Change in vdsm[master]: BZ#815825: deployUtil Do not overwrite cacert.pem

[Douglas Schilling Landgraf]

Douglas Schilling Landgraf has uploaded a new change for review.

Change subject: BZ#815825: deployUtil Do not overwrite cacert.pem
......................................................................

BZ#815825: deployUtil Do not overwrite cacert.pem

Instead of remove the current cacert.pem, let's backup it.
In case of the host doesn't get approved during the registration process
by Engine administrator, the next reboot vdsmcert.pem  won't validate
cacert.pem issuer and will make libvirt daemon fail to start.

Change-Id: Ia8569b5379ec8af7ad2e6dcafb2eef1fe47ab890
Signed-off-by: Douglas Schilling Landgraf <dougsland(a)redhat.com&gt;
---
M vdsm_reg/deployUtil.py.in
1 file changed, 8 insertions(+), 1 deletion(-)


  git pull ssh://gerrit.ovirt.org:29418/vdsm refs/changes/83/3883/1
--
To view, visit http://gerrit.ovirt.org/3883
To unsubscribe, visit http://gerrit.ovirt.org/settings

Gerrit-MessageType: newchange
Gerrit-Change-Id: Ia8569b5379ec8af7ad2e6dcafb2eef1fe47ab890
Gerrit-PatchSet: 1
Gerrit-Project: vdsm
Gerrit-Branch: master
Gerrit-Owner: Douglas Schilling Landgraf <dougsland(a)redhat.com&gt;

Change in vdsm[master]: BZ#815825: backup certs during registration

[Dan Kenigsberg]

Dan Kenigsberg has posted comments on this change.

Change subject: BZ#815825: backup certs during registration
......................................................................


Patch Set 7: Looks good to me, approved

--
To view, visit http://gerrit.ovirt.org/3883
To unsubscribe, visit http://gerrit.ovirt.org/settings

Gerrit-MessageType: comment
Gerrit-Change-Id: Ia8569b5379ec8af7ad2e6dcafb2eef1fe47ab890
Gerrit-PatchSet: 7
Gerrit-Project: vdsm
Gerrit-Branch: master
Gerrit-Owner: Douglas Schilling Landgraf <dougsland(a)redhat.com&gt;
Gerrit-Reviewer: Dan Kenigsberg <danken(a)redhat.com&gt;
Gerrit-Reviewer: Douglas Schilling Landgraf <dougsland(a)redhat.com&gt;
Gerrit-Reviewer: Michael Burns <mburns(a)redhat.com&gt;

Change in vdsm[master]: BZ#815825: backup certs during registration

[Dan Kenigsberg]

Dan Kenigsberg has submitted this change and it was merged.

Change subject: BZ#815825: backup certs during registration
......................................................................


BZ#815825: backup certs during registration

During the registration of oVirt Engine in a oVirt Node, instead of
remove cacert.pem and downloading the new cacert from Engine, is
important to backup the current certs before going further.

Besides, there is also a bug situation where the administrator of oVirt
Node executes the Engine registration procedure, and the host doesn't
get 'approved' (note: at this point cacert.pem from Engine already replaced
the /etc/pki/vdsm/certs/cacert.pem) causing a failure in the next reboot
on libvirt daemon startup. This happens because cacert.pem certificate
file cannot be validated with vdsmcert.pem, so if we have a backup, we
can easily revert it.

For record, steps to reproduce the bug:

- Install oVirt Node
- Setup Network
- Register the Node to oVirt Engine (do not approve)
- Reboot. (libvirt will fail to start)

Finally, there's also available a patch to libvirt.upstart
(http://gerrit.ovirt.org/#change,3885) that adds a validation feature
during the start of libvirt daemon, in order to check cacert.pem and
vdsmcert.pem. In case of
failure, upstart will look for the correct CA (backup file) in
/etc/pki/vdsm/certs and replace the
current cacert.pem. This approach can avoid the above bug description.

Change-Id: Ia8569b5379ec8af7ad2e6dcafb2eef1fe47ab890
Signed-off-by: Douglas Schilling Landgraf <dougsland(a)redhat.com&gt;
---
M vdsm_reg/deployUtil.py.in
1 file changed, 19 insertions(+), 1 deletion(-)

Approvals:
  Douglas Schilling Landgraf: Verified
  Dan Kenigsberg: Looks good to me, approved


--
To view, visit http://gerrit.ovirt.org/3883
To unsubscribe, visit http://gerrit.ovirt.org/settings

Gerrit-MessageType: merged
Gerrit-Change-Id: Ia8569b5379ec8af7ad2e6dcafb2eef1fe47ab890
Gerrit-PatchSet: 7
Gerrit-Project: vdsm
Gerrit-Branch: master
Gerrit-Owner: Douglas Schilling Landgraf <dougsland(a)redhat.com&gt;
Gerrit-Reviewer: Dan Kenigsberg <danken(a)redhat.com&gt;
Gerrit-Reviewer: Douglas Schilling Landgraf <dougsland(a)redhat.com&gt;
Gerrit-Reviewer: Michael Burns <mburns(a)redhat.com&gt;

Change in vdsm[master]: BZ#815825: backup certs during registration

[Dan Kenigsberg]

Dan Kenigsberg has posted comments on this change.

Change subject: BZ#815825: backup certs during registration
......................................................................


Patch Set 7: Looks good to me, but someone else must approve

--
To view, visit http://gerrit.ovirt.org/3883
To unsubscribe, visit http://gerrit.ovirt.org/settings

Gerrit-MessageType: comment
Gerrit-Change-Id: Ia8569b5379ec8af7ad2e6dcafb2eef1fe47ab890
Gerrit-PatchSet: 7
Gerrit-Project: vdsm
Gerrit-Branch: master
Gerrit-Owner: Douglas Schilling Landgraf <dougsland(a)redhat.com&gt;
Gerrit-Reviewer: Dan Kenigsberg <danken(a)redhat.com&gt;
Gerrit-Reviewer: Douglas Schilling Landgraf <dougsland(a)redhat.com&gt;
Gerrit-Reviewer: Michael Burns <mburns(a)redhat.com&gt;

Change in vdsm[master]: BZ#815825: backup certs during registration

[Douglas Schilling Landgraf]

Douglas Schilling Landgraf has posted comments on this change.

Change subject: BZ#815825: backup certs during registration
......................................................................


Patch Set 7: Verified

--
To view, visit http://gerrit.ovirt.org/3883
To unsubscribe, visit http://gerrit.ovirt.org/settings

Gerrit-MessageType: comment
Gerrit-Change-Id: Ia8569b5379ec8af7ad2e6dcafb2eef1fe47ab890
Gerrit-PatchSet: 7
Gerrit-Project: vdsm
Gerrit-Branch: master
Gerrit-Owner: Douglas Schilling Landgraf <dougsland(a)redhat.com&gt;
Gerrit-Reviewer: Dan Kenigsberg <danken(a)redhat.com&gt;
Gerrit-Reviewer: Douglas Schilling Landgraf <dougsland(a)redhat.com&gt;
Gerrit-Reviewer: Michael Burns <mburns(a)redhat.com&gt;

Change in vdsm[master]: BZ#815825: backup certs during registration

[Douglas Schilling Landgraf]

Douglas Schilling Landgraf has posted comments on this change.

Change subject: BZ#815825: backup certs during registration
......................................................................


Patch Set 6: (2 inline comments)

....................................................
File vdsm_reg/deployUtil.py.in
Line 1422:     for pemFile in range(len(certs)):
OK

Line 1440:         certs.append(VDSMCERT)
OK

--
To view, visit http://gerrit.ovirt.org/3883
To unsubscribe, visit http://gerrit.ovirt.org/settings

Gerrit-MessageType: comment
Gerrit-Change-Id: Ia8569b5379ec8af7ad2e6dcafb2eef1fe47ab890
Gerrit-PatchSet: 6
Gerrit-Project: vdsm
Gerrit-Branch: master
Gerrit-Owner: Douglas Schilling Landgraf <dougsland(a)redhat.com&gt;
Gerrit-Reviewer: Dan Kenigsberg <danken(a)redhat.com&gt;
Gerrit-Reviewer: Douglas Schilling Landgraf <dougsland(a)redhat.com&gt;
Gerrit-Reviewer: Michael Burns <mburns(a)redhat.com&gt;

Change in vdsm[master]: BZ#815825: backup certs during registration

[Dan Kenigsberg]

Dan Kenigsberg has posted comments on this change.

Change subject: BZ#815825: backup certs during registration
......................................................................


Patch Set 6: I would prefer that you didn't submit this

(2 inline comments)

....................................................
File vdsm_reg/deployUtil.py.in
Line 1422:     for pemFile in range(len(certs)):
that's not pythonic enough

 for pemFile in certs:

would give you what you want, cheaper.

Line 1440:         certs.append(VDSMCERT)
no need to append a list

  _nodeBackupCerts([CACERT, VDSMCERT])

is shorter and more readable.

--
To view, visit http://gerrit.ovirt.org/3883
To unsubscribe, visit http://gerrit.ovirt.org/settings

Gerrit-MessageType: comment
Gerrit-Change-Id: Ia8569b5379ec8af7ad2e6dcafb2eef1fe47ab890
Gerrit-PatchSet: 6
Gerrit-Project: vdsm
Gerrit-Branch: master
Gerrit-Owner: Douglas Schilling Landgraf <dougsland(a)redhat.com&gt;
Gerrit-Reviewer: Dan Kenigsberg <danken(a)redhat.com&gt;
Gerrit-Reviewer: Douglas Schilling Landgraf <dougsland(a)redhat.com&gt;
Gerrit-Reviewer: Michael Burns <mburns(a)redhat.com&gt;

Change in vdsm[master]: BZ#815825: backup certs during registration

[Douglas Schilling Landgraf]

Douglas Schilling Landgraf has posted comments on this change.

Change subject: BZ#815825: backup certs during registration
......................................................................


Patch Set 6: Verified

--
To view, visit http://gerrit.ovirt.org/3883
To unsubscribe, visit http://gerrit.ovirt.org/settings

Gerrit-MessageType: comment
Gerrit-Change-Id: Ia8569b5379ec8af7ad2e6dcafb2eef1fe47ab890
Gerrit-PatchSet: 6
Gerrit-Project: vdsm
Gerrit-Branch: master
Gerrit-Owner: Douglas Schilling Landgraf <dougsland(a)redhat.com&gt;
Gerrit-Reviewer: Dan Kenigsberg <danken(a)redhat.com&gt;
Gerrit-Reviewer: Douglas Schilling Landgraf <dougsland(a)redhat.com&gt;
Gerrit-Reviewer: Michael Burns <mburns(a)redhat.com&gt;

Change in vdsm[master]: BZ#815825: backup certs during registration

[Dan Kenigsberg]

Dan Kenigsberg has posted comments on this change.

Change subject: BZ#815825: backup certs during registration
......................................................................


Patch Set 5: I would prefer that you didn't submit this

(2 inline comments)

....................................................
File vdsm_reg/deployUtil.py.in
Line 1418: def _nodeBackupCerts(certs):
why are you using a dict instead of a plain list? do you need anything but the filename to
be backed up?

Line 1423:         if "cacert.pem" in certs[pemFile]:
how about something like

  dirname() + timeReplace + '_' + os.path.basename(path)

--
To view, visit http://gerrit.ovirt.org/3883
To unsubscribe, visit http://gerrit.ovirt.org/settings

Gerrit-MessageType: comment
Gerrit-Change-Id: Ia8569b5379ec8af7ad2e6dcafb2eef1fe47ab890
Gerrit-PatchSet: 5
Gerrit-Project: vdsm
Gerrit-Branch: master
Gerrit-Owner: Douglas Schilling Landgraf <dougsland(a)redhat.com&gt;
Gerrit-Reviewer: Dan Kenigsberg <danken(a)redhat.com&gt;
Gerrit-Reviewer: Douglas Schilling Landgraf <dougsland(a)redhat.com&gt;
Gerrit-Reviewer: Michael Burns <mburns(a)redhat.com&gt;

Change in vdsm[master]: BZ#815825: backup certs during registration

[Douglas Schilling Landgraf]

Douglas Schilling Landgraf has posted comments on this change.

Change subject: BZ#815825: backup certs during registration
......................................................................


Patch Set 5: Verified

--
To view, visit http://gerrit.ovirt.org/3883
To unsubscribe, visit http://gerrit.ovirt.org/settings

Gerrit-MessageType: comment
Gerrit-Change-Id: Ia8569b5379ec8af7ad2e6dcafb2eef1fe47ab890
Gerrit-PatchSet: 5
Gerrit-Project: vdsm
Gerrit-Branch: master
Gerrit-Owner: Douglas Schilling Landgraf <dougsland(a)redhat.com&gt;
Gerrit-Reviewer: Dan Kenigsberg <danken(a)redhat.com&gt;
Gerrit-Reviewer: Douglas Schilling Landgraf <dougsland(a)redhat.com&gt;
Gerrit-Reviewer: Michael Burns <mburns(a)redhat.com&gt;

Change in vdsm[master]: BZ#815825: backup certs during registration

[Douglas Schilling Landgraf]

Douglas Schilling Landgraf has posted comments on this change.

Change subject: BZ#815825: backup certs during registration
......................................................................


Patch Set 4: (2 inline comments)

....................................................
File vdsm_reg/deployUtil.py.in
Line 1418: def _nodeBackupCerts(caCert, vdsmCert):
ok, changing to dict..

Line 1427:     for pemFile in certs:
ok, changing to dict.keys()

--
To view, visit http://gerrit.ovirt.org/3883
To unsubscribe, visit http://gerrit.ovirt.org/settings

Gerrit-MessageType: comment
Gerrit-Change-Id: Ia8569b5379ec8af7ad2e6dcafb2eef1fe47ab890
Gerrit-PatchSet: 4
Gerrit-Project: vdsm
Gerrit-Branch: master
Gerrit-Owner: Douglas Schilling Landgraf <dougsland(a)redhat.com&gt;
Gerrit-Reviewer: Dan Kenigsberg <danken(a)redhat.com&gt;
Gerrit-Reviewer: Douglas Schilling Landgraf <dougsland(a)redhat.com&gt;
Gerrit-Reviewer: Michael Burns <mburns(a)redhat.com&gt;

Change in vdsm[master]: BZ#815825: backup certs during registration

[Dan Kenigsberg]

Dan Kenigsberg has posted comments on this change.

Change subject: BZ#815825: backup certs during registration
......................................................................


Patch Set 4: I would prefer that you didn't submit this

(2 inline comments)

....................................................
File vdsm_reg/deployUtil.py.in
Line 1418: def _nodeBackupCerts(caCert, vdsmCert):
I think the function would be prettier if it simply accepted a list of certs to backup.

Line 1427:     for pemFile in certs:
I find this cumbersome, relative to the simple

 for pemFile in (caCert, vdsmCert):

--
To view, visit http://gerrit.ovirt.org/3883
To unsubscribe, visit http://gerrit.ovirt.org/settings

Gerrit-MessageType: comment
Gerrit-Change-Id: Ia8569b5379ec8af7ad2e6dcafb2eef1fe47ab890
Gerrit-PatchSet: 4
Gerrit-Project: vdsm
Gerrit-Branch: master
Gerrit-Owner: Douglas Schilling Landgraf <dougsland(a)redhat.com&gt;
Gerrit-Reviewer: Dan Kenigsberg <danken(a)redhat.com&gt;
Gerrit-Reviewer: Douglas Schilling Landgraf <dougsland(a)redhat.com&gt;
Gerrit-Reviewer: Michael Burns <mburns(a)redhat.com&gt;

Change in vdsm[master]: BZ#815825: backup certs during registration

[Douglas Schilling Landgraf]

Douglas Schilling Landgraf has posted comments on this change.

Change subject: BZ#815825: backup certs during registration
......................................................................


Patch Set 4: Verified

--
To view, visit http://gerrit.ovirt.org/3883
To unsubscribe, visit http://gerrit.ovirt.org/settings

Gerrit-MessageType: comment
Gerrit-Change-Id: Ia8569b5379ec8af7ad2e6dcafb2eef1fe47ab890
Gerrit-PatchSet: 4
Gerrit-Project: vdsm
Gerrit-Branch: master
Gerrit-Owner: Douglas Schilling Landgraf <dougsland(a)redhat.com&gt;
Gerrit-Reviewer: Dan Kenigsberg <danken(a)redhat.com&gt;
Gerrit-Reviewer: Douglas Schilling Landgraf <dougsland(a)redhat.com&gt;
Gerrit-Reviewer: Michael Burns <mburns(a)redhat.com&gt;

Change in vdsm[master]: BZ#815825: backup certs during registration

[Dan Kenigsberg]

Dan Kenigsberg has posted comments on this change.

Change subject: BZ#815825: backup certs during registration
......................................................................


Patch Set 3: I would prefer that you didn't submit this

(2 inline comments)

unfortunately I do not have a better fix for this problem of booting a yet-unapproved
node, so I'm inclined to follow your lead.

....................................................
File vdsm_reg/deployUtil.py.in
Line 1419:     if isOvirt():
why check for ovirt-node-ness again?

Line 1431:         if os.path.exists(VDSMCERT):
that's practically the same code as above. function definition time...

--
To view, visit http://gerrit.ovirt.org/3883
To unsubscribe, visit http://gerrit.ovirt.org/settings

Gerrit-MessageType: comment
Gerrit-Change-Id: Ia8569b5379ec8af7ad2e6dcafb2eef1fe47ab890
Gerrit-PatchSet: 3
Gerrit-Project: vdsm
Gerrit-Branch: master
Gerrit-Owner: Douglas Schilling Landgraf <dougsland(a)redhat.com&gt;
Gerrit-Reviewer: Dan Kenigsberg <danken(a)redhat.com&gt;
Gerrit-Reviewer: Douglas Schilling Landgraf <dougsland(a)redhat.com&gt;
Gerrit-Reviewer: Michael Burns <mburns(a)redhat.com&gt;

Change in vdsm[master]: BZ#815825: backup certs during registration

[Douglas Schilling Landgraf]

Douglas Schilling Landgraf has posted comments on this change.

Change subject: BZ#815825: backup certs during registration
......................................................................


Patch Set 3: Verified

--
To view, visit http://gerrit.ovirt.org/3883
To unsubscribe, visit http://gerrit.ovirt.org/settings

Gerrit-MessageType: comment
Gerrit-Change-Id: Ia8569b5379ec8af7ad2e6dcafb2eef1fe47ab890
Gerrit-PatchSet: 3
Gerrit-Project: vdsm
Gerrit-Branch: master
Gerrit-Owner: Douglas Schilling Landgraf <dougsland(a)redhat.com&gt;
Gerrit-Reviewer: Dan Kenigsberg <danken(a)redhat.com&gt;
Gerrit-Reviewer: Douglas Schilling Landgraf <dougsland(a)redhat.com&gt;
Gerrit-Reviewer: Michael Burns <mburns(a)redhat.com&gt;

Change in vdsm[master]: BZ#815825: Do not overwrite cacert.pem

[Douglas Schilling Landgraf]

Douglas Schilling Landgraf has posted comments on this change.

Change subject: BZ#815825: Do not overwrite cacert.pem
......................................................................


Patch Set 2:

>  also, there is another caller to nodeCleanup: vdsm-> config
> -node-config. does the same problem exist 
>  there? 
Thinking twice: if we keep the current approach for nodeCleanup(), IMO we could call
_backupCaCert() inside it  and then continue doing what this function have been doing.

>  Maybe, what nodeCleanup should do is to
>  unconfigure libvirt - remove vdsm's items from
>  libvirt.conf (just a thought). 
humm, in that case we will change the oVirt Node registration workflow. The oVirt Node
calls nodeCleanup() to remove the cacert, the second step is download the new cacert from
rhev-m. If we unconfigure libvirt at this time I don't think will help (from my point
of view). What do you think?

--
To view, visit http://gerrit.ovirt.org/3883
To unsubscribe, visit http://gerrit.ovirt.org/settings

Gerrit-MessageType: comment
Gerrit-Change-Id: Ia8569b5379ec8af7ad2e6dcafb2eef1fe47ab890
Gerrit-PatchSet: 2
Gerrit-Project: vdsm
Gerrit-Branch: master
Gerrit-Owner: Douglas Schilling Landgraf <dougsland(a)redhat.com&gt;
Gerrit-Reviewer: Dan Kenigsberg <danken(a)redhat.com&gt;
Gerrit-Reviewer: Douglas Schilling Landgraf <dougsland(a)redhat.com&gt;
Gerrit-Reviewer: Michael Burns <mburns(a)redhat.com&gt;

Change in vdsm[master]: BZ#815825: Do not overwrite cacert.pem

[Douglas Schilling Landgraf]

Douglas Schilling Landgraf has posted comments on this change.

Change subject: BZ#815825: Do not overwrite cacert.pem
......................................................................


Patch Set 1: (1 inline comment)

....................................................
Commit Message
Line 11: by Engine administrator, the next reboot vdsmcert.pem  won't validate
>  This information should be written just as clearly in the commit
> message 
Agreed. 

>  noting also when in the process does nodeCleanup is called. I could
> use a
>  refresh of the registration process. 
Sorry, I didn't get this comment :(  

>  libvirtd keeps on not starting after your patch, right? what should
> the admin do
>  to amend his node? 
If admin applied just vdsm patch to backup the CA, he must replace the current CA with the
old one and start libvirtd manually.

The second option is, if admin applied both patches (in vdsm and in libvirt.upstart), he
must use like this:

# initctl reload-configuration
# initctl start libvirtd

--
To view, visit http://gerrit.ovirt.org/3883
To unsubscribe, visit http://gerrit.ovirt.org/settings

Gerrit-MessageType: comment
Gerrit-Change-Id: Ia8569b5379ec8af7ad2e6dcafb2eef1fe47ab890
Gerrit-PatchSet: 1
Gerrit-Project: vdsm
Gerrit-Branch: master
Gerrit-Owner: Douglas Schilling Landgraf <dougsland(a)redhat.com&gt;
Gerrit-Reviewer: Dan Kenigsberg <danken(a)redhat.com&gt;
Gerrit-Reviewer: Douglas Schilling Landgraf <dougsland(a)redhat.com&gt;
Gerrit-Reviewer: Michael Burns <mburns(a)redhat.com&gt;

Change in vdsm[master]: BZ#815825: Do not overwrite cacert.pem

[Dan Kenigsberg]

Dan Kenigsberg has posted comments on this change.

Change subject: BZ#815825: Do not overwrite cacert.pem
......................................................................


Patch Set 2: I would prefer that you didn't submit this

--
To view, visit http://gerrit.ovirt.org/3883
To unsubscribe, visit http://gerrit.ovirt.org/settings

Gerrit-MessageType: comment
Gerrit-Change-Id: Ia8569b5379ec8af7ad2e6dcafb2eef1fe47ab890
Gerrit-PatchSet: 2
Gerrit-Project: vdsm
Gerrit-Branch: master
Gerrit-Owner: Douglas Schilling Landgraf <dougsland(a)redhat.com&gt;
Gerrit-Reviewer: Dan Kenigsberg <danken(a)redhat.com&gt;
Gerrit-Reviewer: Douglas Schilling Landgraf <dougsland(a)redhat.com&gt;
Gerrit-Reviewer: Michael Burns <mburns(a)redhat.com&gt;

Change in vdsm[master]: BZ#815825: Do not overwrite cacert.pem

[Dan Kenigsberg]

Dan Kenigsberg has posted comments on this change.

Change subject: BZ#815825: Do not overwrite cacert.pem
......................................................................


Patch Set 2:

also, there is another caller to nodeCleanup: vdsm-config -node-config. does the same
problem exist there?

Maybe, what nodeCleanup should do is to unconfigure libvirt - remove vdsm's items from
libvirt.conf (just a thought).

--
To view, visit http://gerrit.ovirt.org/3883
To unsubscribe, visit http://gerrit.ovirt.org/settings

Gerrit-MessageType: comment
Gerrit-Change-Id: Ia8569b5379ec8af7ad2e6dcafb2eef1fe47ab890
Gerrit-PatchSet: 2
Gerrit-Project: vdsm
Gerrit-Branch: master
Gerrit-Owner: Douglas Schilling Landgraf <dougsland(a)redhat.com&gt;
Gerrit-Reviewer: Dan Kenigsberg <danken(a)redhat.com&gt;
Gerrit-Reviewer: Douglas Schilling Landgraf <dougsland(a)redhat.com&gt;
Gerrit-Reviewer: Michael Burns <mburns(a)redhat.com&gt;

Change in vdsm[master]: BZ#815825: Do not overwrite cacert.pem

[Dan Kenigsberg]

Dan Kenigsberg has posted comments on this change.

Change subject: BZ#815825: Do not overwrite cacert.pem
......................................................................


Patch Set 1: (1 inline comment)

....................................................
Commit Message
Line 11: by Engine administrator, the next reboot vdsmcert.pem  won't validate
This information should be written just as clearly in the commit message, noting also when
in the process does nodeCleanup is called. I could use a refresh of the registration
process.

libvirtd keeps on not starting after your patch, right? what should the admin do to amend
his node?

--
To view, visit http://gerrit.ovirt.org/3883
To unsubscribe, visit http://gerrit.ovirt.org/settings

Gerrit-MessageType: comment
Gerrit-Change-Id: Ia8569b5379ec8af7ad2e6dcafb2eef1fe47ab890
Gerrit-PatchSet: 1
Gerrit-Project: vdsm
Gerrit-Branch: master
Gerrit-Owner: Douglas Schilling Landgraf <dougsland(a)redhat.com&gt;
Gerrit-Reviewer: Dan Kenigsberg <danken(a)redhat.com&gt;
Gerrit-Reviewer: Douglas Schilling Landgraf <dougsland(a)redhat.com&gt;
Gerrit-Reviewer: Michael Burns <mburns(a)redhat.com&gt;

Change in vdsm[master]: BZ#815825: Do not overwrite cacert.pem

[Douglas Schilling Landgraf]

Douglas Schilling Landgraf has posted comments on this change.

Change subject: BZ#815825: Do not overwrite cacert.pem
......................................................................


Patch Set 2: Verified

--
To view, visit http://gerrit.ovirt.org/3883
To unsubscribe, visit http://gerrit.ovirt.org/settings

Gerrit-MessageType: comment
Gerrit-Change-Id: Ia8569b5379ec8af7ad2e6dcafb2eef1fe47ab890
Gerrit-PatchSet: 2
Gerrit-Project: vdsm
Gerrit-Branch: master
Gerrit-Owner: Douglas Schilling Landgraf <dougsland(a)redhat.com&gt;
Gerrit-Reviewer: Dan Kenigsberg <danken(a)redhat.com&gt;
Gerrit-Reviewer: Douglas Schilling Landgraf <dougsland(a)redhat.com&gt;
Gerrit-Reviewer: Michael Burns <mburns(a)redhat.com&gt;

[Douglas Schilling Landgraf]

Douglas Schilling Landgraf has posted comments on this change.

Change subject: BZ#815825: deployUtil Do not overwrite cacert.pem
......................................................................


Patch Set 1: (2 inline comments)

....................................................
Commit Message
Line 11: by Engine administrator, the next reboot vdsmcert.pem  won't validate
It's only backup. The patch that handle which cert to use during the initialization 
is here: http://gerrit.ovirt.org/#change,3885

The sequence is:

1) Install RHEV-H
2) Open TUI
3) Configure Network
4) Register Engine and *do not* approve the oVirt Node on oVirt Engine
5) reboot oVirt Node

Next reboot libvirt won't start.

....................................................
File vdsm_reg/deployUtil.py.in
Line 1422:             dt = datetime.datetime.now()
OK

--
To view, visit http://gerrit.ovirt.org/3883
To unsubscribe, visit http://gerrit.ovirt.org/settings

Gerrit-MessageType: comment
Gerrit-Change-Id: Ia8569b5379ec8af7ad2e6dcafb2eef1fe47ab890
Gerrit-PatchSet: 1
Gerrit-Project: vdsm
Gerrit-Branch: master
Gerrit-Owner: Douglas Schilling Landgraf <dougsland(a)redhat.com&gt;
Gerrit-Reviewer: Dan Kenigsberg <danken(a)redhat.com&gt;
Gerrit-Reviewer: Douglas Schilling Landgraf <dougsland(a)redhat.com&gt;
Gerrit-Reviewer: Michael Burns <mburns(a)redhat.com&gt;

[Dan Kenigsberg]

Dan Kenigsberg has posted comments on this change.

Change subject: BZ#815825: deployUtil Do not overwrite cacert.pem
......................................................................


Patch Set 1: I would prefer that you didn't submit this

(2 inline comments)

....................................................
Commit Message
Line 11: by Engine administrator, the next reboot vdsmcert.pem  won't validate
your use of the future tense confuses me. could you detail the failing sequence?
Does it fix it, or only allow the admin to recover the old cacert somehow?

....................................................
File vdsm_reg/deployUtil.py.in
Line 1422:             dt = datetime.datetime.now()
you new code can be better encapsulated in a "backup" function.

--
To view, visit http://gerrit.ovirt.org/3883
To unsubscribe, visit http://gerrit.ovirt.org/settings

Gerrit-MessageType: comment
Gerrit-Change-Id: Ia8569b5379ec8af7ad2e6dcafb2eef1fe47ab890
Gerrit-PatchSet: 1
Gerrit-Project: vdsm
Gerrit-Branch: master
Gerrit-Owner: Douglas Schilling Landgraf <dougsland(a)redhat.com&gt;
Gerrit-Reviewer: Dan Kenigsberg <danken(a)redhat.com&gt;
Gerrit-Reviewer: Douglas Schilling Landgraf <dougsland(a)redhat.com&gt;
Gerrit-Reviewer: Michael Burns <mburns(a)redhat.com&gt;

[Douglas Schilling Landgraf]

Douglas Schilling Landgraf has posted comments on this change.

Change subject: BZ#815825: deployUtil Do not overwrite cacert.pem
......................................................................


Patch Set 1: Verified

--
To view, visit http://gerrit.ovirt.org/3883
To unsubscribe, visit http://gerrit.ovirt.org/settings

Gerrit-MessageType: comment
Gerrit-Change-Id: Ia8569b5379ec8af7ad2e6dcafb2eef1fe47ab890
Gerrit-PatchSet: 1
Gerrit-Project: vdsm
Gerrit-Branch: master
Gerrit-Owner: Douglas Schilling Landgraf <dougsland(a)redhat.com&gt;
Gerrit-Reviewer: Dan Kenigsberg <danken(a)redhat.com&gt;
Gerrit-Reviewer: Douglas Schilling Landgraf <dougsland(a)redhat.com&gt;
Gerrit-Reviewer: Michael Burns <mburns(a)redhat.com&gt;