Procedure 2.1. Updating Red Hat Virtualization Manager

1. On the Red Hat Virtualization Manager machine, check if updated packages are available:

   # engine-upgrade-check

2. • If there are no updates are available, the command will output the text No upgrade:

     # engine-upgrade-check
     VERB: queue package ovirt-engine-setup for update
     VERB: package ovirt-engine-setup queued
     VERB: Building transaction
     VERB: Empty transaction
     VERB: Transaction Summary:
     No upgrade

     Note

     If updates are expected, but not available, ensure that the required repositories are enabled. See Subscribing to the Required Entitlements in the Installation Guide.
   • If updates are available, the command will list the packages to be updated:

     # engine-upgrade-check
     VERB: queue package ovirt-engine-setup for update
     VERB: package ovirt-engine-setup queued
     VERB: Building transaction
     VERB: Transaction built
     VERB: Transaction Summary:
     VERB:     updated    - ovirt-engine-lib-3.3.2-0.50.el6ev.noarch
     VERB:     update     - ovirt-engine-lib-3.4.0-0.13.el6ev.noarch
     VERB:     updated    - ovirt-engine-setup-3.3.2-0.50.el6ev.noarch
     VERB:     update     - ovirt-engine-setup-3.4.0-0.13.el6ev.noarch
     VERB:     install    - ovirt-engine-setup-base-3.4.0-0.13.el6ev.noarch
     VERB:     install    - ovirt-engine-setup-plugin-ovirt-engine-3.4.0-0.13.el6ev.noarch
     VERB:     updated    - ovirt-engine-setup-plugins-3.3.1-1.el6ev.noarch
     VERB:     update     - ovirt-engine-setup-plugins-3.4.0-0.5.el6ev.noarch
     Upgrade available
     
     Upgrade available

3. Update the setup packages:

   # yum update ovirt\*setup\*

4. Update the Red Hat Virtualization Manager. By running engine-setup, the script will prompt you with some configuration questions like updating the firewall rules, updating PKI certificates, and backing up the Data Warehouse database. The script will then go through the process of stopping the ovirt-engine service, downloading and installing the updated packages, backing up and updating the database, performing post-installation configuration, and starting the ovirt-engine service.

   Note

   The engine-setup script is also used during the Red Hat Virtualization Manager installation process, and it stores the configuration values that were supplied. During an update, the stored values are displayed when previewing the configuration, and may not be up to date if engine-config was used to update configuration after installation. For example, if engine-config was used to update SANWipeAfterDelete to true after installation, engine-setup will output "Default SAN wipe after delete: False" in the configuration preview. However, the updated values will not be overwritten by engine-setup.

   # engine-setup

   Important

   The update process may take some time; allow time for the update process to complete and do not stop the process once initiated.
5. Update the base operating system and any optional packages installed on the Manager:

   # yum update

   Important

   If any kernel packages were updated, reboot the system to complete the update.

Procedure 2.2. Updating Red Hat Enterprise Linux hosts and Red Hat Virtualization Host

1. Click the Hosts tab and select the host to be updated.
   • If the host requires updating, an alert message under Action Items and an icon next to the host's name indicate that a new version is available.
   • If the host does not require updating, no alert message or icon is displayed and no further action is required.
2. Click Installation → Check for Upgrade to open the Upgrade Host confirmation window.
3. Click OK to begin the upgrade check.
4. If you want to upgrade the host, click Installation → Upgrade to open the Upgrade Host confirmation window.
5. Click OK to update the host. The details of the host are updated in the Hosts tab, and the status will transition through these stages:

   • Maintenance
   • Installing
   • Up

Procedure 2.3. Manually Updating Hosts

1. From the Administration Portal, click the Hosts tab and select the host to be updated.
2. Click Management → Maintenance to place the host into maintenance mode.
3. • On a Red Hat Enterprise Linux host, log in to the host machine and run the following command:

     # yum update

   • On a Red Hat Virtualization Host, log in to the Cockpit user interface, click Terminal, and run the following command:

     # yum update

4. Restart the host to ensure all updates are correctly applied.

   Note

   Check the imgbased logs to see if any additional package updates have failed for a Red Hat Virtualization Host. If some packages were not successfully reinstalled after the update, check that the packages are listed in /var/imgbased/persisted-rpms. Add any missing packages then run rpm -Uvh /var/imgbased/persisted-rpms/*.

Procedure 2.4. Removing NIST-800 Partitions

1. Back up the logs located in /var/log and /var/log/audit.
2. Remove the following logical volumes manually:
   • /tmp
   • /home
   • /var
   • /var/log/audit. The lvm lvs command may show this logical volume as rhvh_var_log_audit .
   See Removing Logical Volumes in the Logical Volume Manager Administration for details.

Procedure 3.1. Upgrading to Red Hat Virtualization Manager 4.1

1. Enable the Red Hat Virtualization Manager 4.1 and Red Hat Virtualization Tools repositories:

   # subscription-manager repos --enable=rhel-7-server-rhv-4.1-rpms \
       --enable=rhel-7-server-rhv-4-tools-rpms \
       --enable=jb-eap-7.1-for-rhel-7-server-rpms
   

2. Update the setup packages:

   # yum update ovirt\*setup\*

3. Run the following command and follow the prompts to upgrade the Red Hat Virtualization Manager:

   # engine-setup

4. Remove or disable the Red Hat Virtualization Manager 4.0 repository to ensure the system does not use any Red Hat Virtualization Manager 4.0 packages:

   # subscription-manager repos --disable=rhel-7-server-rhv-4.0-rpms --enable=jb-eap-7.0-for-rhel-7-server-rpms
   

5. Update the base operating system:

   # yum update

   Important

   If any kernel packages were updated, reboot the system to complete the update.

Procedure 4.1. Changing the Cluster Compatibility Version

1. From the Administration Portal, click the Clusters tab.
2. Select the cluster to change from the list displayed.
3. Click Edit.
4. Change the Compatibility Version to the desired value.
5. Click OK to open the Change Cluster Compatibility Version confirmation window.
6. Click OK to confirm.

   Important

   An error message may warn that some virtual machines and templates are incorrectly configured. To fix this error, edit each virtual machine manually. The Edit Virtual Machine window provides additional validations and warnings that show what to correct. Sometimes the issue is automatically corrected and the virtual machine's configuration just needs to be saved again. After editing each virtual machine, you will be able to change the cluster compatibility version.

Procedure 4.2. Changing the Data Center Compatibility Version

1. From the Administration Portal, click the Data Centers tab.
2. Select the data center to change from the list displayed.
3. Click Edit.
4. Change the Compatibility Version to the desired value.
5. Click OK to open the Change Data Center Compatibility Version confirmation window.
6. Click OK to confirm.

Procedure 4.3. Preventing Warning Messages from Appearing in the Browser

1. Log in to the Manager machine as the root user.
2. Check whether /etc/pki/ovirt-engine/openssl.conf includes the line default_md = sha256:

   # cat /etc/pki/ovirt-engine/openssl.conf

   If it still includes default_md = sha1, back up the existing configuration and change the default to sha256:

   # cp -p /etc/pki/ovirt-engine/openssl.conf /etc/pki/ovirt-engine/openssl.conf."$(date +"%Y%m%d%H%M%S")"
   # sed -i 's/^default_md = sha1/default_md = sha256/' /etc/pki/ovirt-engine/openssl.conf
   

3. Define the certificate that should be re-signed:

   # names="apache"

4. For self-hosted engine environments, log in to one of the self-hosted engine nodes and enable global maintenance:

   # hosted-engine --set-maintenance --mode=global
   

5. On the Manager, re-sign the Apache certificate:

   for name in $names; do
       subject="$(
           openssl \
               x509 \
               -in /etc/pki/ovirt-engine/certs/"${name}".cer \
               -noout \
               -subject \
           | sed \
               's;subject= \(.*\);\1;' \
       )"
      /usr/share/ovirt-engine/bin/pki-enroll-pkcs12.sh \
           --name="${name}" \
           --password=mypass \
           --subject="${subject}" \
           --keep-key 
   done
   

6. Restart the httpd service:

   # systemctl restart httpd
   

7. For self-hosted engine environments, log in to one of the self-hosted engine nodes and disable global maintenance:

   # hosted-engine --set-maintenance --mode=none
   

8. Connect to the Administration Portal to confirm that the warning no longer appears.
9. If you previously imported a CA or https certificate into the browser, find the certificate(s), remove them from the browser, and reimport the new CA certificate. Install the certificate authority according to the instructions provided by your browser. To get the certificate authority's certificate, navigate to http://your-manager-fqdn/ovirt-engine/services/pki-resource?resource=ca-certificate&format=X509-PEM-CA, replacing your-manager-fqdn with the fully qualified domain name (FQDN).

Procedure 4.4. Replacing All Signed Certificates with SHA-256

1. Log in to the Manager machine as the root user.
2. Check whether /etc/pki/ovirt-engine/openssl.conf includes the line default_md = sha256:

   # cat /etc/pki/ovirt-engine/openssl.conf

   If it still includes default_md = sha1, back up the existing configuration and change the default to sha256:

   # cp -p /etc/pki/ovirt-engine/openssl.conf /etc/pki/ovirt-engine/openssl.conf."$(date +"%Y%m%d%H%M%S")"
   # sed -i 's/^default_md = sha1/default_md = sha256/' /etc/pki/ovirt-engine/openssl.conf
   

3. Re-sign the CA certificate by backing it up and creating a new certificate in ca.pem.new:

   # cp -p /etc/pki/ovirt-engine/private/ca.pem /etc/pki/ovirt-engine/private/ca.pem."$(date +"%Y%m%d%H%M%S")"
   # openssl x509 -signkey /etc/pki/ovirt-engine/private/ca.pem -in /etc/pki/ovirt-engine/ca.pem -out /etc/pki/ovirt-engine/ca.pem.new -days 3650 -sha256

4. Replace the existing certificate with the new certificate:

   # mv /etc/pki/ovirt-engine/ca.pem.new /etc/pki/ovirt-engine/ca.pem

5. Define the certificates that should be re-signed:

   # names="engine apache websocket-proxy jboss imageio-proxy"
   

   If you replaced the Red Hat Virtualization Manager SSL Certificate after the upgrade, run the following instead:

   # names="engine websocket-proxy jboss imageio-proxy"
   

   For more details see Replacing the Red Hat Virtualization Manager SSL Certificate in the Administration Guide.
6. For self-hosted engine environments, log in to one of the self-hosted engine nodes and enable global maintenance:

   # hosted-engine --set-maintenance --mode=global
   

7. On the Manager, re-sign the certificates:

   for name in $names; do
      subject="$(
           openssl \
               x509 \
               -in /etc/pki/ovirt-engine/certs/"${name}".cer \
               -noout \
               -subject \
           | sed \
               's;subject= \(.*\);\1;' \
           )"
        /usr/share/ovirt-engine/bin/pki-enroll-pkcs12.sh \
               --name="${name}" \
               --password=mypass \
               --subject="${subject}" \
               --keep-key 
   done
   

8. Restart the following services:

   # systemctl restart httpd
   # systemctl restart ovirt-engine
   # systemctl restart ovirt-websocket-proxy
   # systemctl restart ovirt-imageio-proxy
   

9. For self-hosted engine environments, log in to one of the self-hosted engine nodes and disable global maintenance:

   # hosted-engine --set-maintenance --mode=none
   

10. Connect to the Administration Portal to confirm that the warning no longer appears.
11. If you previously imported a CA or https certificate into the browser, find the certificate(s), remove them from the browser, and reimport the new CA certificate. Install the certificate authority according to the instructions provided by your browser. To get the certificate authority's certificate, navigate to http://your-manager-fqdn/ovirt-engine/services/pki-resource?resource=ca-certificate&format=X509-PEM-CA, replacing your-manager-fqdn with the fully qualified domain name (FQDN).
12. Enroll the certificates on the hosts. Repeat the following procedure for each host.
    1. In the Administration Portal, click the Hosts tab.
    2. Select the host, and click Management → Maintenance.
    3. Once the host is in maintenance mode, click Installation → Enroll Certificate.
    4. Click Management → Activate.