July 2018 - Users - oVirt List Archives

User permission. All user can access (start, shutdown) all vm in User/VM portal
by florentl 10 Jul '18

10 Jul '18

Hello, There is something I don't understand in permissions. I'm using Ovirt 4.2.3.5-1. I created a user : - ovirt-aaa-jdbc-tool user add etudiant2 --attribute=firstName=Etudiant2 --attribute=lastName=Etudiant2-Lastname - ovirt-aaa-jdbc-tool user password-reset etudiant2 --password-valid-to="2025-01-01 10:30:00Z" On the Administration Portal I gave him (etudiant2) the permission UserVmManager on only one VM and nothing else. But when he logs in the VM Portal he can view, start, stop all the VM. I think it's because all users are member of the group Everyone and this group has by default the UserRole. And in my config (the default/install config) the UserRole can do Basic Operation an VM. Moreover the UserRole is given to the group Everyone on all VM I created, and I can't remove this permission (Remove button is greyed). How can I make a VM "private", only visible by one user ? Thanks in advance, Florent

3 5

OVN ACLs
by Niyazi Elvan 10 Jul '18

10 Jul '18

Hi All, I have started testing oVirt 4.2 and focused on OVN recently. I was wondering whether there is a plan to manage L2->L7 ACLs through oVirt web ui. If not, how could it be possible to manage ACLs except command line tools ? Using opendaylight ?? All the best ! Niyazi -- Niyazi Elvan

3 3

Device Mapper Timeout when using Gluster Snapshots
by hsahmed＠gmail.com 09 Jul '18

09 Jul '18

I am facing this trouble since version 4.1 up to the latest 4.2.4, once we enable gluster snapshots and accumulate some snapshots (as few as 15 snapshots per server) we start having trouble booting the server. The server enters emergency shell upon boot after timing out waiting for snapshot devices. Waiting a few minutes and pressing Control-D then boots the server normally. In case of very large number of snapshots (600+) it can take days before the sever will boot. Attaching journal log, let me know if you need any other logs. Details of the setup: 3 node hyperconverged oVirt setup (64GB RAM, 8-Core E5 Xeon) oVirt 4.2.4 oVirt Node 4.2.4 10Gb Interface Thanks, Hesham S. Ahmed

4 7

hyperconverged cluster - how to change the mount path?
by Liebe, André-Sebastian 09 Jul '18

09 Jul '18

Hi list, I'm looking for an advice how to change the mount point of the hosted_storage due to a hostname change. When I set up our hyperconverged lab cluster (host1, host2, host3) I populated the mount path with host3:/hosted_storage which wasn't very clever as it brings in a single point of failure (i.e. when host3 is down). So I thought adding a round robin dns/hosts entry (i.e. gluster1) for host 1 to 3 and changing the mount path would be a better idea. But the mount path entry is locked in web gui and I couldn't find any hint how to change it manually (in database, shared and local configuration) in a consistent way without risking the cluster. So, is there a step by step guide how to achieve this without reinstalling (from backup)? Sincerely André-Sebastian Liebe Technik / Innovation gematik Gesellschaft für Telematikanwendungen der Gesundheitskarte mbH Friedrichstraße 136 10117 Berlin Telefon: +49 30 40041-197 Telefax: +49 30 40041-111 E-Mail: andre.liebe(a)gematik.de www.gematik.de ___________________________________________ Amtsgericht Berlin-Charlottenburg HRB 96351 B Geschäftsführer: Alexander Beyer

6 10

Advice on deploying oVirt hyperconverged environment Node based
by Tal Bar-Or 09 Jul '18

09 Jul '18

Hello All, I am about deploying a new Ovirt system for our developers that we plan to be hyperconverged environment Node based. The system workload would be mostly used for builders that compiling our code , which involves with lots of small files and intensive IO. I plan to build two glustered volume "layers" one based on sas drives for OS spin on, and second for Nvme based for intensive IO. I would expect that the system will be resilient/high availability and in the same time give enough good IO request for vm builders that will be at least 6 to 8 vm guests. The system hardware would be as follows: *chassis*: 4x HP DL380 gen8 *each server hardware:* *cpu*: 2x e5-2690v2 *memory*:256GB *Disks*:12x 1.2TB sas 10k disks , 2 mirror for os (or using usk kingstone 2x 128gb mirror) rest for vm os volume. *Nvme*: 2x960GB Kingstone KC1000 for builders compiling source code *Network: *4 ports Intel 10Gbit/s SFP + Given above configuration and theory, my question would be what would be best practice in terms of Gluster configuration *Distributed,Replicated,Distributed Replicated,Dispersed,Distributed Dispersed*? What is the suggestion for hardware raid type 5 or 6 , or use ZFS? Network nodes communication , i intend to use 3 ports for storage communication and one port for guests network , my question regarding Gluster inter communication , what is better would i gail from 3x 10G LACP or 1 network for each gluster volume? Please advice Thanks -- Tal Bar-or

3 3

Changing resolution of console on Mint guest running on Ovirt 4.2
by pascal＠butterflyit.com 09 Jul '18

09 Jul '18

I keep getting an error: Could not set configuration for CRTC 63. I checked that I have spice-agent and spice-agentd running. Also qemu-guest-agent. lspci shows that I have a QXL adapter. xrandr -q shows that I have many different config available. but none work. What am I missing? Screen 0: minimum 320 x 200, current 1024 x 768, maximum 8192 x 8192 Virtual-0 connected primary 1024x768+0+0 0mm x 0mm 1024x768 59.95*+ 1920x1200 59.95 1920x1080 60.00 1600x1200 59.95 1680x1050 60.00 1400x1050 60.00 1280x1024 59.95 1440x900 59.99 1280x960 59.99 1280x854 59.95 1280x800 59.96 1280x720 59.97 1152x768 59.95 800x600 59.96 848x480 59.94 720x480 59.94 640x480 59.94 Virtual-1 disconnected V

2 1

change from LDAP to AD authentication
by p.staniforth＠leedsbeckett.ac.uk 09 Jul '18

09 Jul '18

Hello, as part of our policy I have to change from LDAP to Active Directory for authentication in our oVirt system. I have managed to configure a test system that allows users to login using the CN (sAMAccountName) as before. The users in the system using the AD namespace are using their UPN for their user name. Do we have to copy permissions from all the old accounts to their new accounts or is there a way to rename them to the UPN retaining there old permissions? Thanks, Paul S.

3 2

Cannot import a qcow2 image
by etienne.charlier＠reduspaceservices.eu 09 Jul '18

09 Jul '18

Hello, I' m trying without success to import a qcow2 file into ovirt. I tried on a ISCSI datadomain and an nfs datadomain. I struggled quite a lot to have the "test connection" succed ( I write a small shell script to "deploy" letsencryt certificates into ovirt engine) Doc is not clear on the fact that certificates for imageio-proxy are different than for main engine… Now, the upload fails with Transfer was stopped by system. Reason: failed to add image ticket to ovirt-imageio-proxy. Image gets stuck in "transfer paused by system" Any idea ? ovrit is up to date: 4.2.4 on both engine and hosts.

4 11

OVN and MTU of vnics based on it clarification
by Gianluca Cecchi 09 Jul '18

09 Jul '18

Hello, I'm testing a virtual rhcs cluster based on 4 nodes that are CentOS 7.4 VMs. So the stack is based on Corosync/Pacemaker I have two oVirt hosts and so my plan is to put two VMs on first host and two VMs on the second host, to simulate a two sites config and site loss, before going to physical production config. Incidentally the two hypervisor hosts are indeed placed into different physical datacenters. So far so good. I decided to use OVN for the intracluster dedicated network configured for corosync (each VM has two vnics, one on production lan and one for intracluster). I detected that the cluster worked and formed (also only two nodes) only if the VMs run on the same host, while it seems they are not able to communicate when on different hosts. Ping is ok and an attempt of ssh session between them on intracluster lan, but cluster doesn't come up So after digging in past mailing list mails I found this recent one: https://lists.ovirt.org/archives/list/users@ovirt.org/thread/RMS7XFOZ67O3ER… where the solution was to set 1400 for the MTU of the interfaces on OVN network. It seems it resolves the problem also in my scenario: - I live migrated two VMs on the second host and rhcs clusterware didn't complain - I relocated a resource group composed by several LV/FS, VIP and application from VM running on host1 to VM running on host2 without problems. So the question is: can anyone confirm what are guidelines for settings vnics on OVN? Is there already a document in place about MTU settings for OVN based vnics? Other particular settings or limitations if I want to configure a vnic on OVN? Thanks, Gianluca

2 1

fence_rhevm and ovirt 4.2
by Gianluca Cecchi 08 Jul '18

08 Jul '18

Hello, I'm configuring a virtual rhcs cluster and would like to use fence_rhevm agent for stonith. As VMs composing the 4-nodes cluster I'm using CentOS 7.4 os with fence-agents-rhevm-4.0.11-66.el7_4.4.x86_64; I see that in 7.5 the agent is fence-agents-rhevm-4.0.11-86.el7_5.2.x86_64 but with no modification for the /usr/sbin/fence_rhevm python script apart the BUILD_DATE line. Some questions: - it seems it is still in API v3 even if deprecated; any particular reason? Possible to update to V4? Can I create a RFE bugzilla? This is in fact what I get in engine events registering connection: Client from address "10.4.4.68" is using version 3 of the API, which has been deprecated since version 4.0 of the engine, and will no longer be supported starting with version 4.3. Make sure to update that client to use a supported versions of the API and the SDKs, before upgrading to version 4.3 of the engine. 7/7/184:56:11 PM User fenceuser@internal-authz connecting from '10.4.4.68' using session 'OVgdzMofRFDS4ZKSdL83mRyGUFEdc+++onJHzGiAfpYuS07xa/EbBqFEPtztpwEeRzCn9mBOTGXE69rBbHlhXQ==' logged in. 7/7/184:56:11 PM - UserRole ok Back in April 2017 for version 4.1.1 I had problems and it seems I had to set super user privileges for the "fencing user" See thread here https://lists.ovirt.org/archives/list/users@ovirt.org/message/FS5YFU5ZXIYDC… Now instead I only set UserRole for the defined "fenceuser" on the virtual cluster VMS and it works ok - for a VM with permissions already setup: [root@cl1 ~]# fence_rhevm -a 10.4.192.49 -l "fenceuser@internal" -S /usr/local/bin/pwd_ovmgr01.sh -z --ssl-insecure -o status --shell-timeout=20 --power-wait=10 -n cl1 Status: ON - for a VM still without permissions [root@cl1 ~]# fence_rhevm -a 10.4.192.49 -l "fenceuser@internal" -S /usr/local/bin/pwd_ovmgr01.sh -z --ssl-insecure -o status --shell-timeout=20 --power-wait=10 -n cl2 Failed: Unable to obtain correct plug status or plug is not available - for a VM with permissions already setup: I'm able to make power off / power on of the VM Thanks, Gianluca

2 2