Bug 1439240 - [downstream clone - 3.6.11] [Upgrade] Auto-Import of HostedEngine VM fails due to missing CPU Profile Permissions
Summary: [downstream clone - 3.6.11] [Upgrade] Auto-Import of HostedEngine VM fails du...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Virtualization Manager
Classification: Red Hat
Component: ovirt-engine
Version: 3.6.10
Hardware: x86_64
OS: Linux
high
medium
Target Milestone: ovirt-3.6.11
: ---
Assignee: Andrej Krejcir
QA Contact: Nikolai Sednev
URL:
Whiteboard:
Depends On: 1435088
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-04-05 13:34 UTC by rhev-integ
Modified: 2020-05-14 15:53 UTC (History)
8 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Previously, while importing a self-hosted engine virtual machine (VM), the permissions for using the CPU profile were checked, even when this was not required. As a result, if the CPU profile in the cluster did not have permissions for 'Everyone', the import would fail. In this update, the permissions are only checked when necessary and the self-hosted engine VM can be imported regardless of the CPU profile permissions.
Clone Of: 1435088
Environment:
Last Closed: 2017-05-09 17:04:20 UTC
oVirt Team: SLA
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Knowledge Base (Solution) 2978821 0 None None None 2017-04-05 13:35:00 UTC
Red Hat Product Errata RHEA-2017:1210 0 normal SHIPPED_LIVE Red Hat Enterprise Virtualization Manager 3.6.11 2017-05-09 21:03:09 UTC
oVirt gerrit 74908 0 master MERGED core: Ignore cpu profile premissions for internal commands 2017-04-05 13:38:37 UTC
oVirt gerrit 75140 0 ovirt-engine-4.1 MERGED core: Ignore cpu profile premissions for internal commands 2017-04-05 14:56:23 UTC
oVirt gerrit 75141 0 ovirt-engine-4.0 ABANDONED core: Ignore cpu profile premissions for internal commands 2017-04-05 13:35:00 UTC
oVirt gerrit 75142 0 ovirt-engine-3.6 MERGED core: Ignore cpu profile premissions for internal commands 2017-04-05 14:53:42 UTC

Description rhev-integ 2017-04-05 13:34:32 UTC
+++ This bug is a downstream clone. The original bug is: +++
+++   bug 1435088 +++
======================================================================

Description of problem:

Initially I saw this on one of out test labs and thought it was just us messing around with every single option available. But now I saw it again.

CanDoAction of ImportVm during the Auto-Import of HE VM ends up calling assignFirstCpuProfile(). And in case the the Cluster the HE VM is being imported to is missing the permissions for CpuProfileOperator, the canDo validation fails and the HostedEngine VM is not imported with ACTION_TYPE_CPU_PROFILE_EMPTY. 

See:

2017-03-21 14:41:20,149 WARN  [org.ovirt.engine.core.bll.ImportVmCommand] (org.ovirt.thread.pool-6-thread-19) [] CanDoAction of action 'ImportVm' failed for user SYSTEM. Reasons: VAR__ACTION__IMPORT,VAR__TYPE__VM,ACTION_TYPE_CPU_PROFILE_EMPTY

2017-03-21 14:41:20,149 ERROR [org.ovirt.engine.core.bll.HostedEngineImporter] (org.ovirt.thread.pool-6-thread-19) [] Failed importing the Hosted Engine VM

And it keeps looping like this forever.

In both occurrences I saw the Cluster the HE VM is being imported to is not the Default one and is missing the CpuProfileOperator permission role, so HE Auto-Import fails.

Common Ground:
- Both were upgraded from 3.5
- Both have custom (user created) Clusters in which the HE runs (not Default name)
- Cluster already existed in 3.5

From what I can see CpuProfileOperator was introduced in 3.6.

Case 1 (ticket):
* 3.5 to 3.6 Upgrade
* Cluster the HE VM supposed to be imported already existed pre upgrade to 3.6

Case 2 (labs):
* 4.0 Standalone to 4.0 SHE Migration
* this has been upgraded all the way from early RHV 3.x
* Cluster HE VM was supposed to be imported to was definitely created pre-3.6

Version-Release number of selected component (if applicable):
rhevm-3.6.10.2-0.2.el6.noarch

How reproducible:
Not sure

More information:
* Shouldn't the HE VM Auto-Import process ensure the CpuProfile roles are in the cluster it's trying to import the VM to?
* Shouldn't these permissions be added to all clusters that are upgraded to 3.6? I can only see it added to the 'Default' cluster, not the user created cluster that runs HE.

(Originally by Germano Veit Michel)

Comment 5 rhev-integ 2017-04-07 14:10:05 UTC
INFO: Bug status wasn't changed from MODIFIED to ON_QA due to the following reason:

[TAG 'ovirt-engine-3.6.11' DOESN'T CONTAIN PATCH 'https://gerrit.ovirt.org/75142']
gitweb: https://gerrit.ovirt.org/gitweb?p=ovirt-engine.git;a=shortlog;h=refs/tags/ovirt-engine-3.6.11

For more info please contact: rhv-devops

Comment 7 Nikolai Sednev 2017-04-13 16:47:15 UTC
Works for me on these components on hosts:
rhevm-sdk-python-3.6.9.1-1.el7ev.noarch
vdsm-4.17.39-1.el7ev.noarch
sanlock-3.4.0-1.el7.x86_64
qemu-kvm-rhev-2.6.0-28.el7_3.9.x86_64
ovirt-hosted-engine-ha-1.3.5.10-1.el7ev.noarch
ovirt-vmconsole-host-1.0.4-1.el7ev.noarch
ovirt-host-deploy-1.4.1-1.el7ev.noarch
libvirt-client-2.0.0-10.el7_3.5.x86_64
ovirt-vmconsole-1.0.4-1.el7ev.noarch
mom-0.5.6-1.el7ev.noarch
ovirt-hosted-engine-setup-1.3.7.4-1.el7ev.noarch
ovirt-setup-lib-1.0.1-1.el7ev.noarch
Linux version 3.10.0-327.53.1.el7.x86_64 (mockbuild.eng.bos.redhat.com) (gcc version 4.8.5 20150623 (Red Hat 4.8.5-4) (GCC) ) #1 SMP Tue Mar 14 10:49:09 EDT 2017
Linux  3.10.0-327.53.1.el7.x86_64 #1 SMP Tue Mar 14 10:49:09 EDT 2017 x86_64 x86_64 x86_64 GNU/Linux
Red Hat Enterprise Linux Server release 7.3 (Maipo)

On engine:

rhevm-setup-plugin-vmconsole-proxy-helper-3.6.11-0.2.el6.noarch
rhevm-sdk-python-3.6.9.1-1.el6ev.noarch
rhevm-spice-client-x86-cab-3.6-7.el6.noarch
rhevm-backend-3.6.11-0.2.el6.noarch
rhevm-setup-base-3.6.11-0.2.el6.noarch
rhevm-setup-plugin-websocket-proxy-3.6.11-0.2.el6.noarch
rhevm-doc-3.6.10-1.el6ev.noarch
rhevm-tools-backup-3.6.11-0.2.el6.noarch
rhevm-webadmin-portal-3.6.11-0.2.el6.noarch
ovirt-setup-lib-1.0.1-1.el6ev.noarch
rhevm-setup-3.6.11-0.2.el6.noarch
rhevm-cli-3.6.9.0-1.el6ev.noarch
rhevm-branding-rhev-3.6.0-10.el6ev.noarch
ovirt-vmconsole-proxy-1.0.4-1.el6ev.noarch
rhevm-spice-client-x64-msi-3.6-7.el6.noarch
rhevm-dwh-3.6.8-1.el6ev.noarch
ovirt-engine-extension-aaa-jdbc-1.0.7-2.el6ev.noarch
rhevm-setup-plugin-ovirt-engine-3.6.11-0.2.el6.noarch
rhevm-reports-setup-3.6.5.1-1.el6ev.noarch
rhevm-iso-uploader-3.6.0-1.el6ev.noarch
rhevm-dependencies-3.6.1-1.el6ev.noarch
ovirt-host-deploy-java-1.4.1-1.el6ev.noarch
rhevm-vmconsole-proxy-helper-3.6.11-0.2.el6.noarch
rhevm-spice-client-x86-msi-3.6-7.el6.noarch
rhevm-userportal-3.6.11-0.2.el6.noarch
rhevm-3.6.11-0.2.el6.noarch
rhevm-lib-3.6.11-0.2.el6.noarch
rhevm-dwh-setup-3.6.8-1.el6ev.noarch
rhevm-log-collector-3.6.1-1.el6ev.noarch
rhevm-websocket-proxy-3.6.11-0.2.el6.noarch
rhevm-extensions-api-impl-3.6.11-0.2.el6.noarch
rhevm-dbscripts-3.6.11-0.2.el6.noarch
rhevm-guest-agent-common-1.0.11-6.el6ev.noarch
rhevm-setup-plugins-3.6.5-1.el6ev.noarch
rhevm-image-uploader-3.6.1-2.el6ev.noarch
ovirt-vmconsole-1.0.4-1.el6ev.noarch
rhevm-spice-client-x64-cab-3.6-7.el6.noarch
rhevm-reports-3.6.5.1-1.el6ev.noarch
rhev-guest-tools-iso-3.6-6.el6ev.noarch
rhevm-setup-plugin-ovirt-engine-common-3.6.11-0.2.el6.noarch
ovirt-host-deploy-1.4.1-1.el6ev.noarch
rhevm-tools-3.6.11-0.2.el6.noarch
rhevm-restapi-3.6.11-0.2.el6.noarch
Linux version 2.6.32-573.41.1.el6.x86_64 (mockbuild.eng.bos.redhat.com) (gcc version 4.4.7 20120313 (Red Hat 4.4.7-16) (GCC) ) #1 SMP Thu Mar 2 11:08:17 EST 2017
Linux 2.6.32-573.41.1.el6.x86_64 #1 SMP Thu Mar 2 11:08:17 EST 2017 x86_64 x86_64 x86_64 GNU/Linux
Red Hat Enterprise Linux Server release 6.8 (Santiago)

Upgraded 3.5->3.6 without reproducing this issue, hence moving to verified.

Comment 9 errata-xmlrpc 2017-05-09 17:04:20 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2017:1210


Note You need to log in before you can comment on or make changes to this bug.