Language:
Format:

Red Hat Training

A Red Hat training course is available for Red Hat Virtualization

8.3. Upgrading a Self-Hosted Engine from 4.1 to Red Hat Virtualization 4.2

Upgrading a self-hosted engine environment from version 4.1 to 4.2 involves the following steps:

Place the environment in global maintenance mode
Update the 4.1 Manager to the latest version of 4.1
Upgrade the Manager from 4.1 to 4.2
Disable global maintenance mode
Upgrade the self-hosted engine nodes, and any standard hosts
Update the compatibility version of the clusters
Update the compatibility version of the data centers
If you installed the technology preview version of Open Virtual Network (OVN) in 4.1, update the OVN provider’s networking plugin
Replace SHA-1 certificates with SHA-256 certificates

8.3.1. Enabling Global Maintenance Mode

You must place the self-hosted engine environment in global maintenance mode before performing any setup or upgrade tasks on the Manager virtual machine.

Procedure

Log in to one of the self-hosted engine nodes and enable global maintenance mode:
```
# hosted-engine --set-maintenance --mode=global
```
Confirm that the environment is in maintenance mode before proceeding:
```
# hosted-engine --vm-status
```

8.3.2. Updating the Red Hat Virtualization Manager

Updates to the Red Hat Virtualization Manager are released through the Content Delivery Network.

Procedure

On the Red Hat Virtualization Manager machine, check if updated packages are available:
```
# engine-upgrade-check
```
Update the setup packages:
```
# yum update ovirt\*setup\*
```
Update the Red Hat Virtualization Manager. The engine-setup script prompts you with some configuration questions, then stops the ovirt-engine service, downloads and installs the updated packages, backs up and updates the database, performs post-installation configuration, and starts the ovirt-engine service.
```
# engine-setup
```
Note
The engine-setup script is also used during the Red Hat Virtualization Manager installation process, and it stores the configuration values supplied. During an update, the stored values are displayed when previewing the configuration, and may not be up to date if engine-config was used to update configuration after installation. For example, if engine-config was used to update SANWipeAfterDelete to true after installation, engine-setup will output "Default SAN wipe after delete: False" in the configuration preview. However, the updated values will not be overwritten by engine-setup.
Important
The update process may take some time; allow time for the update process to complete and do not stop the process once initiated.
Update the base operating system and any optional packages installed on the Manager:
```
# yum update
```
Important
If any kernel packages were updated, reboot the host to complete the update.

8.3.3. Upgrading the Manager from 4.1 to 4.2

Upgrade the Red Hat Virtualization Manager from 4.1 to 4.2.

Important

If the upgrade fails, the engine-setup command will attempt to roll your Red Hat Virtualization Manager installation back to its previous state. For this reason, the previous version’s repositories must not be removed until after the upgrade is complete. If the upgrade fails, detailed instructions display that explain how to restore your installation.

Procedure

Enable the Red Hat Virtualization 4.2 repositories:

# subscription-manager repos \
    --enable=rhel-7-server-rhv-4.2-manager-rpms \
    --enable=rhel-7-server-rhv-4-manager-tools-rpms \
    --enable=jb-eap-7-for-rhel-7-server-rpms \
    --enable=rhel-7-server-ansible-2.9-rpms

All other repositories remain the same across Red Hat Virtualization releases.

Update the setup packages:
```
# yum update ovirt\*setup\*
```
Run engine-setup and follow the prompts to upgrade the Red Hat Virtualization Manager:
```
# engine-setup
```
Note
If you changed the default trust keystore password, you might get a keystore certificate error. If so, update the configuration to reflect the correct password. For more information, see RHV 4.2 - Failed to import provider certificate into the external provider keystore

Disable the Red Hat Virtualization 4.1 repositories to ensure the system does not use any 4.1 packages:

# subscription-manager repos \
    --disable=rhel-7-server-rhv-4.1-rpms \
    --disable=rhel-7-server-rhv-4.1-manager-rpms \
    --disable=rhel-7-server-rhv-4-tools-rpms \
    --disable=jb-eap-7.0-for-rhel-7-server-rpms \
    --disable=jb-eap-7.1-for-rhel-7-server-rpms

Update the base operating system:
```
# yum update
```
Reboot the machine.

8.3.4. Disabling Global Maintenance Mode

Procedure

Log in to one of the self-hosted engine nodes and disable global maintenance mode:
```
# hosted-engine --set-maintenance --mode=none
```
Confirm that the environment is running:
```
# hosted-engine --vm-status
```

You can now update the self-hosted engine nodes, and then any standard hosts. The procedure is the same for both host types.

8.3.5. Updating the Hosts

Use the host upgrade manager to update individual hosts directly from the Red Hat Virtualization Manager.

Note

The upgrade manager only checks hosts with a status of Up or Non-operational, but not Maintenance.

Important

On RHVH, the update only preserves modified content in the /etc and /var directories. Modified data in other paths is overwritten during an update.

Prerequisites

If migration is enabled at the cluster level, virtual machines are automatically migrated to another host in the cluster. Update a host when its usage is relatively low.
Ensure that the cluster contains more than one host before performing an update. Do not update all hosts at the same time, as one host must remain available to perform Storage Pool Manager (SPM) tasks.
Ensure that the cluster to which the host belongs has sufficient memory reserve for its hosts to perform maintenance. Otherwise, the virtual machine migration operation will hang and fail. You can reduce the memory usage of this operation by shutting down some or all virtual machines before updating the host.
You cannot migrate a virtual machine using a vGPU to a different host. Virtual machines with vGPUs installed must be shut down before updating the host.

Procedure

Ensure that the correct repositories are enabled (to view a list of currently enabled repositories, type yum repolist):

For Red Hat Virtualization Hosts:

# subscription-manager repos --enable=rhel-7-server-rhvh-4-rpms

For Red Hat Enterprise Linux hosts:

# subscription-manager repos \
    --enable=rhel-7-server-rpms \
    --enable=rhel-7-server-rhv-4-mgmt-agent-rpms \
    --enable=rhel-7-server-ansible-2.9-rpms

In the Administration Portal, click Compute → Hosts and select the host to be updated.
Click Installation → Check for Upgrade and click OK.
Click the Events and alerts notification icon ( ) and expand the Events section to see the result.
If an update is available, click Installation → Upgrade.
Click OK to update the host. Running virtual machines will be migrated according to their migration policy. If migration is disabled for any virtual machines, you will be prompted to shut them down.
The details of the host are updated in Compute → Hosts and the status transitions through these stages:
- Maintenance
- Installing
- Reboot
- Up
  If any virtual machines were migrated off the host, they are now migrated back.
  Note
  If the update fails, the host’s status changes to Install Failed. From Install Failed you can click Installation → Upgrade again.

Repeat this procedure for each host in the Red Hat Virtualization environment.

8.3.6. Changing the Cluster Compatibility Version

Red Hat Virtualization clusters have a compatibility version. The cluster compatibility version indicates the features of Red Hat Virtualization supported by all of the hosts in the cluster. The cluster compatibility is set according to the version of the least capable host operating system in the cluster.

Important

To change the cluster compatibility version, you must have first updated all the hosts in your cluster to a level that supports your desired compatibility level. Check if there is an icon next to the host indicating an update is available.

Procedure

Click Compute → Clusters and select the cluster to change.
Click Edit.
Change the Compatibility Version to the desired value.
Click OK to open the Change Cluster Compatibility Version confirmation window.
Click OK to confirm.

Important

An error message may warn that some virtual machines and templates are incorrectly configured. To fix this error, edit each virtual machine manually. The Edit Virtual Machine window provides additional validations and warnings that show what to correct. Sometimes the issue is automatically corrected and the virtual machine’s configuration just needs to be saved again. After editing each virtual machine, you will be able to change the cluster compatibility version.

After you update the cluster’s compatibility version, you must update the cluster compatibility version of all running or suspended virtual machines by restarting them from within the Manager, or using the REST API, instead of within the guest operating system. Virtual machines will continue to run in the previous cluster compatibility level until they are restarted. Those virtual machines that require a restart are marked with the pending changes icon ( pendingchanges ). You cannot change the cluster compatibility version of a virtual machine snapshot that is in preview; you must first commit or undo the preview.

The self-hosted engine virtual machine does not need to be restarted.

Once you have updated the compatibility version of all clusters in a data center, you can then change the compatibility version of the data center itself.

8.3.7. Changing the Data Center Compatibility Version

Red Hat Virtualization data centers have a compatibility version. The compatibility version indicates the version of Red Hat Virtualization that the data center is intended to be compatible with. All clusters in the data center must support the desired compatibility level.

Important

To change the data center compatibility version, you must have first updated all the clusters in your data center to a level that supports your desired compatibility level.

Procedure

Click Compute → Data Centers and select the data center to change.
Click Edit.
Change the Compatibility Version to the desired value.
Click OK to open the Change Data Center Compatibility Version confirmation window.
Click OK to confirm.

8.3.8. Updating OVN Providers Installed in Red Hat Virtualization 4.1

If you installed an Open Virtual Network (OVN) provider in Red Hat Virtualization 4.1, you must manually edit its configuration for Red Hat Virtualization 4.2.

Procedure

Click Administration → Providers and select the OVN provider.
Click Edit.
Click the Networking Plugin text field and select oVirt Network Provider for OVN from the drop-down list.
Click OK.

8.3.9. Replacing SHA-1 Certificates with SHA-256 Certificates

Red Hat Virtualization 4.2 uses SHA-256 signatures, which provide a more secure way to sign SSL certificates than SHA-1. Newly installed 4.2 systems do not require any special steps to enable Red Hat Virtualization’s public key infrastructure (PKI) to use SHA-256 signatures. However, for upgraded systems one of the following is recommended:

Prevent warning messages from appearing in your browser when connecting to the Administration Portal. These warnings may either appear as pop-up windows or in the browser’s Web Console window. This option is not required if you already replaced the Red Hat Virtualization Manager’s Apache SSL certificate after the upgrade. However, if the certificate was signed with SHA-1, you should replace it with an SHA-256 certificate. For more details see Replacing the Red Hat Virtualization Manager SSL Certificate in the Administration Guide.
Replace the SHA-1 certificates throughout the system with SHA-256 certificates.

Preventing Warning Messages from Appearing in the Browser

Check whether /etc/pki/ovirt-engine/openssl.conf includes the line default_md = sha256:

# cat /etc/pki/ovirt-engine/openssl.conf

If it still includes default_md = sha1, back up the existing configuration and change the default to sha256:

# cp -p /etc/pki/ovirt-engine/openssl.conf /etc/pki/ovirt-engine/openssl.conf."$(date +"%Y%m%d%H%M%S")"
# sed -i 's/^default_md = sha1/default_md = sha256/' /etc/pki/ovirt-engine/openssl.conf

Define the certificate that should be re-signed:
```
# names="apache"
```
Log in to one of the self-hosted engine nodes and enable global maintenance:
```
# hosted-engine --set-maintenance --mode=global
```

On the Manager, re-sign the Apache certificate:

for name in $names; do
    subject="$(
        openssl \
            x509 \
            -in /etc/pki/ovirt-engine/certs/"${name}".cer \
            -noout \
            -subject \
        | sed \
            's;subject= \(.*\);\1;' \
    )"
   /usr/share/ovirt-engine/bin/pki-enroll-pkcs12.sh \
        --name="${name}" \
        --password=mypass \
        --subject="${subject}" \
        --keep-key
done

Restart the httpd service:
```
# systemctl restart httpd
```
Log in to one of the self-hosted engine nodes and disable global maintenance:
```
# hosted-engine --set-maintenance --mode=none
```
Connect to the Administration Portal to confirm that the warning no longer appears.
If you previously imported a CA or https certificate into the browser, find the certificate(s), remove them from the browser, and reimport the new CA certificate. Install the certificate authority according to the instructions provided by your browser. To get the certificate authority’s certificate, navigate to http://your-manager-fqdn/ovirt-engine/services/pki-resource?resource=ca-certificate&format=X509-PEM-CA, replacing your-manager-fqdn with the fully qualified domain name (FQDN).

Replacing All Signed Certificates with SHA-256

Check whether /etc/pki/ovirt-engine/openssl.conf includes the line default_md = sha256:

# cat /etc/pki/ovirt-engine/openssl.conf

If it still includes default_md = sha1, back up the existing configuration and change the default to sha256:

# cp -p /etc/pki/ovirt-engine/openssl.conf /etc/pki/ovirt-engine/openssl.conf."$(date +"%Y%m%d%H%M%S")"
# sed -i 's/^default_md = sha1/default_md = sha256/' /etc/pki/ovirt-engine/openssl.conf

Re-sign the CA certificate by backing it up and creating a new certificate in ca.pem.new:

# cp -p /etc/pki/ovirt-engine/private/ca.pem /etc/pki/ovirt-engine/private/ca.pem."$(date +"%Y%m%d%H%M%S")"
# openssl x509 -signkey /etc/pki/ovirt-engine/private/ca.pem -in /etc/pki/ovirt-engine/ca.pem -out /etc/pki/ovirt-engine/ca.pem.new -days 3650 -sha256

Replace the existing certificate with the new certificate:

# mv /etc/pki/ovirt-engine/ca.pem.new /etc/pki/ovirt-engine/ca.pem

Define the certificates that should be re-signed:
```
# names="engine apache websocket-proxy jboss imageio-proxy"
```
If you replaced the Red Hat Virtualization Manager SSL Certificate after the upgrade, run the following instead:
```
# names="engine websocket-proxy jboss imageio-proxy"
```
For more details see Replacing the Red Hat Virtualization Manager SSL Certificate in the Administration Guide.
Log in to one of the self-hosted engine nodes and enable global maintenance:
```
# hosted-engine --set-maintenance --mode=global
```

On the Manager, re-sign the certificates:

for name in $names; do
   subject="$(
        openssl \
            x509 \
            -in /etc/pki/ovirt-engine/certs/"${name}".cer \
            -noout \
            -subject \
        | sed \
            's;subject= \(.*\);\1;' \
        )"
     /usr/share/ovirt-engine/bin/pki-enroll-pkcs12.sh \
            --name="${name}" \
            --password=mypass \
            --subject="${subject}" \
            --keep-key
done

Restart the following services:

# systemctl restart httpd
# systemctl restart ovirt-engine
# systemctl restart ovirt-websocket-proxy
# systemctl restart ovirt-imageio-proxy

Log in to one of the self-hosted engine nodes and disable global maintenance:
```
# hosted-engine --set-maintenance --mode=none
```
Connect to the Administration Portal to confirm that the warning no longer appears.
If you previously imported a CA or https certificate into the browser, find the certificate(s), remove them from the browser, and reimport the new CA certificate. Install the certificate authority according to the instructions provided by your browser. To get the certificate authority’s certificate, navigate to http://your-manager-fqdn/ovirt-engine/services/pki-resource?resource=ca-certificate&format=X509-PEM-CA, replacing your-manager-fqdn with the fully qualified domain name (FQDN).
Enroll the certificates on the hosts. Repeat the following procedure for each host.
1. In the Administration Portal, click Compute → Hosts.
2. Select the host and click Management → Maintenance.
3. Once the host is in maintenance mode, click Installation → Enroll Certificate.
4. Click Management → Activate.

Select Your Language

Red Hat Training

8.3. Upgrading a Self-Hosted Engine from 4.1 to Red Hat Virtualization 4.2

8.3.1. Enabling Global Maintenance Mode

8.3.2. Updating the Red Hat Virtualization Manager

8.3.3. Upgrading the Manager from 4.1 to 4.2

8.3.4. Disabling Global Maintenance Mode

8.3.5. Updating the Hosts

8.3.6. Changing the Cluster Compatibility Version

8.3.7. Changing the Data Center Compatibility Version

8.3.8. Updating OVN Providers Installed in Red Hat Virtualization 4.1

8.3.9. Replacing SHA-1 Certificates with SHA-256 Certificates

Preventing Warning Messages from Appearing in the Browser

Replacing All Signed Certificates with SHA-256

Quick Links

Help

Site Info

Related Sites

About

Red Hat legal and privacy links

Red Hat legal and privacy links

Language and Page Formatting Options

Red Hat Training

8.3. Upgrading a Self-Hosted Engine from 4.1 to Red Hat Virtualization 4.2

8.3.1. Enabling Global Maintenance Mode

8.3.2. Updating the Red Hat Virtualization Manager

8.3.3. Upgrading the Manager from 4.1 to 4.2

8.3.4. Disabling Global Maintenance Mode

8.3.5. Updating the Hosts

8.3.6. Changing the Cluster Compatibility Version

8.3.7. Changing the Data Center Compatibility Version

8.3.8. Updating OVN Providers Installed in Red Hat Virtualization 4.1

8.3.9. Replacing SHA-1 Certificates with SHA-256 Certificates

Preventing Warning Messages from Appearing in the Browser

Replacing All Signed Certificates with SHA-256

Quick Links

Help

Site Info

Related Sites

Systems Status

About

Red Hat legal and privacy links

Red Hat legal and privacy links