Bug 1439240

Summary:	[downstream clone - 3.6.11] [Upgrade] Auto-Import of HostedEngine VM fails due to missing CPU Profile Permissions
Product:	Red Hat Enterprise Virtualization Manager	Reporter:	rhev-integ
Component:	ovirt-engine	Assignee:	Andrej Krejcir <akrejcir>
Status:	CLOSED ERRATA	QA Contact:	Nikolai Sednev <nsednev>
Severity:	medium	Docs Contact:
Priority:	high
Version:	3.6.10	CC:	eheftman, lsurette, mavital, rbalakri, Rhev-m-bugs, srevivo, ykaul, ylavi
Target Milestone:	ovirt-3.6.11	Keywords:	Triaged, ZStream
Target Release:	---
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:	Previously, while importing a self-hosted engine virtual machine (VM), the permissions for using the CPU profile were checked, even when this was not required. As a result, if the CPU profile in the cluster did not have permissions for 'Everyone', the import would fail. In this update, the permissions are only checked when necessary and the self-hosted engine VM can be imported regardless of the CPU profile permissions.	Story Points:	---
Clone Of:	1435088	Environment:
Last Closed:	2017-05-09 17:04:20 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	SLA	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1435088
Bug Blocks:

Description rhev-integ 2017-04-05 13:34:32 UTC

+++ This bug is a downstream clone. The original bug is: +++
+++   bug 1435088 +++
======================================================================

Description of problem:

Initially I saw this on one of out test labs and thought it was just us messing around with every single option available. But now I saw it again.

CanDoAction of ImportVm during the Auto-Import of HE VM ends up calling assignFirstCpuProfile(). And in case the the Cluster the HE VM is being imported to is missing the permissions for CpuProfileOperator, the canDo validation fails and the HostedEngine VM is not imported with ACTION_TYPE_CPU_PROFILE_EMPTY. 

See:

2017-03-21 14:41:20,149 WARN  [org.ovirt.engine.core.bll.ImportVmCommand] (org.ovirt.thread.pool-6-thread-19) [] CanDoAction of action 'ImportVm' failed for user SYSTEM. Reasons: VAR__ACTION__IMPORT,VAR__TYPE__VM,ACTION_TYPE_CPU_PROFILE_EMPTY

2017-03-21 14:41:20,149 ERROR [org.ovirt.engine.core.bll.HostedEngineImporter] (org.ovirt.thread.pool-6-thread-19) [] Failed importing the Hosted Engine VM

And it keeps looping like this forever.

In both occurrences I saw the Cluster the HE VM is being imported to is not the Default one and is missing the CpuProfileOperator permission role, so HE Auto-Import fails.

Common Ground:
- Both were upgraded from 3.5
- Both have custom (user created) Clusters in which the HE runs (not Default name)
- Cluster already existed in 3.5

From what I can see CpuProfileOperator was introduced in 3.6.

Case 1 (ticket):
* 3.5 to 3.6 Upgrade
* Cluster the HE VM supposed to be imported already existed pre upgrade to 3.6

Case 2 (labs):
* 4.0 Standalone to 4.0 SHE Migration
* this has been upgraded all the way from early RHV 3.x
* Cluster HE VM was supposed to be imported to was definitely created pre-3.6

Version-Release number of selected component (if applicable):
rhevm-3.6.10.2-0.2.el6.noarch

How reproducible:
Not sure

More information:
* Shouldn't the HE VM Auto-Import process ensure the CpuProfile roles are in the cluster it's trying to import the VM to?
* Shouldn't these permissions be added to all clusters that are upgraded to 3.6? I can only see it added to the 'Default' cluster, not the user created cluster that runs HE.

(Originally by Germano Veit Michel)

Comment 5 rhev-integ 2017-04-07 14:10:05 UTC

INFO: Bug status wasn't changed from MODIFIED to ON_QA due to the following reason:

[TAG 'ovirt-engine-3.6.11' DOESN'T CONTAIN PATCH 'https://gerrit.ovirt.org/75142']
gitweb: https://gerrit.ovirt.org/gitweb?p=ovirt-engine.git;a=shortlog;h=refs/tags/ovirt-engine-3.6.11

For more info please contact: rhv-devops

Comment 7 Nikolai Sednev 2017-04-13 16:47:15 UTC

Works for me on these components on hosts:
rhevm-sdk-python-3.6.9.1-1.el7ev.noarch
vdsm-4.17.39-1.el7ev.noarch
sanlock-3.4.0-1.el7.x86_64
qemu-kvm-rhev-2.6.0-28.el7_3.9.x86_64
ovirt-hosted-engine-ha-1.3.5.10-1.el7ev.noarch
ovirt-vmconsole-host-1.0.4-1.el7ev.noarch
ovirt-host-deploy-1.4.1-1.el7ev.noarch
libvirt-client-2.0.0-10.el7_3.5.x86_64
ovirt-vmconsole-1.0.4-1.el7ev.noarch
mom-0.5.6-1.el7ev.noarch
ovirt-hosted-engine-setup-1.3.7.4-1.el7ev.noarch
ovirt-setup-lib-1.0.1-1.el7ev.noarch
Linux version 3.10.0-327.53.1.el7.x86_64 (mockbuild.eng.bos.redhat.com) (gcc version 4.8.5 20150623 (Red Hat 4.8.5-4) (GCC) ) #1 SMP Tue Mar 14 10:49:09 EDT 2017
Linux  3.10.0-327.53.1.el7.x86_64 #1 SMP Tue Mar 14 10:49:09 EDT 2017 x86_64 x86_64 x86_64 GNU/Linux
Red Hat Enterprise Linux Server release 7.3 (Maipo)

On engine:

rhevm-setup-plugin-vmconsole-proxy-helper-3.6.11-0.2.el6.noarch
rhevm-sdk-python-3.6.9.1-1.el6ev.noarch
rhevm-spice-client-x86-cab-3.6-7.el6.noarch
rhevm-backend-3.6.11-0.2.el6.noarch
rhevm-setup-base-3.6.11-0.2.el6.noarch
rhevm-setup-plugin-websocket-proxy-3.6.11-0.2.el6.noarch
rhevm-doc-3.6.10-1.el6ev.noarch
rhevm-tools-backup-3.6.11-0.2.el6.noarch
rhevm-webadmin-portal-3.6.11-0.2.el6.noarch
ovirt-setup-lib-1.0.1-1.el6ev.noarch
rhevm-setup-3.6.11-0.2.el6.noarch
rhevm-cli-3.6.9.0-1.el6ev.noarch
rhevm-branding-rhev-3.6.0-10.el6ev.noarch
ovirt-vmconsole-proxy-1.0.4-1.el6ev.noarch
rhevm-spice-client-x64-msi-3.6-7.el6.noarch
rhevm-dwh-3.6.8-1.el6ev.noarch
ovirt-engine-extension-aaa-jdbc-1.0.7-2.el6ev.noarch
rhevm-setup-plugin-ovirt-engine-3.6.11-0.2.el6.noarch
rhevm-reports-setup-3.6.5.1-1.el6ev.noarch
rhevm-iso-uploader-3.6.0-1.el6ev.noarch
rhevm-dependencies-3.6.1-1.el6ev.noarch
ovirt-host-deploy-java-1.4.1-1.el6ev.noarch
rhevm-vmconsole-proxy-helper-3.6.11-0.2.el6.noarch
rhevm-spice-client-x86-msi-3.6-7.el6.noarch
rhevm-userportal-3.6.11-0.2.el6.noarch
rhevm-3.6.11-0.2.el6.noarch
rhevm-lib-3.6.11-0.2.el6.noarch
rhevm-dwh-setup-3.6.8-1.el6ev.noarch
rhevm-log-collector-3.6.1-1.el6ev.noarch
rhevm-websocket-proxy-3.6.11-0.2.el6.noarch
rhevm-extensions-api-impl-3.6.11-0.2.el6.noarch
rhevm-dbscripts-3.6.11-0.2.el6.noarch
rhevm-guest-agent-common-1.0.11-6.el6ev.noarch
rhevm-setup-plugins-3.6.5-1.el6ev.noarch
rhevm-image-uploader-3.6.1-2.el6ev.noarch
ovirt-vmconsole-1.0.4-1.el6ev.noarch
rhevm-spice-client-x64-cab-3.6-7.el6.noarch
rhevm-reports-3.6.5.1-1.el6ev.noarch
rhev-guest-tools-iso-3.6-6.el6ev.noarch
rhevm-setup-plugin-ovirt-engine-common-3.6.11-0.2.el6.noarch
ovirt-host-deploy-1.4.1-1.el6ev.noarch
rhevm-tools-3.6.11-0.2.el6.noarch
rhevm-restapi-3.6.11-0.2.el6.noarch
Linux version 2.6.32-573.41.1.el6.x86_64 (mockbuild.eng.bos.redhat.com) (gcc version 4.4.7 20120313 (Red Hat 4.4.7-16) (GCC) ) #1 SMP Thu Mar 2 11:08:17 EST 2017
Linux 2.6.32-573.41.1.el6.x86_64 #1 SMP Thu Mar 2 11:08:17 EST 2017 x86_64 x86_64 x86_64 GNU/Linux
Red Hat Enterprise Linux Server release 6.8 (Santiago)

Upgraded 3.5->3.6 without reproducing this issue, hence moving to verified.

Comment 9 errata-xmlrpc 2017-05-09 17:04:20 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2017:1210