Posts

Running ipa-healthcheck --failures-only on my FreeIPA primary (idm.gnali.home, RHEL 10.2, IPA 4.13.1) reported two ERROR results against the Dogtag CA subsystem: 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 { "source": "pki.server.healthcheck.certs.expiration", "check": "CASystemCertExpiryCheck", "result": "ERROR", "kw": { "exception": "Request timed out" } }, { "source": "pki.server.healthcheck.certs.trustflags", "check": "CASystemCertTrustFlagCheck", "result": "ERROR", "kw": { "key": "ocsp_signing", "nssdbDir": "/var/lib/pki/pki-tomcat/conf/alias", "msg": "Unable to load cert from NSSDB: Request timed out" } } The wording sounds alarming — certificate expiry and trust flags are core PKI concerns. In this case, the CA was healthy. The healthcheck simply ran out of time while reading the NSS database. ...

On RHEL with firewalld’s nftables backend, allowing one libvirt VM network to reach another is not a classic firewall-cmd --direct problem anymore. Libvirt installs its own ip libvirt_network table, and that is what rejects NEW traffic between bridges. ...

When installing Red Hat Openstack until version 17.1, we use tripleo and the so called “installer” : The Undercloud. To configure it we have to set some parameters in file undercloud.conf, where we define 2 dhcp range : dhcp_start, dhcp_end inspection_iprange ...

Here’s a quick how-to to move cinder-volume bundle resource to a specific controller. ...

Based on : https://access.redhat.com/documentation/en-us/red_hat_openstack_platform/16.2/html/service_telemetry_framework_1.5/assembly-installing-the-core-components-of-stf_assembly list all needed operators and images and generate imageset-config.yaml ...