Bug 1745491
| Summary: | [downstream clone - 4.3.6] Unable to start guests in our Power9 cluster without running in headless mode. | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Virtualization Manager | Reporter: | RHV bug bot <rhv-bugzilla-bot> |
| Component: | ovirt-engine | Assignee: | Tomasz Barański <tbaransk> |
| Status: | CLOSED ERRATA | QA Contact: | Nisim Simsolo <nsimsolo> |
| Severity: | urgent | Docs Contact: | |
| Priority: | urgent | ||
| Version: | 4.3.0 | CC: | dfediuck, lleistne, lsurette, lsvaty, mavital, michal.skrivanek, mtessun, nsimsolo, rbarry, Rhev-m-bugs, rmcswain, srevivo, tbaransk, ycui |
| Target Milestone: | ovirt-4.3.6 | Keywords: | ZStream |
| Target Release: | 4.3.6 | ||
| Hardware: | Unspecified | ||
| OS: | All | ||
| Whiteboard: | |||
| Fixed In Version: | ovirt-engine-4.3.6.6 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | 1734839 | Environment: | |
| Last Closed: | 2019-10-10 15:36:58 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | Virt | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1734839 | ||
| Bug Blocks: | |||
|
Description
RHV bug bot
2019-08-26 08:53:08 UTC
Tomas, any thoughts? I doubt if this behaves differently on POWER (Originally by Ryan Barry) it's probably still enabled/request in configuration to use secured VNC. But if they reinstalled hosts then it's no longer possible to run secured VNC. It needs to be disabled in webadmin as well in Cluster->Console setting The full error message is "A VM is not secure: VNC has no password and SASL authentication not configured. On hosts in FIPS mode VNC must use SASL." Toams, please improve the logging, it seems the message gets cut off when logged (Originally by michal.skrivanek) (In reply to Michal Skrivanek from comment #3) > Toams, please improve the logging, it seems the message gets cut off when > logged *Tomas, sorry:) - and please also check the tooltip in Enable VNC Encryption setting, seems empty to me. (Originally by michal.skrivanek) Yes, Michal is right, this looks like a misconfiguration.
Also, for FIPS+Encypted VNC, SASL need to be correctly configured, preferably with the provided ansible role ('ovirt-host-setup-vnc-sasl', example playbook is 'ovirt-vnc-sasl.yml'). Putting it somewhere in the documentation is not the most user-friendly way to make users aware. Should the hint about it be included in the error message, maybe?
(Originally by Tomasz Baranski)
There is also a real bug on POWER. The kernel cmdline is not editable at all beacause originally it was only for hostdev passthrough not relevant on POWER. But now the FIPS and NOSMT should be available, all the others should still be disabled.
Also the detection is probably wrong...for the disabled ones we probably should not initialize the json fields.
example:
{"current":"fips=0 nosmt","parsable":false,"blacklistNouveau":true,"iommu":true,"kvmNested":true,"unsafeInterrupts":true,"pciRealloc":true,"fips":true,"smtDisabled":true}
which shows up in UI as checked greyed out. Problem is that they are still interpreted - fips config is being sent.
(Originally by michal.skrivanek)
actually, we will need a doc text for the actual fix of wrongly grayed out options on POWER (Originally by michal.skrivanek) sync2jira sync2jira INFO: Bug status (ON_QA) wasn't changed but the folowing should be fixed: [Tag 'ovirt-engine-4.3.5.6' doesn't contain patch 'https://gerrit.ovirt.org/103034'] gitweb: https://gerrit.ovirt.org/gitweb?p=ovirt-engine.git;a=shortlog;h=refs/tags/ovirt-engine-4.3.5.6 For more info please contact: rhv-devops Verified: rhvm-4.3.6.6-0.1.el7 vdsm-4.30.33-1.el7ev.ppc64le libvirt-4.5.0-23.el7_7.1.ppc64le qemu-kvm-rhev-10:2.12.0-33.el7_7.4.ppc64le Verification scenario: 1. Add host to Power9 cluster 2. After host added, reboot the host and wait for it to be loaded and active in the engine. verify Kernel command line does not include FIPS configuration (Webadmin -> edit host -> kernel tab. also in host cli: cat /proc/cmdline). Verify VNC encryption is disabled on cluster. 3. Create new VM and keep default configuration (console -> VNC VGA). Verify VNC console can be open on the VM and console is showing VM display. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHEA-2019:3010 |