On Sun, Feb 6, 2022 at 5:09 PM Gilboa Davara <gilb...@gmail.com> wrote: > > Unlike my predecessor, I not only lost my vmengine, I also lost the vdsm > services on all hosts. > All seem to be hitting the same issue - read, the certs under > /etc/pki/vdsm/certs and /etc/pki/ovirt* all expired a couple of days ago. > As such, the hosted engine cannot go into global maintenance mode,
What do you mean by that? What happens if you 'hosted-engine --set-maintenance --mode=global'? > preventing engine-setup --offline from running. Actually just a few days ago I pushed a patch for: https://bugzilla.redhat.com/show_bug.cgi?id=1700460 But: If you really have a problem that you can't set global maintenance, using this is a risk - HA might intervene in the middle and shutdown the VM. So either make sure global maintenance does work, or stop all HA services on all hosts. > Two questions: > 1. Is there any automated method to renew the vdsm certificates? You mean, without an engine? I think that if you have a functional engine one way or another, you can automate this somehow, didn't check. Try checking e.g. the python sdk examples - there might be there something you can base on. > 2. Assuming the previous answer is "no", assuming I'm somewhat versed in > using openssl, how can I manually renew them? I'd rather not try to invent from memory how this is supposed to work, and doing this methodically and verifying before replying is quite an effort. If this is really what you want, I suggest something like: 1. Set up a test env with an engine and one host 2. Backup (or use git on) /etc on both 3. Renew the host cert from the UI 4. Check what changed You should find, IMO, that the key(s) on the host didn't change. I guess you might also find CSRs on one or both of them. So basically it should be something like: 1. Create a CSR on the host for the existing key (one or more, not sure). 2. Copy and sign this on the engine using pki-enroll-request.sh (I think you can find examples for it scattered around, perhaps even in the main guides) 3. Copy back the generated certs to the host 4. Perhaps restart one or more services there (vdsm, imageio?, ovn, etc.) You can check the code in /usr/share/ovirt-engine/ansible-runner-service-project/project to see how it's done when initiated from the UI. Good luck and best regards, -- Didi _______________________________________________ Users mailing list -- users@ovirt.org To unsubscribe send an email to users-le...@ovirt.org Privacy Statement: https://www.ovirt.org/privacy-policy.html oVirt Code of Conduct: https://www.ovirt.org/community/about/community-guidelines/ List Archives: https://lists.ovirt.org/archives/list/users@ovirt.org/message/UAQ66VOSANSAFV2QZTR2GO4NOYN4E3DE/
