Host is showing as unsecure not matter how it is added.

[Fozzman]

ISSUE TYPE

• Bug Report

COMPONENT NAME

UI

CLOUDSTACK VERSION

4.18.1

CONFIGURATION

One Management Server, One Database Server, One Host

OS / ENVIRONMENT

Ubuntu 22.04 LTS, KVM, MySQL 8.0

SUMMARY

This is not a bug, but was not sure how to categorize it. It is a problem that I am having with the latest rebuild of our system. This is the third or fourth time we have rebuilt it and the first time this issue has popped up. Our one and only host is showing up as unsecure, but connected. We have restarted the agent, management service, disconnected, and reconnected the host. As well as removed and readded the host. Each time it shows as unsecure. I am looking for pointers for things to look at to troubleshoot the issue.

STEPS TO REPRODUCE

Added host both in the wizard and manually. 

EXPECTED RESULTS

I expect the host to show green 

ACTUAL RESULTS

The host is showing as unsecure.

See picture above, host shows as unsecure. 

[boring-cyborg]

Thanks for opening your first issue here! Be sure to follow the issue template!

[DaanHoogland]

@Fozzman is the host added with certificates created from the in the system configured root ca?

[Fozzman]

I am not sure if I can answer that. What I can say is that this is a base install and there was no configuration on my end to install a root CA. I did the same as the previous two installs as it pertains to steps taken and in those attempts, the host was able to be added with no issue. From: dahn ***@***.***> Date: Tuesday, December 19, 2023 at 8:14 AM To: apache/cloudstack ***@***.***> Cc: Fozzman ***@***.***>, Mention ***@***.***> Subject: Re: [apache/cloudstack] Host is showing as unsecure not matter how it is added. (Issue #8379) @Fozzman<https://github.com/Fozzman> is the host added with certificates created from the in the system configured root ca? — Reply to this email directly, view it on GitHub<#8379 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AZHFIEISAHGYTIPJETDXKOLYKGHMFAVCNFSM6AAAAABA3EYXC6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTQNRSG4ZTQNZWG4>. You are receiving this because you were mentioned.Message ID: ***@***.***>

[JoaoJandre]

Hello @Fozzman,

The Unsecure state in ACS indicates that the Libvirt service has been configured to start with TCP. For the host to be marked with the Up state, Libvirt must be configured to start with TLS. However, during installation of the ACS Agent for KVM, some sockets are automatically masked, including the TLS socket; making it necessary to unmask them manually. To unmask the sockets and reestablish communication via TLS, the following steps are needed:

1. Unmask sockets:

systemctl unmask libvirtd-admin.socket
systemctl unmask libvirtd-ro.socket
systemctl unmask libvirtd-tcp.socket
systemctl unmask libvirtd-tls.socket
systemctl unmask libvirtd.socket

2. Stop the libvirtd service:

systemctl stop libvirtd

3. Start libvirtd-tls.socket

systemctl start libvirtd-tls.socket

4. Restart the ACS agent:

systemctl restart cloudstack-agent

5. Enable socket libvirt-tls

systemctl enable libvirtd-tls.socket

With this, Libvirt should start with TLS and ACS will mark it with the status Up, instead of Unsecure.

[Fozzman]

Thank you very much! It worked like a champ! I will close the issue as resolved. Very much appreciated. From: João Jandre ***@***.***> Date: Tuesday, December 19, 2023 at 11:36 AM To: apache/cloudstack ***@***.***> Cc: Fozzman ***@***.***>, Mention ***@***.***> Subject: Re: [apache/cloudstack] Host is showing as unsecure not matter how it is added. (Issue #8379) Hello @Fozzman<https://github.com/Fozzman>, The Unsecure state in ACS indicates that the Libvirt service has been configured to start with TCP. For the host to be marked with the Up state, Libvirt must be configured to start with TLS. However, during installation of the ACS Agent for KVM, some sockets are automatically masked, including the TLS socket; making it necessary to unmask them manually. To unmask the sockets and reestablish communication via TLS, the following steps are needed: 1. Unmask sockets: systemctl unmask libvirtd-admin.socket systemctl unmask libvirtd-ro.socket systemctl unmask libvirtd-tcp.socket systemctl unmask libvirtd-tls.socket systemctl unmask libvirtd.socket 1. Stop the libvirtd service: systemctl stop libvirtd 1. Start libvirtd-tls.socket systemctl start libvirtd-tls.socket 1. Restart the ACS agent: systemctl restart cloudstack-agent 1. Enable socket libvirt-tls systemctl enable libvirtd-tls.socket With this, Libvirt should start with TLS and ACS will mark it with the status Up, instead of Unsecure. — Reply to this email directly, view it on GitHub<#8379 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AZHFIEKPHBLQ7BJW4AKYWSDYKG677AVCNFSM6AAAAABA3EYXC6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTQNRTGEYDKMRXHA>. You are receiving this because you were mentioned.Message ID: ***@***.***>