessage='An error occurred while attempting to establish a connection to server ldap-master.niif.hu/193.225.14.175:636: UnknownHostException(ldap-master.niif.hu), ldapSDKVersion=4.0.14, revision=c0fb784eebf9d36a67c736d0428fb3577f2e25bb')) 2021-09-07 15:53:09,833+02 ERROR [org.ovirt.engine.core.sso.service.SsoService] (default task-1) [] An error occurred while attempting to connect to server ldap-master.niif.hu:636: IOException(LDAPException(resultCode=91 (connect error), errorMessage='An error occurred while attempting to establish a connection to server ldap-master.niif.hu/193.225.14.175:636: UnknownHostException(ldap-master.niif.hu), ldapSDKVersion=4.0.14, revision=c0fb784eebf9d36a67c736d0428fb3577f2e25bb')) 2021-09-07 15:53:09,854+02 ERROR [org.ovirt.engine.core.aaa.servlet.SsoPostLoginServlet] (default task-1) [] server_error: An error occurred while attempting to connect to server ldap-master.niif.hu:636: IOException(LDAPException(resultCode=91 (connect error), errorMessage='An error occurred while attempting to establish a connection to server ldap-master.niif.hu/193.225.14.175:636: UnknownHostException(ldap-master.niif.hu), ldapSDKVersion=4.0.14, revision=c0fb784eebf9d36a67c736d0428fb3577f2e25bb')) As we tried to run the setup tool, that is also looks broken (after that, we've copied the required files to /etc/ovirt-engine/aaa and /etc/ovirt-engine/extensions.d/ from other, working hosted engine) so we've tested the plugin itself, and the setup too, but no luck. I think, this (CNAME in DNS) should be working with the plugin. Could you please investigate this issue? (we're here to help test the repaired version/patch, if needed, but not feel the knowledge to create the patch ourself) Regards: Peter -- *Erdősi Péter * /Informatikus, IKT Fejlesztési Főosztály / *Kormányzati Informatikai Fejlesztési Ügynökség * cím: 1134 Budapest, Váci út 35. tel: +36 1 450 3080 e-mail: erdosi.peter(a)kifu.gov.hu <mailto:erdosi.peter@kifu.gov.hu> KIFÜ - www.kifu.gov.hu <http://kifu.gov.hu/kifu/>

3 3

Google OAuth enabled on jenkins.ovirt.org
by Evgheni Dereveanchin 14 Sep '21

14 Sep '21

Hi Everyone, TL;DR: From now on please use a Google account if you need to log in to jenkins.ovirt.rog Longer version: We're using Jenkins CI for oVirt and most content does not need authentication - this does not change. Some workflows such as manual job runs do need sign-in and up until now a local user database was used for that. It was inconvenient and not did not meet modern security standards. To improve the situation we're moving to Google OAuth. It works similarly to what we already have on gerrit.ovirt.org and other services. Existing user accounts were migrated so all permissions should be retained. Job results will be available without sign-in just as they did before. If you are unable to perform some actions that worked before - please let me know or log a JIRA ticket. -- Regards, Evgheni Dereveanchin

1 0

vdsm pylint runs don't report some errors
by Harel Braha 14 Sep '21

14 Sep '21

Hi, When I ran vdsm linters in my local environment, I received errors such as: ` lib/vdsm/storage/lvm.py:1837:14: E1120: No value for argument 'rc' in constructor call (no-value-for-parameter)` On inspection of the CI logs from other runs, we found an internal Pylint error[1]. It appears that this error prevents Pylint from working properly. As a result of bumping up pylint version in order to overcome this error, we got the same errors as in my local environment [2], and another error that seems to be a false positive: `lib/vdsm/storage/volumemetadata.py:101:29: E1102: validate is not callable (not-callable)` We don't have a path in the tests that would reach the code part that raises the problematic exception[3], but it seems legit. any suggestions? [1] https://jenkins.ovirt.org/blue/organizations/jenkins/vdsm_standard-check-pa… [2] https://jenkins.ovirt.org/blue/organizations/jenkins/vdsm_standard-check-pa… [3] https://jenkins.ovirt.org/job/vdsm_standard-check-patch/29565/artifact/chec… best regards, Harel

2 1

ovirt-imageio fails tests on CentOS Stream 9 / qemu-6.1.0
by Sandro Bonazzola 10 Sep '21

10 Sep '21

Hi, running ovirt-imageio check-patch on CentOS Stream 9 fails. Is anyone around from the storage team who can have a look? https://jenkins.ovirt.org/job/ovirt-imageio_standard-check-patch/3974//arti… Thanks, -- Sandro Bonazzola MANAGER, SOFTWARE ENGINEERING, EMEA R&D RHV Red Hat EMEA <https://www.redhat.com/> sbonazzo(a)redhat.com <https://www.redhat.com/> *Red Hat respects your work life balance. Therefore there is no need to answer this email out of your office hours.*

4 5

self hosted engine installation stucks in "run engine-setup with answerfile"
by parkyh0413＠gmail.com 09 Sep '21

09 Sep '21

Hi, I'm building ovirt-engine and ovirt-engine-appliance rpm on CentOS8. But when I install ovirt using "hosted-engine --deploy" command using local repository that contains the rpms, the installation always stucks in "run engine-setup with answerfile". So I checked engine-setup log in /var/log/ovirt-engine/setup of HostedEngineLocal VM, the error log is as follow. I've been trying to solve this problem for a long time, but i'm just not sure what the problem is. --- 2021-09-08 14:44:23,841+0900 DEBUG otopi.plugins.otopi.dialog.human human.queryString:159 query OVESETUP_ENGINE_DB_PASSWORD 2021-09-08 14:44:23,842+0900 DEBUG otopi.plugins.otopi.dialog.human dialog.__logString:204 DIALOG:SEND Engine database password: 2021-09-08 14:44:23,843+0900 DEBUG otopi.ovirt_engine_setup.engine_common.database database.getCredentials:1343 dbenv: {'OVESETUP_DB/host': 'localhost', 'OVESETUP_DB/port': 5432, 'OVESETUP_DB/secured': False, 'OVESETUP_DB/securedHostValidation': False, 'OVESETUP_DB/database': 'engine', 'OVESETUP_DB/user': 'engine', 'OVESETUP_DB/password': ''} 2021-09-08 14:44:23,845+0900 DEBUG otopi.ovirt_engine_setup.engine_common.database database.execute:234 Database: 'None', Statement: ' select 1 ', args: {} 2021-09-08 14:44:23,846+0900 DEBUG otopi.ovirt_engine_setup.engine_common.database database.execute:239 Creating own connection 2021-09-08 14:44:23,848+0900 DEBUG otopi.ovirt_engine_setup.engine_common.database database.tryDatabaseConnect:394 Connection failed Traceback (most recent call last): File "/usr/share/ovirt-engine/setup/ovirt_engine_setup/engine_common/database.py", line 390, in tryDatabaseConnect transaction=False, File "/usr/share/ovirt-engine/setup/ovirt_engine_setup/engine_common/database.py", line 248, in execute database=database, File "/usr/share/ovirt-engine/setup/ovirt_engine_setup/engine_common/database.py", line 181, in connect sslmode=sslmode, File "/usr/lib64/python3.6/site-packages/psycopg2/__init__.py", line 130, in connect conn = _connect(dsn, connection_factory=connection_factory, **kwasync) psycopg2.OperationalError: could not connect to server: Connection refused Is the server running on host "localhost" (::1) and accepting TCP/IP connections on port 5432? could not connect to server: Connection refused Is the server running on host "localhost" (127.0.0.1) and accepting TCP/IP connections on port 5432? 2021-09-08 14:44:23,849+0900 ERROR otopi.ovirt_engine_setup.engine_common.database database.getCredentials:1361 Cannot connect to Engine database: Cannot connect to database: could not connect to server: Connection refused Is the server running on host "localhost" (::1) and accepting TCP/IP connections on port 5432? could not connect to server: Connection refused Is the server running on host "localhost" (127.0.0.1) and accepting TCP/IP connections on port 5432? --- Regards, parkyh0413

2 1

2021-09-08 oVirt 4.4.z branching status update
by Sandro Bonazzola 08 Sep '21

08 Sep '21

Hi, an update on where we are with 4.4.z branching: Result: package: ovirt-engine-4.4.9-0.0.master.20210831071114.git33e35c629e5.el8.noarch from ovirt-4.4-tested unresolved deps: ovirt-dependencies >= 4.4.2 ovirt-engine-ui-extensions >= 1.0.4 ovirt-cockpit-sso ovirt-imageio-daemon >= 2.0.10-1 ovirt-web-ui ovirt-ansible-collection >= 1.2.0 package: ovirt-engine-backend-4.4.9-0.0.master.20210831071114.git33e35c629e5.el8.noarch from ovirt-4.4-tested unresolved deps: java-client-kubevirt >= 0.5.0 ovirt-engine-extension-aaa-jdbc >= 1.2.0 vdsm-jsonrpc-java >= 1.6.0 vdsm-jsonrpc-java < 1.7.0 package: ovirt-engine-setup-plugin-imageio-4.4.9-0.0.master.20210831071114.git33e35c629e5.el8.noarch from ovirt-4.4-tested unresolved deps: ovirt-imageio-daemon >= 2.0.10-1 package: ovirt-engine-setup-plugin-ovirt-engine-4.4.9-0.0.master.20210831071114.git33e35c629e5.el8.noarch from ovirt-4.4-tested unresolved deps: ovirt-engine-extension-aaa-jdbc >= 1.2.0 package: ovirt-host-4.4.8-1.1.20210817163956.git6573056.el8.x86_64 from ovirt-4.4-tested unresolved deps: cockpit-ovirt-dashboard package: ovirt-host-dependencies-4.4.8-1.1.20210817163956.git6573056.el8.x86_64 from ovirt-4.4-tested unresolved deps: ovirt-imageio-client package: ovirt-hosted-engine-setup-2.5.4-0.0.master.20210908141824.git9103df7.el8.noarch from ovirt-4.4-tested unresolved deps: ovirt-hosted-engine-ha >= 2.4 python3-ovirt-engine-sdk4 >= 4.3.1 ovirt-ansible-collection >= 1.5.4 package: ovirt-release-host-node-4.4.9-0.0.master.20210906100952.gitc2eb82a.el8.noarch from ovirt-4.4-tested unresolved deps: python3-ovirt-engine-sdk4 package: vdsm-4.40.90-9.git48250e672.el8.x86_64 from ovirt-4.4-tested unresolved deps: ovirt-imageio-daemon >= 2.2.0-1 ovirt-imageio-common package: vdsm-python-4.40.90-9.git48250e672.el8.noarch from ovirt-4.4-tested unresolved deps: python3-ioprocess >= 1.4.1 -- Sandro Bonazzola MANAGER, SOFTWARE ENGINEERING, EMEA R&D RHV Red Hat EMEA <https://www.redhat.com/> sbonazzo(a)redhat.com <https://www.redhat.com/> *Red Hat respects your work life balance. Therefore there is no need to answer this email out of your office hours.*

1 0