Chapter 8. Upgrading the Self-Hosted Engine

Procedure

1. Log in to one of the self-hosted engine nodes and enable global maintenance mode:

   # hosted-engine --set-maintenance --mode=global

2. Confirm that the environment is in maintenance mode before proceeding:

   # hosted-engine --vm-status

Procedure

1. On the Red Hat Virtualization Manager machine, check if updated packages are available:

   # engine-upgrade-check

2. Update the setup packages:

   # yum update rhevm-setup

3. Update the Red Hat Virtualization Manager. The engine-setup script prompts you with some configuration questions, then stops the ovirt-engine service, downloads and installs the updated packages, backs up and updates the database, performs post-installation configuration, and starts the ovirt-engine service.

   # engine-setup

   Note

   The engine-setup script is also used during the Red Hat Virtualization Manager installation process, and it stores the configuration values supplied. During an update, the stored values are displayed when previewing the configuration, and may not be up to date if engine-config was used to update configuration after installation. For example, if engine-config was used to update SANWipeAfterDelete to true after installation, engine-setup will output "Default SAN wipe after delete: False" in the configuration preview. However, the updated values will not be overwritten by engine-setup.

   Important

   The update process may take some time; allow time for the update process to complete and do not stop the process once initiated.

4. Update the base operating system and any optional packages installed on the Manager:

   # yum update

   Important

   If any kernel packages were updated, reboot the host to complete the update.

Procedure

1. On the host that is currently set as SPM and contains the Manager virtual machine, enable the required repository for Red Hat Virtualization 4.0:

   # subscription-manager repos --enable=rhel-7-server-rhv-4-mgmt-agent-rpms

2. Migrate all virtual machines except the Manager virtual machine to alternate hosts.

3. On the host, update the Manager virtual machine packages:

   # yum update ovirt-hosted-engine-setup rhevm-appliance

   If the rhevm-appliance package is missing, install it manually before updating ovirt-hosted-engine-setup.

   # yum install rhevm-appliance
   # yum update ovirt-hosted-engine-setup

4. Run the upgrade utility to upgrade the Manager virtual machine. If not already installed, install the screen package, which is available in the standard Red Hat Enterprise Linux repository:

   # yum install screen
   # screen
   # hosted-engine --upgrade-appliance

   You will be prompted to select the appliance if more than one is detected, and to create a backup of the Manager database and provide its full location.

Procedure

1. Enable the Red Hat Virtualization 4.1 repositories:

   # subscription-manager repos \
       --enable=rhel-7-server-rhv-4.1-rpms \
       --enable=rhel-7-server-rhv-4-tools-rpms \
       --enable=jb-eap-7.1-for-rhel-7-server-rpms

   All other repositories remain the same across Red Hat Virtualization releases.

2. Update the setup packages:

   # yum update ovirt\*setup\*

3. Run engine-setup and follow the prompts to upgrade the Red Hat Virtualization Manager:

   # engine-setup

4. Disable the Red Hat Virtualization 4.0 repositories to ensure the system does not use any 4.0 packages:

   # subscription-manager repos \
       --disable=rhel-7-server-rhv-4.0-rpms \
       --disable=jb-eap-7-for-rhel-7-server-rpms \
       --disable=jb-eap-7.0-for-rhel-7-server-rpms

5. Update the base operating system:

   # yum update

6. Reboot the machine.

Procedure

1. Enable the Red Hat Virtualization 4.2 repositories:

   # subscription-manager repos \
       --enable=rhel-7-server-rhv-4.2-manager-rpms \
       --enable=rhel-7-server-rhv-4-manager-tools-rpms \
       --enable=jb-eap-7-for-rhel-7-server-rpms \
       --enable=rhel-7-server-ansible-2.9-rpms

   All other repositories remain the same across Red Hat Virtualization releases.

2. Update the setup packages:

   # yum update ovirt\*setup\*

3. Run engine-setup and follow the prompts to upgrade the Red Hat Virtualization Manager:

   # engine-setup

   Note

   If you changed the default trust keystore password, you might get a keystore certificate error. If so, update the configuration to reflect the correct password. For more information, see RHV 4.2 - Failed to import provider certificate into the external provider keystore

4. Disable the Red Hat Virtualization 4.1 repositories to ensure the system does not use any 4.1 packages:

   # subscription-manager repos \
       --disable=rhel-7-server-rhv-4.1-rpms \
       --disable=rhel-7-server-rhv-4.1-manager-rpms \
       --disable=rhel-7-server-rhv-4-tools-rpms \
       --disable=jb-eap-7.0-for-rhel-7-server-rpms \
       --disable=jb-eap-7.1-for-rhel-7-server-rpms

5. Update the base operating system:

   # yum update

6. Reboot the machine.

Procedure

1. Log in to one of the self-hosted engine nodes and disable global maintenance mode:

   # hosted-engine --set-maintenance --mode=none

2. Confirm that the environment is running:

   # hosted-engine --vm-status

Procedure

1. If your Red Hat Enterprise Linux hosts are locked to version 7.3, as described in https://access.redhat.com/solutions/3194482, set them to the general RHEL 7 version before updating (to view the version number, type subscription-manager release --show):

   # subscription-manager release --set=7Server

2. Disable your current repositories:

   # subscription-manager repos --disable='*'

3. Ensure that the correct repositories are enabled (to view a list of currently enabled repositories, type yum repolist):

   • For Red Hat Virtualization Hosts:

     # subscription-manager repos --enable=rhel-7-server-rhvh-4-rpms

   • For Red Hat Enterprise Linux hosts:

     # subscription-manager repos \
         --enable=rhel-7-server-rpms \
         --enable=rhel-7-server-rhv-4-mgmt-agent-rpms \
         --enable=rhel-7-server-ansible-2.9-rpms

4. In the Administration Portal, click Compute Hosts and select the host to be updated.

5. Click Installation Check for Upgrade and click OK.

   Click the Events and alerts notification icon ( ) and expand the Events section to see the result.

6. If an update is available, click Installation Upgrade.

7. Click OK to update the host. Running virtual machines will be migrated according to their migration policy. If migration is disabled for any virtual machines, you will be prompted to shut them down.

   The details of the host are updated in Compute Hosts and the status transitions through these stages:

   • Maintenance
   • Installing
   • Reboot

   • Up

     If any virtual machines were migrated off the host, they are now migrated back.

     Note

     If the update fails, the host’s status changes to Install Failed. From Install Failed you can click Installation Upgrade again.

Procedure

1. Click Compute Clusters and select the cluster to change.
2. Click Edit.
3. Change the Compatibility Version to the desired value.
4. Click OK to open the Change Cluster Compatibility Version confirmation window.
5. Click OK to confirm.

Procedure

1. Click Compute Data Centers and select the data center to change.
2. Click Edit.
3. Change the Compatibility Version to the desired value.
4. Click OK to open the Change Data Center Compatibility Version confirmation window.
5. Click OK to confirm.

1. Log in to the Manager machine as the root user.

2. Check whether /etc/pki/ovirt-engine/openssl.conf includes the line default_md = sha256:

   # cat /etc/pki/ovirt-engine/openssl.conf

   If it still includes default_md = sha1, back up the existing configuration and change the default to sha256:

   # cp -p /etc/pki/ovirt-engine/openssl.conf /etc/pki/ovirt-engine/openssl.conf."$(date +"%Y%m%d%H%M%S")"
   # sed -i 's/^default_md = sha1/default_md = sha256/' /etc/pki/ovirt-engine/openssl.conf

3. Define the certificate that should be re-signed:

   # names="apache"

4. Log in to one of the self-hosted engine nodes and enable global maintenance:

   # hosted-engine --set-maintenance --mode=global

5. On the Manager, re-sign the Apache certificate:

   for name in $names; do
       subject="$(
           openssl \
               x509 \
               -in /etc/pki/ovirt-engine/certs/"${name}".cer \
               -noout \
               -subject \
           | sed \
               's;subject= \(.*\);\1;' \
       )"
      /usr/share/ovirt-engine/bin/pki-enroll-pkcs12.sh \
           --name="${name}" \
           --password=mypass \
           --subject="${subject}" \
           --keep-key
   done

6. Restart the httpd service:

   # systemctl restart httpd

7. Log in to one of the self-hosted engine nodes and disable global maintenance:

   # hosted-engine --set-maintenance --mode=none

8. Connect to the Administration Portal to confirm that the warning no longer appears.
9. If you previously imported a CA or https certificate into the browser, find the certificate(s), remove them from the browser, and reimport the new CA certificate. Install the certificate authority according to the instructions provided by your browser. To get the certificate authority’s certificate, navigate to http://your-manager-fqdn/ovirt-engine/services/pki-resource?resource=ca-certificate&format=X509-PEM-CA, replacing your-manager-fqdn with the fully qualified domain name (FQDN).

1. Log in to the Manager machine as the root user.

2. Check whether /etc/pki/ovirt-engine/openssl.conf includes the line default_md = sha256:

   # cat /etc/pki/ovirt-engine/openssl.conf

   If it still includes default_md = sha1, back up the existing configuration and change the default to sha256:

   # cp -p /etc/pki/ovirt-engine/openssl.conf /etc/pki/ovirt-engine/openssl.conf."$(date +"%Y%m%d%H%M%S")"
   # sed -i 's/^default_md = sha1/default_md = sha256/' /etc/pki/ovirt-engine/openssl.conf

3. Re-sign the CA certificate by backing it up and creating a new certificate in ca.pem.new:

   # cp -p /etc/pki/ovirt-engine/private/ca.pem /etc/pki/ovirt-engine/private/ca.pem."$(date +"%Y%m%d%H%M%S")"
   # openssl x509 -signkey /etc/pki/ovirt-engine/private/ca.pem -in /etc/pki/ovirt-engine/ca.pem -out /etc/pki/ovirt-engine/ca.pem.new -days 3650 -sha256

4. Replace the existing certificate with the new certificate:

   # mv /etc/pki/ovirt-engine/ca.pem.new /etc/pki/ovirt-engine/ca.pem

5. Define the certificates that should be re-signed:

   # names="engine apache websocket-proxy jboss imageio-proxy"

   If you replaced the Red Hat Virtualization Manager SSL Certificate after the upgrade, run the following instead:

   # names="engine websocket-proxy jboss imageio-proxy"

   For more details see Replacing the Red Hat Virtualization Manager SSL Certificate in the Administration Guide.

6. Log in to one of the self-hosted engine nodes and enable global maintenance:

   # hosted-engine --set-maintenance --mode=global

7. On the Manager, re-sign the certificates:

   for name in $names; do
      subject="$(
           openssl \
               x509 \
               -in /etc/pki/ovirt-engine/certs/"${name}".cer \
               -noout \
               -subject \
           | sed \
               's;subject= \(.*\);\1;' \
           )"
        /usr/share/ovirt-engine/bin/pki-enroll-pkcs12.sh \
               --name="${name}" \
               --password=mypass \
               --subject="${subject}" \
               --keep-key
   done

8. Restart the following services:

   # systemctl restart httpd
   # systemctl restart ovirt-engine
   # systemctl restart ovirt-websocket-proxy
   # systemctl restart ovirt-imageio-proxy

9. Log in to one of the self-hosted engine nodes and disable global maintenance:

   # hosted-engine --set-maintenance --mode=none

10. Connect to the Administration Portal to confirm that the warning no longer appears.
11. If you previously imported a CA or https certificate into the browser, find the certificate(s), remove them from the browser, and reimport the new CA certificate. Install the certificate authority according to the instructions provided by your browser. To get the certificate authority’s certificate, navigate to http://your-manager-fqdn/ovirt-engine/services/pki-resource?resource=ca-certificate&format=X509-PEM-CA, replacing your-manager-fqdn with the fully qualified domain name (FQDN).

12. Enroll the certificates on the hosts. Repeat the following procedure for each host.

    1. In the Administration Portal, click Compute Hosts.
    2. Select the host and click Management Maintenance.
    3. Once the host is in maintenance mode, click Installation Enroll Certificate.
    4. Click Management Activate.