RHBA-2019:2559 - Bug Fix Advisory

Topic

Updated ovirt-ansible-roles packages that fix several bugs and add various
enhancements are now available.

Description

The ovirt-ansible-roles package contains Ansible roles, which automate common Red Hat Virtualization administration tasks.

The ovirt-hosted-engine-setup package provides a self-hosted engine tool for the Red Hat Virtualization Manager. A self-hosted engine is a virtualized environment in which the Manager runs on a virtual machine on the hosts managed by the Manager.

Changes to the ovirt-ansible-roles component:

• This is the initial release of oVirt Ansible roles for RHEL 8. (BZ#1723344)

Changes to the ovirt-hosted-engine-setup component:

• After performing OpenSCAP remediation, a reboot of the engine VM is required to enable FIPS mode. Previously, The ovirt-ansible-hosted-engine-setup wasn't triggering that reboot. As a result, engine-setup did not run FIPS mode, even though the Manager virtual machine would run in FIPS mode from the next reboot. By default, OpenSSL created PKCS#12 bundles with 40 bits RC2 encryption. However, this cipher is not available on FIPS configured machines. As a result, the first upgrade OpenSSL triggered by engine-setup fails while parsing the PKCS#12 bundles.

The current release fixes these issues for new deployments. If you run into these issues with previous versions, we recommend performing a recovery procedure. (BZ#1734171)

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/2974891

Affected Products

• Red Hat Virtualization Manager 4.3 x86_64
• Red Hat Virtualization 4 for RHEL 7 x86_64
• Red Hat Virtualization Host 4 for RHEL 7 x86_64
• Red Hat Enterprise Linux for x86_64 8 x86_64
• Red Hat Enterprise Linux for Power, little endian 8 ppc64le

Fixes

• BZ - 1723344 - Build and release oVirt Ansible roles on RHEL 8
• BZ - 1734171 - RHV-M 4.3.4 does not boot with fips=1 when OpenSCAP profile used resulting in non FIPS compliant certificates

CVEs

(none)

References

(none)