Bug 1734839
| Summary: | Unable to start guests in our Power9 cluster without running in headless mode. | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Virtualization Manager | Reporter: | Frank DeLorey <fdelorey> | ||||
| Component: | ovirt-engine | Assignee: | Tomasz Barański <tbaransk> | ||||
| Status: | CLOSED ERRATA | QA Contact: | Beni Pelled <bpelled> | ||||
| Severity: | urgent | Docs Contact: | |||||
| Priority: | urgent | ||||||
| Version: | 4.3.0 | CC: | dfediuck, lleistne, lsurette, mavital, michal.skrivanek, mtessun, rmcswain, srevivo, tbaransk, ycui | ||||
| Target Milestone: | ovirt-4.4.0 | Keywords: | ZStream | ||||
| Target Release: | --- | Flags: | lsvaty:
testing_plan_complete-
|
||||
| Hardware: | Unspecified | ||||||
| OS: | All | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | rhv-4.4.0-29 | Doc Type: | No Doc Update | ||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | |||||||
| : | 1745491 (view as bug list) | Environment: | |||||
| Last Closed: | 2020-08-04 13:20:00 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | Virt | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Bug Depends On: | |||||||
| Bug Blocks: | 1745491 | ||||||
| Attachments: |
|
||||||
|
Description
Frank DeLorey
2019-07-31 14:57:12 UTC
Tomas, any thoughts? I doubt if this behaves differently on POWER it's probably still enabled/request in configuration to use secured VNC. But if they reinstalled hosts then it's no longer possible to run secured VNC. It needs to be disabled in webadmin as well in Cluster->Console setting The full error message is "A VM is not secure: VNC has no password and SASL authentication not configured. On hosts in FIPS mode VNC must use SASL." Toams, please improve the logging, it seems the message gets cut off when logged (In reply to Michal Skrivanek from comment #3) > Toams, please improve the logging, it seems the message gets cut off when > logged *Tomas, sorry:) - and please also check the tooltip in Enable VNC Encryption setting, seems empty to me. Yes, Michal is right, this looks like a misconfiguration.
Also, for FIPS+Encypted VNC, SASL need to be correctly configured, preferably with the provided ansible role ('ovirt-host-setup-vnc-sasl', example playbook is 'ovirt-vnc-sasl.yml'). Putting it somewhere in the documentation is not the most user-friendly way to make users aware. Should the hint about it be included in the error message, maybe?
There is also a real bug on POWER. The kernel cmdline is not editable at all beacause originally it was only for hostdev passthrough not relevant on POWER. But now the FIPS and NOSMT should be available, all the others should still be disabled.
Also the detection is probably wrong...for the disabled ones we probably should not initialize the json fields.
example:
{"current":"fips=0 nosmt","parsable":false,"blacklistNouveau":true,"iommu":true,"kvmNested":true,"unsafeInterrupts":true,"pciRealloc":true,"fips":true,"smtDisabled":true}
which shows up in UI as checked greyed out. Problem is that they are still interpreted - fips config is being sent.
actually, we will need a doc text for the actual fix of wrongly grayed out options on POWER sync2jira sync2jira The documentation text flag should only be set after 'doc text' field is provided. Please provide the documentation text and set the flag to '?' again. WARN: Bug status (ON_QA) wasn't changed but the folowing should be fixed:
[Found non-acked flags: '{}', ]
For more info please contact: rhv-devops: Bug status (ON_QA) wasn't changed but the folowing should be fixed:
[Found non-acked flags: '{}', ]
For more info please contact: rhv-devops
WARN: Bug status (ON_QA) wasn't changed but the folowing should be fixed:
[Found non-acked flags: '{}', ]
For more info please contact: rhv-devops: Bug status (ON_QA) wasn't changed but the folowing should be fixed:
[Found non-acked flags: '{}', ]
For more info please contact: rhv-devops
WARN: Bug status (ON_QA) wasn't changed but the folowing should be fixed:
[Found non-acked flags: '{}', ]
For more info please contact: rhv-devops: Bug status (ON_QA) wasn't changed but the folowing should be fixed:
[Found non-acked flags: '{}', ]
For more info please contact: rhv-devops
WARN: Bug status (ON_QA) wasn't changed but the folowing should be fixed:
[Found non-acked flags: '{}', ]
For more info please contact: rhv-devops: Bug status (ON_QA) wasn't changed but the folowing should be fixed:
[Found non-acked flags: '{}', ]
For more info please contact: rhv-devops
WARN: Bug status (ON_QA) wasn't changed but the folowing should be fixed:
[Found non-acked flags: '{}', ]
For more info please contact: rhv-devops: Bug status (ON_QA) wasn't changed but the folowing should be fixed:
[Found non-acked flags: '{}', ]
For more info please contact: rhv-devops
Verified with: - RHV 4.4.0-0.26.master.el8ev - vdsm-4.40.7-1.el8ev Verification steps: 1. Add a POWER9 host (PowerNV 9006-12P) to a PPC64 cluster - make sure the PIPS checkbox (under kernel tab) is un-checked. 2. Reboot the host and make sure PIPS is disabled Result: - The host was added successfully and PIPS remain disabled after reboot. - The checkboxes for FIPS & SMT are available. - The tooltip for VNC encryption is updated with "Enabling VNC Encryption will enforce VNC communication over TLS (using X509Vnc VeNCrypt)". Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Important: RHV Manager (ovirt-engine) 4.4 security, bug fix, and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2020:3247 |