Description of problem: For various reason (PKI renewal -- see https://bugzilla.redhat.com/1648190, expiration...) host certs could requires to be enrolled again. We already have a specific action on engine side but being able to do it also at host upgrade time (at least if lead by the engine) could be a good idea since the host is in maintenance for sure and it can save the user from a second pass just to re-enroll certs if needed.
Martin, what do you think? Looks reasonable to me. Do you see any side effect I can't think of?
(In reply to Sandro Bonazzola from comment #1) > Martin, what do you think? Looks reasonable to me. > Do you see any side effect I can't think of? It makes sense to move another part from class host-deploy to ansible and add execution of enrolling certificates also to upgrade, but we are very late in the game for 4.3 RFEs. We will try to work on that, but it may be ready in some of oVirt 4.3.z releases ... I've also removed "optionally" from the title, in order to solve that issue, this needs to be by default turned on, but yeah we will add a flag so administrators could disable it.
Verified on ovirt-engine-4.3.1.2-0.0.master.20190225111554.git314f81b.el7.noarch
This bugzilla is included in oVirt 4.3.1 release, published on February 28th 2019. Since the problem described in this bug report should be resolved in oVirt 4.3.1 release, it has been closed with a resolution of CURRENT RELEASE. If the solution does not work for you, please open a new bug report.