🥇oVirt in 2 Hours. Part 3. Additional Settings

In this article, we will discuss a number of optional but useful settings:

using additional names for the manager;
connecting authentication through Active Directory;
Multipathing;
power management;
replacing the SSL certificate;
archiving;
host management interface (cockpit);
VLANs;
HPE-specific.

This article is a continuation; see the beginning in oVirt in 2 Hours Part 1 and Part 2.

Articles

Introduction
Installing the manager (ovirt-engine) and hypervisors (hosts)
Additional Settings — We're Here

Additional manager settings

For convenience, we will install additional packages:

$ sudo yum install bash-completion vim

To enable command autocompletion, you need to switch to bash.

Adding additional DNS names

This is necessary when you need to connect to the manager using an alternative name (CNAME, alias, or just a short name without the domain suffix). For security reasons, the manager allows connection only through an approved list of names.

Create a configuration file:

$ sudo vim /etc/ovirt-engine/engine.conf.d/99-custom-sso-setup.conf

with the following content:

SSO_ALTERNATE_ENGINE_FQDNS="ovirt.example.com some.alias.example.com ovirt"

and restart the manager:

$ sudo systemctl restart ovirt-engine

Configuring authentication via AD

oVirt has a built-in user database, but it also supports external LDAP providers, including AD.

The simplest way for a standard configuration is to run the wizard and restart the manager:

$ sudo yum install ovirt-engine-extension-aaa-ldap-setup
$ sudo ovirt-engine-extension-aaa-ldap-setup
$ sudo systemctl restart ovirt-engine

Example of running the wizard
$ sudo ovirt-engine-extension-aaa-ldap-setup
Available LDAP implementations:
…
3 — Active Directory
…
Please select: 3
Please enter the Active Directory Forest name: example.com

Please select the protocol to use (startTLS, ldaps, plain) [startTLS]:
Please select the method to obtain the PEM encoded CA certificate (File, URL, Inline, System, Insecure): URL
URL: wwwca.example.com/myRootCA.pem
Enter search user DN (for example uid=username,dc=example,dc=com or leave empty for anonymous): CN=oVirt-Engine,CN=Users,DC=example,DC=com
Enter search user password: *password*
[ INFO ] Attempting to bind using ‘CN=oVirt-Engine,CN=Users,DC=example,DC=com’
Are you going to use Single Sign-On for Virtual Machines (Yes, No) [Yes]:
Please specify a profile name that will be visible to users [example.com]:
Please provide credentials to test the login flow:
Enter user name: someAnyUser
Enter user password:
…
[ INFO ] Login sequence executed successfully
…
Select test sequence to execute (Done, Abort, Login, Search) [Done]:
[ INFO ] Stage: Transaction setup
…
CONFIGURATION SUMMARY
…

Using the wizard is suitable for most cases. For complex configurations, settings are done manually. For more information, refer to the oVirt documentation. Users and Roles. After successfully connecting the Engine to AD, an additional profile will appear in the connection window, and on the tab Permissions for system objects — the ability to grant permissions to users and AD groups. It is worth noting that the external directory of users and groups can be not only AD but also IPA, eDirectory, etc.

Multipathing

In a production environment, the storage system must be connected to the host through multiple independent paths for multipath I/O. Typically, in CentOS (and thus in oVirt), there are no issues with assembling multiple paths to the device (find_multipaths yes). Additional settings for FCoE are described in Part 2. It is important to pay attention to the manufacturer's recommendation for the storage system — many recommend using the round-robin policy, while the default in Enterprise Linux 7 is service-time.

For example, 3PAR
and the documentation HPE 3PAR Red Hat Enterprise Linux, CentOS Linux, Oracle Linux, and Oracle VM Server Implementation Guide EL is created as a Host with Generic-ALUA Persona 2, for which the following values are added to the settings in /etc/multipath.conf:

defaults {
           polling_interval      10
           user_friendly_names   no
           find_multipaths       yes
          }
devices {
          device {
                   vendor                   "3PARdata"
                   product                  "VV"
                   path_grouping_policy     group_by_prio
                   path_selector            "round-robin 0"
                   path_checker             tur
                   features                 "0"
                   hardware_handler         "1 alua"
                   prio                     alua
                   failback                 immediate
                   rr_weight                uniform
                   no_path_retry            18
                   rr_min_io_rq             1
                   detect_prio              yes
                   fast_io_fail_tmo         10
                   dev_loss_tmo             "infinity"
                 }
}

After that, the restart command is given:

systemctl restart multipathd

Fig. 1 — Default multipath I/O policy.

Fig. 2 — Multipath I/O policy after applying the settings.

Power Management Configuration

Allows, for example, a hardware reset of the machine if the Engine cannot get a response from the Host for an extended period. Implemented through Fence Agent.

Compute -> Hosts -> HOST — Edit -> Power Management, then enable 'Enable Power Management' and add an agent — 'Add Fence Agent' -> +.

Specify the type (for example, for iLO5 you need to specify ilo4), the name/IP address of the IPMI interface, as well as the username/password. It is recommended to create a separate user (e.g., oVirt-PM) and, in the case of iLO, grant it privileges:

Login
Remote Console
Virtual Power and Reset
Virtual Media
Configure iLO Settings
Administer User Accounts

Don't ask why this approach has been chosen; it has been determined empirically. The console fencing agent requires a smaller set of permissions.

When configuring access control lists, keep in mind that the agent runs not on the engine, but on the 'neighboring' host (the so-called Power Management Proxy). This means that if there is only one node in the cluster, power management will not function. will not work.

Configuring SSL

The complete official guide can be found in the documentation, Appendix D: oVirt and SSL — Replacing the oVirt Engine SSL/TLS Certificate.

The certificate can be from our corporate CA or from an external commercial certificate authority.

Important note: The certificate is intended for connecting to the manager and will not affect the interaction between the Engine and the nodes — they will use self-signed certificates issued by the Engine.

Requirements:

a certificate from the issuing CA in PEM format, with the entire chain up to the root CA (from subordinate issuing to root at the end);
a certificate for Apache, issued by the CA (also supplemented with the entire chain of CA certificates);
a private key for Apache, without a password.

Let's assume our certificate authority is running on CentOS, is called subca.example.com, and the requests, keys, and certificates are located in the directory /etc/pki/tls/.

Back up and create a temporary directory:

$ sudo cp /etc/pki/ovirt-engine/keys/apache.key.nopass /etc/pki/ovirt-engine/keys/apache.key.nopass.`date +%F`
$ sudo cp /etc/pki/ovirt-engine/certs/apache.cer /etc/pki/ovirt-engine/certs/apache.cer.`date +%F`
$ sudo mkdir /opt/certs
$ sudo chown mgmt.mgmt /opt/certs

Download the certificates, either from your workstation or by transferring them in some other convenient way:

[myuser@mydesktop] $ scp -3 causer@subca.example.com:/etc/pki/tls/cachain.pem mgmt@ovirt.example.com:/opt/certs
[myuser@mydesktop] $ scp -3 causer@subca.example.com:/etc/pki/tls/private/ovirt.key mgmt@ovirt.example.com:/opt/certs
[myuser@mydesktop] $ scp -3 causer@subca.example.com:/etc/pki/tls/certs/ovirt.crt mgmt@ovirt.example.com:/opt/certs

As a result, you should see all 3 files:

$ ls /opt/certs
cachain.pem  ovirt.crt  ovirt.key

Installing the Certificates

Copy the files and update the trust lists:

$ sudo cp /opt/certs/cachain.pem /etc/pki/ca-trust/source/anchors
$ sudo update-ca-trust
$ sudo rm /etc/pki/ovirt-engine/apache-ca.pem
$ sudo cp /opt/certs/cachain.pem /etc/pki/ovirt-engine/apache-ca.pem
$ sudo cp /opt/certs/ovirt03.key /etc/pki/ovirt-engine/keys/apache.key.nopass
$ sudo cp /opt/certs/ovirt03.crt /etc/pki/ovirt-engine/certs/apache.cer
$ sudo systemctl restart httpd.service

Add/update the configuration files:

$ sudo vim /etc/ovirt-engine/engine.conf.d/99-custom-truststore.conf

ENGINE_HTTPS_PKI_TRUST_STORE="/etc/pki/java/cacerts"
ENGINE_HTTPS_PKI_TRUST_STORE_PASSWORD=""

$ sudo vim /etc/ovirt-engine/ovirt-websocket-proxy.conf.d/10-setup.conf

SSL_CERTIFICATE=/etc/pki/ovirt-engine/certs/apache.cer
SSL_KEY=/etc/pki/ovirt-engine/keys/apache.key.nopass

$ sudo vim /etc/ovirt-imageio-proxy/ovirt-imageio-proxy.conf

# Key file for SSL connections
ssl_key_file = /etc/pki/ovirt-engine/keys/apache.key.nopass
# Certificate file for SSL connections
ssl_cert_file = /etc/pki/ovirt-engine/certs/apache.cer

Next, we restart all affected services:

$ sudo systemctl restart ovirt-provider-ovn.service
$ sudo systemctl restart ovirt-imageio-proxy
$ sudo systemctl restart ovirt-websocket-proxy
$ sudo systemctl restart ovirt-engine.service

Done! It's time to connect to the manager and check that the connection is secured with a signed SSL certificate.

Archiving

Where would we be without it! This section will discuss the archiving of the manager; archiving VMs is a separate topic. Backup copies will be made once a day and stored on NFS, for example, on the same system where we placed the ISO images — mynfs01.example.com:/exports/ovirt-backup. It is not recommended to store backups on the same machine where the Engine operates.

We install and enable autofs:

$ sudo yum install autofs
$ sudo systemctl enable autofs
$ sudo systemctl start autofs

We create a script:

$ sudo vim /etc/cron.daily/make.oVirt.backup.sh

with the following content:

#!/bin/bash

datetime=`date +"%F.%R"`
backupdir="/net/mynfs01.example.com/exports/ovirt-backup"
filename="$backupdir/`hostname --short`.`date +"%F.%R"`"
engine-backup --mode=backup --scope=all --file=$filename.data --log=$filename.log
#uncomment next line for autodelete files older 30 days 
#find $backupdir -type f -mtime +30 -exec rm -f {} ;

We make the file executable:

$ sudo chmod a+x /etc/cron.daily/make.oVirt.backup.sh

Now, every night we will receive an archive of the manager's settings.

Host management interface

Cockpit — a modern administrative interface for Linux systems. In this case, it acts similarly to the web interface of ESXi.

Fig. 3 — appearance of the panel.

It installs very easily; the cockpit and cockpit-ovirt-dashboard packages are needed:

$ sudo yum install cockpit cockpit-ovirt-dashboard -y

Enabling Cockpit:

$ sudo systemctl enable --now cockpit.socket

Configuring the firewall:

sudo firewall-cmd --add-service=cockpit
sudo firewall-cmd --add-service=cockpit --permanent

Now you can connect to the host: https://[Host IP or FQDN]:9090

VLANs

For more information about networks, it’s worth reading in the documentation. There are many possibilities; here we will describe the connection of virtual networks.

To connect other subnets, they first need to be described in the configuration: Network -> Networks -> New, the only required field is the name; the VM Network checkbox, allowing machines to use this network, is enabled, and for connecting the tag, you need to enable Enable VLAN tagging, specify the VLAN number, and click Ok.

Now go to Compute -> Hosts -> kvmNN -> Network Interfaces -> Setup Host Networks. Drag the added network from the right side Unassigned Logical Networks to the left in Assigned Logical Networks:

Fig. 4 — before adding the network.

Fig. 5 — after adding the network.

To mass connect several networks to the host conveniently, assign them a label(s) when creating networks and add networks by labels.

After creating the network, hosts will move to a Non Operational state until the network addition is complete across all nodes in the cluster. This behavior is triggered by the Require All option on the Cluster tab when creating a new network. If the network is not needed on all cluster nodes, this option can be disabled; then, the network will appear on the right side in the Non Required section when adding to a host, allowing you to choose whether to connect it to the specific host.

Fig. 6 — selecting the network requirement attribute.

Specific to HPE

Almost all manufacturers provide tools that enhance the usability of their products. For example, HPE provides AMS (Agentless Management Service, amsd for iLO5, hp-ams for iLO4) and SSA (Smart Storage Administrator, for managing the disk controller), among others.

Connecting the HPE repository
Import the key and connect the HPE repositories:

$ sudo rpm --import https://downloads.linux.hpe.com/SDR/hpePublicKey2048_key1.pub
$ sudo vim /etc/yum.repos.d/mcp.repo

with the following content:

[mcp]
name=Management Component Pack
baseurl=http://downloads.linux.hpe.com/repo/mcp/centos/$releasever/$basearch/current/
enabled=1
gpgkey=file:///etc/pki/rpm-gpg/GPG-KEY-mcp

[spp]
name=Service Pack for ProLiant
baseurl=http://downloads.linux.hpe.com/SDR/repo/spp/RHEL/$releasever/$basearch/current/
enabled=1
gpgkey=file:///etc/pki/rpm-gpg/GPG-KEY-mcp

Viewing the contents of the repository and package information (for reference):

$ sudo yum --disablerepo="*" --enablerepo="mcp" list available
$ yum info amsd

Installation and starting:

$ sudo yum install amsd ssacli
$ sudo systemctl start amsd

Example of the utility's operation for managing the disk controller

That's all for now. In upcoming articles, I plan to discuss some basic operations and applications, e.g., how to create VDI in oVirt.

Source: habr.com