Bug 1525242

Summary:	[RHV] Template Seal option, chosen as part of Publish VM to a template dialog is not working.
Product:	Red Hat CloudForms Management Engine	Reporter:	Satoe Imaishi <simaishi>
Component:	Providers	Assignee:	Moti Asayag <masayag>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Ilanit Stein <istein>
Severity:	high	Docs Contact:
Priority:	high
Version:	5.9.0	CC:	cpelland, gblomqui, istein, jfrey, jhardy, jprause, masayag, mperina, obarenbo, simaishi
Target Milestone:	GA
Target Release:	5.9.0
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	rhev
Fixed In Version:	5.9.0.13	Doc Type:	Release Note
Doc Text:	Release Note contents: This feature works only with RHV 4.1.10 and higher. Doc contents: Feature: Support 'Seal template' as part of 'publish vm' flow. Reason: Allowing the user to decide if the created template should be sealed. Taken from RHV admin guide: " Specifies whether a template is sealed. 'Sealing' is an operation that erases all machine-specific configurations from a filesystem, including SSH keys, UDEV rules, MAC addresses, system ID, and hostname. This setting prevents a virtual machine based on this template from inheriting the configuration of the source virtual machine." Result: The user will be able to check or uncheck a checkbox that will instruct how the template should be created. This feature is applicable for Linux vms only.	Story Points:	---
Clone Of:	1514895	Environment:
Last Closed:	2018-03-06 15:26:21 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	RHEVM	Target Upstream Version:
Embargoed:
Bug Depends On:	1514895, 1516689, 1530223
Bug Blocks:

Comment 2 Ilanit Stein 2018-01-01 06:34:14 UTC

* On CFME-5.9.0.14,
1. On CFME Publish a RHEL VM (with /root/.ssh/known_hosts, that has content),
to a template, with choosing seal template.
2. On RHV side, create a VM from this published template:
File /root/.ssh/known_hosts exist,
with same content as in the original RHEL VM.

Moti,
Would you please check?

thanks.

Comment 3 Ilanit Stein 2018-01-01 06:39:46 UTC

Info on the seal template choice from evm.log:

[----] I, [2018-01-01T01:21:39.215372 #11892:d59134]  INFO -- : Q-task_id([miq_provision_10]) MIQ(ManageIQ::Providers::Redhat::InfraManager::Provision#log_clone_options) Prov Options:  [:seal_template][0](TrueClass) = true
[----] I, [2018-01-01T01:21:39.215498 #11892:d59134]  INFO -- : Q-task_id([miq_provision_10]) MIQ(ManageIQ::Providers::Redhat::InfraManager::Provision#log_clone_options) Prov Options:  [:seal_template][1](Fixnum) = 1

Comment 4 Moti Asayag 2018-01-01 15:34:01 UTC

(In reply to Ilanit Stein from comment #3)
> Info on the seal template choice from evm.log:
> 
> [----] I, [2018-01-01T01:21:39.215372 #11892:d59134]  INFO -- :
> Q-task_id([miq_provision_10])
> MIQ(ManageIQ::Providers::Redhat::InfraManager::Provision#log_clone_options)
> Prov Options:  [:seal_template][0](TrueClass) = true
> [----] I, [2018-01-01T01:21:39.215498 #11892:d59134]  INFO -- :
> Q-task_id([miq_provision_10])
> MIQ(ManageIQ::Providers::Redhat::InfraManager::Provision#log_clone_options)
> Prov Options:  [:seal_template][1](Fixnum) = 1

I tested it against ovirt-engine-4.2.0 and the sealed template was created successfully.

However, I tested just the creation of template via rest-client against ovirt-engine-4.1.8 and the sealing option wasn't triggered. Therefore this bug should be moved to ovirt-engine restapi or virt for further analyzing why that option isn't working anymore.

I sent via POST to the following url:
https://istein-rhv40.scl.lab.tlv.redhat.com/ovirt-engine/api/templates?seal=true

this body:
<template>
  <name>mysealedtemplate</name>
  <vm>
    <name>rhel_pass</name>
  </vm>
</template>

Comment 5 Ilanit Stein 2018-01-02 10:13:07 UTC

Filed Bug 1530223 for ovirt-engine virt.

When Bug 1530223 will be resolved, this BZ can be verified on RHV-4.1.

Comment 6 Ilanit Stein 2018-02-15 09:11:36 UTC

Moving bug to ON_DEV since it depends on RHV bug 1530223, and this cannot be verified.

Comment 8 Martin Perina 2018-02-27 08:57:02 UTC

Retargeting back to 5.9.0 as according to Ilanit this was successfully verified with RHV 4.1.10. But we should have in release notes that this RFE requires RHV 4.1.10 and higher to work properly (with RHV 4.1.9 and earlier the feature doesn't work)

John, do we need some changes in 5.9.0 errata around this bug?

Comment 9 Ilanit Stein 2018-02-27 16:22:52 UTC

Verified on CFME-5.9.0.22 (latest) / RHV-4.1.10-0.1.el7.

1. From CFME, make template from an original RHEL VM, that contain /root/.ssh/known_hosts file,
with seal template option.

2. Create a VM from this template:  /root/.ssh/known_hosts exists.