[ovirt-users] Re: Task Run PKI enroll request for vdsm and QEMU failed to execute. Ovirt 4.5.1
Thank you Patrick and Milan for your assistance. I was at a complete loss as I had added nodes before without issue and Dr. Google failed to provide any solutions. Relieved to know that this issue is being worked on! Cheers, Xavier ___ Users mailing list -- users@ovirt.org To unsubscribe send an email to users-le...@ovirt.org Privacy Statement: https://www.ovirt.org/privacy-policy.html oVirt Code of Conduct: https://www.ovirt.org/community/about/community-guidelines/ List Archives: https://lists.ovirt.org/archives/list/users@ovirt.org/message/EDBDTKOKPNANZN34N5MBYBTZIUTGH3UE/
[ovirt-users] Re: Task Run PKI enroll request for vdsm and QEMU failed to execute. Ovirt 4.5.1
Patrick Hibbs writes: > That error is saying the enrollment script cannot access the serial.txt > file to generate the new certificate's serial number. That file should > be located at /etc/pki/ovirt-engine/serial.txt Owned by the ovirt user > / group. (Oddly enough on my system that file is world readable / > writable. Which seems like it should be wrong...) It is wrong and it is being handled in https://github.com/oVirt/ovirt-engine/pull/477. > There may also be backup files of it in that same directory. > > If the file doesn't exist at all and there are no backups: You could > try to create a new one by figuring out what the highest serial number > issued by the internal ca is, incrementing it by one, and echoing that > into a new serial.txt file. (Setting permissions as appropriate.) > Although in this case, I'd ask why the file was deleted in the first > place. It might be related to https://bugzilla.redhat.com/2088446 but I don't know any details. Regards, Milan > -Patrick Hibbs > > On Wed, 2022-07-20 at 19:44 +, xavi...@rogers.com wrote: >> Log: >> >> 2022-07-20 17:50:43 UTC - TASK [ovirt-host-deploy-vdsm-certificates : >> Run PKI enroll request for vdsm and QEMU] *** >> 2022-07-20 17:50:43 UTC - >> 2022-07-20 17:50:43 UTC - { >> "status" : "OK", >> "msg" : "", >> "data" : { >> "uuid" : "67f44c2c-edf2-454b-ab5f-a3a6e3076ddc", >> "counter" : 179, >> "stdout" : "", >> "start_line" : 171, >> "end_line" : 171, >> "runner_ident" : "6b4c5f52-0854-11ed-b044-00163e598f5b", >> "event" : "runner_on_failed", >> "pid" : 32040, >> "created" : "2022-07-20T17:50:43.065710", >> "parent_uuid" : "00163e59-8f5b-ba87-8722-02a4", >> "event_data" : { >> "playbook" : "ovirt-host-deploy.yml", >> "playbook_uuid" : "4f7a6915-ae99-445b-ac02-ba66bbd1aa57", >> "play" : "all", >> "play_uuid" : "00163e59-8f5b-ba87-8722-0008", >> "play_pattern" : "all", >> "task" : "Run PKI enroll request for vdsm and QEMU", >> "task_uuid" : "00163e59-8f5b-ba87-8722-02a4", >> "task_action" : "command", >> "task_args" : "", >> "task_path" : "/usr/share/ovirt-engine/ansible-runner-service- >> project/project/roles/ovirt-host-deploy-vdsm- >> certificates/tasks/main.yml:38", >> "role" : "ovirt-host-deploy-vdsm-certificates", >> "host" : "xnet-node-02.xnet.local", >> "remote_addr" : "xnet-node-02.xnet.local", >> "res" : { >> "results" : [ { >> "msg" : "non-zero return code", >> "cmd" : [ "/usr/share/ovirt-engine/bin/pki-enroll- >> request.sh", "--name=xnet-node-02.xnet.local", "-- >> subject=/O=xnet.local/CN=xnet-node-02.xnet.local", "--san=DNS:xnet- >> node-02.xnet.local", "--days=398", "--timeout=30", "--ca-file=ca", "- >> -cert-dir=certs", "--req-dir=requests" ], >> "stdout" : "", >> "stderr" : "Using configuration from openssl.conf\nunable >> to load number from serial.txt\nerror while loading serial >> number\n140364123252544:error:0D066096:asn1 encoding >> routines:a2i_ASN1_INTEGER:short line:crypto/asn1/f_int.c:140:\nCannot >> sign certificate", >> "rc" : 1, >> "start" : "2022-07-20 17:50:42.811555", >> "end" : "2022-07-20 17:50:42.840405", >> "delta" : "0:00:00.028850", >> "changed" : true, >> "failed" : true, >> "invocation" : { >> "module_args" : { >> "_raw_params" : "\"/usr/share/ovirt-engine/bin/pki- >> enroll-request.sh\"\n\"--name=xnet-node-02.xnet.local\"\n\"-- >> subject=/O=xnet.local/CN=xnet-node-02.xnet.local\"\n\"--san=DNS:xnet- >> node-02.xnet.local\"\n\"--days=398\"\n\"--timeout=30\"\n\"--ca- >> file=ca\"\n\"--cert-dir=certs\"\n\"--req-dir=requests\"\n", >> "warn" : true, >> "_uses_shell" : false, >> "stdin_add_newline" : true, >> "strip_empty_ends" : true, >> "argv" : null, >> "chdir" : null, >> "executable" : null, >> "creates" : null, >> "removes" : null, >> "stdin" : null >> } >> }, >> "stdout_lines" : [ ], >> "stderr_lines" : [ "Using configuration from openssl.conf", >> "unable to load number from serial.txt", "error while loading serial >> number", "140364123252544:error:0D066096:asn1 encoding >> routines:a2i_ASN1_INTEGER:short line:crypto/asn1/f_int.c:140:", >> "Cannot sign certificate" ], >> "_ansible_no_log" : false, >> "item" : { >> "ou" : "", >> "ca_file" : "ca", >> "cert_dir" : "certs", >> "req_dir" : "requests" >> }, >> "ansible_loop_var" : "item", >> "_ansible_item_label" : { >> "ou" : "", >> "ca_file" : "ca", >> "cert_dir" : "certs", >> "req_dir" : "requests" >> } >>
[ovirt-users] Re: Task Run PKI enroll request for vdsm and QEMU failed to execute. Ovirt 4.5.1
That error is saying the enrollment script cannot access the serial.txt file to generate the new certificate's serial number. That file should be located at /etc/pki/ovirt-engine/serial.txt Owned by the ovirt user / group. (Oddly enough on my system that file is world readable / writable. Which seems like it should be wrong...) There may also be backup files of it in that same directory. If the file doesn't exist at all and there are no backups: You could try to create a new one by figuring out what the highest serial number issued by the internal ca is, incrementing it by one, and echoing that into a new serial.txt file. (Setting permissions as appropriate.) Although in this case, I'd ask why the file was deleted in the first place. -Patrick Hibbs On Wed, 2022-07-20 at 19:44 +, xavi...@rogers.com wrote: > Log: > > 2022-07-20 17:50:43 UTC - TASK [ovirt-host-deploy-vdsm-certificates : > Run PKI enroll request for vdsm and QEMU] *** > 2022-07-20 17:50:43 UTC - > 2022-07-20 17:50:43 UTC - { > "status" : "OK", > "msg" : "", > "data" : { > "uuid" : "67f44c2c-edf2-454b-ab5f-a3a6e3076ddc", > "counter" : 179, > "stdout" : "", > "start_line" : 171, > "end_line" : 171, > "runner_ident" : "6b4c5f52-0854-11ed-b044-00163e598f5b", > "event" : "runner_on_failed", > "pid" : 32040, > "created" : "2022-07-20T17:50:43.065710", > "parent_uuid" : "00163e59-8f5b-ba87-8722-02a4", > "event_data" : { > "playbook" : "ovirt-host-deploy.yml", > "playbook_uuid" : "4f7a6915-ae99-445b-ac02-ba66bbd1aa57", > "play" : "all", > "play_uuid" : "00163e59-8f5b-ba87-8722-0008", > "play_pattern" : "all", > "task" : "Run PKI enroll request for vdsm and QEMU", > "task_uuid" : "00163e59-8f5b-ba87-8722-02a4", > "task_action" : "command", > "task_args" : "", > "task_path" : "/usr/share/ovirt-engine/ansible-runner-service- > project/project/roles/ovirt-host-deploy-vdsm- > certificates/tasks/main.yml:38", > "role" : "ovirt-host-deploy-vdsm-certificates", > "host" : "xnet-node-02.xnet.local", > "remote_addr" : "xnet-node-02.xnet.local", > "res" : { > "results" : [ { > "msg" : "non-zero return code", > "cmd" : [ "/usr/share/ovirt-engine/bin/pki-enroll- > request.sh", "--name=xnet-node-02.xnet.local", "-- > subject=/O=xnet.local/CN=xnet-node-02.xnet.local", "--san=DNS:xnet- > node-02.xnet.local", "--days=398", "--timeout=30", "--ca-file=ca", "- > -cert-dir=certs", "--req-dir=requests" ], > "stdout" : "", > "stderr" : "Using configuration from openssl.conf\nunable > to load number from serial.txt\nerror while loading serial > number\n140364123252544:error:0D066096:asn1 encoding > routines:a2i_ASN1_INTEGER:short line:crypto/asn1/f_int.c:140:\nCannot > sign certificate", > "rc" : 1, > "start" : "2022-07-20 17:50:42.811555", > "end" : "2022-07-20 17:50:42.840405", > "delta" : "0:00:00.028850", > "changed" : true, > "failed" : true, > "invocation" : { > "module_args" : { > "_raw_params" : "\"/usr/share/ovirt-engine/bin/pki- > enroll-request.sh\"\n\"--name=xnet-node-02.xnet.local\"\n\"-- > subject=/O=xnet.local/CN=xnet-node-02.xnet.local\"\n\"--san=DNS:xnet- > node-02.xnet.local\"\n\"--days=398\"\n\"--timeout=30\"\n\"--ca- > file=ca\"\n\"--cert-dir=certs\"\n\"--req-dir=requests\"\n", > "warn" : true, > "_uses_shell" : false, > "stdin_add_newline" : true, > "strip_empty_ends" : true, > "argv" : null, > "chdir" : null, > "executable" : null, > "creates" : null, > "removes" : null, > "stdin" : null > } > }, > "stdout_lines" : [ ], > "stderr_lines" : [ "Using configuration from openssl.conf", > "unable to load number from serial.txt", "error while loading serial > number", "140364123252544:error:0D066096:asn1 encoding > routines:a2i_ASN1_INTEGER:short line:crypto/asn1/f_int.c:140:", > "Cannot sign certificate" ], > "_ansible_no_log" : false, > "item" : { > "ou" : "", > "ca_file" : "ca", > "cert_dir" : "certs", > "req_dir" : "requests" > }, > "ansible_loop_var" : "item", > "_ansible_item_label" : { > "ou" : "", > "ca_file" : "ca", > "cert_dir" : "certs", > "req_dir" : "requests" > } > }, { > "msg" : "non-zero return code", > "cmd" : [ "/usr/share/ovirt-engine/bin/pki-enroll- > request.sh", "--name=xnet-node-02.xnet.local", "-- > subject=/O=xnet.local/CN=xnet-node-02.xnet.local/OU=qemu", "-- > san=DNS:xnet-node-02.xnet.local", "--days=398", "--timeout=30", "-- > ca-file=qemu-ca",
[ovirt-users] Re: Task Run PKI enroll request for vdsm and QEMU failed to execute. Ovirt 4.5.1
Log: 2022-07-20 17:50:43 UTC - TASK [ovirt-host-deploy-vdsm-certificates : Run PKI enroll request for vdsm and QEMU] *** 2022-07-20 17:50:43 UTC - 2022-07-20 17:50:43 UTC - { "status" : "OK", "msg" : "", "data" : { "uuid" : "67f44c2c-edf2-454b-ab5f-a3a6e3076ddc", "counter" : 179, "stdout" : "", "start_line" : 171, "end_line" : 171, "runner_ident" : "6b4c5f52-0854-11ed-b044-00163e598f5b", "event" : "runner_on_failed", "pid" : 32040, "created" : "2022-07-20T17:50:43.065710", "parent_uuid" : "00163e59-8f5b-ba87-8722-02a4", "event_data" : { "playbook" : "ovirt-host-deploy.yml", "playbook_uuid" : "4f7a6915-ae99-445b-ac02-ba66bbd1aa57", "play" : "all", "play_uuid" : "00163e59-8f5b-ba87-8722-0008", "play_pattern" : "all", "task" : "Run PKI enroll request for vdsm and QEMU", "task_uuid" : "00163e59-8f5b-ba87-8722-02a4", "task_action" : "command", "task_args" : "", "task_path" : "/usr/share/ovirt-engine/ansible-runner-service-project/project/roles/ovirt-host-deploy-vdsm-certificates/tasks/main.yml:38", "role" : "ovirt-host-deploy-vdsm-certificates", "host" : "xnet-node-02.xnet.local", "remote_addr" : "xnet-node-02.xnet.local", "res" : { "results" : [ { "msg" : "non-zero return code", "cmd" : [ "/usr/share/ovirt-engine/bin/pki-enroll-request.sh", "--name=xnet-node-02.xnet.local", "--subject=/O=xnet.local/CN=xnet-node-02.xnet.local", "--san=DNS:xnet-node-02.xnet.local", "--days=398", "--timeout=30", "--ca-file=ca", "--cert-dir=certs", "--req-dir=requests" ], "stdout" : "", "stderr" : "Using configuration from openssl.conf\nunable to load number from serial.txt\nerror while loading serial number\n140364123252544:error:0D066096:asn1 encoding routines:a2i_ASN1_INTEGER:short line:crypto/asn1/f_int.c:140:\nCannot sign certificate", "rc" : 1, "start" : "2022-07-20 17:50:42.811555", "end" : "2022-07-20 17:50:42.840405", "delta" : "0:00:00.028850", "changed" : true, "failed" : true, "invocation" : { "module_args" : { "_raw_params" : "\"/usr/share/ovirt-engine/bin/pki-enroll-request.sh\"\n\"--name=xnet-node-02.xnet.local\"\n\"--subject=/O=xnet.local/CN=xnet-node-02.xnet.local\"\n\"--san=DNS:xnet-node-02.xnet.local\"\n\"--days=398\"\n\"--timeout=30\"\n\"--ca-file=ca\"\n\"--cert-dir=certs\"\n\"--req-dir=requests\"\n", "warn" : true, "_uses_shell" : false, "stdin_add_newline" : true, "strip_empty_ends" : true, "argv" : null, "chdir" : null, "executable" : null, "creates" : null, "removes" : null, "stdin" : null } }, "stdout_lines" : [ ], "stderr_lines" : [ "Using configuration from openssl.conf", "unable to load number from serial.txt", "error while loading serial number", "140364123252544:error:0D066096:asn1 encoding routines:a2i_ASN1_INTEGER:short line:crypto/asn1/f_int.c:140:", "Cannot sign certificate" ], "_ansible_no_log" : false, "item" : { "ou" : "", "ca_file" : "ca", "cert_dir" : "certs", "req_dir" : "requests" }, "ansible_loop_var" : "item", "_ansible_item_label" : { "ou" : "", "ca_file" : "ca", "cert_dir" : "certs", "req_dir" : "requests" } }, { "msg" : "non-zero return code", "cmd" : [ "/usr/share/ovirt-engine/bin/pki-enroll-request.sh", "--name=xnet-node-02.xnet.local", "--subject=/O=xnet.local/CN=xnet-node-02.xnet.local/OU=qemu", "--san=DNS:xnet-node-02.xnet.local", "--days=398", "--timeout=30", "--ca-file=qemu-ca", "--cert-dir=certs-qemu", "--req-dir=requests-qemu" ], "stdout" : "", "stderr" : "Using configuration from openssl.conf\nunable to load number from serial.txt\nerror while loading serial number\n140005905663808:error:0D066096:asn1 encoding routines:a2i_ASN1_INTEGER:short line:crypto/asn1/f_int.c:140:\nCannot sign certificate", "rc" : 1, "start" : "2022-07-20 17:50:43.015979", "end" : "2022-07-20 17:50:43.043930", "delta" : "0:00:00.027951", "changed" : true, "failed" : true, "invocation" : { "module_args" : { "_raw_params" : "\"/usr/share/ovirt-engine/bin/pki-enroll-request.sh\"\n\"--name=xnet-node-02.xnet.local\"\n\"--subject=/O=xnet.local/CN=xnet-node-02.xnet.local/OU=qemu\"\n\"--san=DNS:xnet-node-02.xnet.local\"\n\"--days=398\"\n\"--timeout=30\"\n\"--ca-file=qemu-ca\"\n\"--cert-dir=certs-qemu\"\n\"--req-dir=requests-qemu\"\n", "warn" : true, "_uses_shell" : false,