Download as PDF, PPTX
Uploaded byDouglas Landgraf
oVirt 4.3 highlights
The presentation highlights version 4.3 of oVirt, emphasizing improvements in Python 3 support, enhanced Windows guest tools, and tightened security measures such as the removal of insecure TLS protocols. Key features include updated integrations with Cinder for block storage, better VM management dashboards, and the introduction of new deployment options such as support for IPv6. The presentation also notes deprecated functionalities along with guidelines for upgrading environments safely.
oVirt 4.3 highlights
- 1. oVirt 4.3 Highlights DouglasSchilling Landgraf <dougsland@redhat.com> oVirt/RHV Engineer 05/2019 - Red Hat Summit This presentation is licensed under a Creative Commons Attribution 4.0 International License
- 2. 3 Quick recap aboutoVirt What is oVirt ? Why oVirt?
- 3. 3 Quick recap aboutoVirt
- 4. 3 Quick recap aboutoVirt Which platforms are supported?
- 5. 3 Quick recap aboutoVirt
- 6. 3 Quick recap aboutoVirt
- 7. 3 Quick recap aboutoVirt Also available a Hypervisor ISO, oVirt Node
- 8.
- 9. 3 General: Python3 -improved support ● engine-setup ● otopi ● ovirt-engine-lib ● ovirt-host-deploy ● ovirt-log-collector ● ovirt-engine-dwh
- 10. 3 VM Portal -New dashboard and forms
- 11. 3 VM Portal -New dashboard and forms
- 12. 3 Added new CPUType
- 13. 3 Hosted Engine ● Supportdeployment with static IPv6 ● Deploy with Ansible Roles ● Iptables is not required anymore for deployments ● --restore-from-file option to restore the Manager backup during the deployment
- 14. 3 oVirt Engine ● Replacedfluentd with rsyslog ● Fully support to IPV6 ● Improved v2v feature ● Support to Keycloak Project/Red Hat Single Sign One
- 15. 3 oVirt Engine -Update the Cluster
- 16.
- 17. 3 Cinderlib - CinderBlock Storage ● Better integration with cinderlib ● Users are able to consume any storage backend supported in Cinder in order to create virtual disks for its VMs, without the need of a full OpenStack deployment. ● Use any storage vendor supported in Cinder (over 80 storage drivers) # engine-config -s ManagedBlockDomainSupported=true Please select a version: 1. 4.1 2. 4.2 3. 4.3 3 # systemctl restart ovirt-engine.service
- 18. 3 Cinderlib - CinderBlock Storage
- 19. 3 Database and Ansibleupdated ● PostgreSQL 10 is now supported ● Ansible requirement now is 2.7.2+ ○ python2.6 deprecated, now support python3 (host still requires python2)
- 20. 3 oVirt Windows GuestTools ● Add qemufwcfg driver in windows guest tools Prevents Windows Device Manager to display the device as unrecognized. ● Added smbus driver in windows guest tools When a guest running Windows 2008 with Q35 bios an unknown device is listed in Device Manager.
- 21. 3 Security - TransportLayer Security ● Removed support to insecure TLSv1 and TLSv1.1 and leave only most secure TLSv1.2 ● Enable TLSv1.2 or higher (vdsm - engine) $ openssl s_client -connect localhost:54321 -tls1 -CAfile /etc/pki/vdsm/certs/cacert.pem or $ openssl s_client -connect localhost:54321 -tls1_1 -CAfile /etc/pki/vdsm/certs/cacert.pem CONNECTED(00000003) write:errno=104 --- no peer certificate available
- 22. 3 Security - TransportLayer Security $ openssl s_client -connect localhost.localdomain:54321 -tls1_2 -CAfile /etc/pki/vdsm/certs/cacert.pem CONNECTED(00000003) …. --- Server certificate -----BEGIN CERTIFICATE----- MIIEUDCCAzigAwIBAgICEA0wDQYJKoZIhvcNAQELBQAwRjELMAkGA1UEBhMCVVMx FDASBgNVBAoMC2xvY2FsZG9tYWluMSEwHwYDVQQDDBhlbmdpbmUubG9jYWxkb21h aW4uOTMxNjcwHhcNMTkwNDIxMTYxNTIwWhcNMjQwNDIwMTYxNTIwWjAyMRQwEgYD …..
- 23. 3 Security - OpenSCAPand STIGs ● Added OpenSCAP tools into oVirt-Node “The OpenSCAP ecosystem provides multiple tools to assist administrators and auditors with assessment, measurement, and enforcement of security baselines.” https://www.open-scap.org/ ● oVirt Engine Appliance meet Security Technical Implementation Guides standards.
- 24. 3 Security - SecureHash Algorithm ● engine-backup now support SHA256 (required by FIPS mode) $ tar xvf /var/lib/ovirt-engine-backup/ovirt-engine-backup-20190424154138.backup $ cat ./sha256sum c746505ab9eee105b59e0354d226974954e4218ab9c2e455b40156e05c036927 db/engine_backup.db 8b72cffd6773a6f40cd20654a4e48bd0509bac1169e7ef05ad099aafdf6e1039 db/dwh_backup.db 00c7c19df07fad786cbfed308a9ff2ddb793ed714b9f1c6267041f1296bfa8fa files 8db64ff64f529a47b944b4dd96f2eda3f540137609e359d784210280e44085c0 version 6e7135e172b14539ad9aee8a4316a3c240ec20280fa39613d1a9513e39793870 os_version 4389da2b2c4927e7aaa457c7f1549d5b23616c96a13da1075032c52022b1b01f config Federal Information Processing Standard (FIPS) is a computer security standard, developed by the U.S. Government and industry working group to validate the quality of cryptographic modules.
- 25. 3 Dropped Functionality ● Dropped3.6 and 4.0 datacenter/cluster level
- 26. 3 Dropped Functionality ● DroppedConroe and Penryn CPU Types from Compatibility Version 4.3
- 27. 3 Dropped Functionality ● Removedsupport to API v3 ● Dropped ovirt-engine-cli (ovirt-shell) dependency (used version 3 REST API) ● Disks scan alignment
- 28. 3 Upgrading your environment? ●Use engine-backup tool to create a backup before upgrades! ;-) ● Engine upgrades are incremental ● Environment must be in 4.1 datacenter/cluster before upgrading to 4.3
- 29. Thank you! https://ovirt.org/ users@ovirt.org dougsland@redhat.com https://www.meetup.com/Boston-oVirt-Community/ @ovirt@dougsland This presentation is licensed under a Creative Commons Attribution 4.0 International License