Dedicated Servers
  • Instant
  • Custom
  • Single CPU servers
  • Dual CPU servers
  • Servers with 4th Gen CPUs
  • AMD Ryzen ve Intel Core i9'lu Sunucular
  • Storage Servers
  • Servers with 10Gbps ports
  • Hosting virtualization nodes
  • GPU
  • Sale
  • VPS
    GPU
  • Dedicated GPU server
  • VM with GPU
  • Tesla A100 80GB & H100 Servers
  • Sale
    Apps
    Cloud
  • VMware and RedHat's oVirt Сlusters
  • Proxmox VE
  • Colocation
  • Colocation in the Netherlands
  • Remote smart hands
  • Services
  • Intelligent DDoS protection
  • Network equipment
  • IPv4 and IPv6 address
  • Managed servers
  • SLA packages for technical support
  • Monitoring
  • Software
  • VLAN
  • Announcing your IP or AS (BYOIP)
  • USB flash/key/flash drive
  • Traffic
  • Hardware delivery for EU data centers
  • About
  • Careers at HOSTKEY
  • Server Control Panel & API
  • Data Centers
  • Network
  • Speed test
  • Hot deals
  • Sales contact
  • Reseller program
  • Affiliate Program
  • Grants for winners
  • Grants for scientific projects and startups
  • News
  • Our blog
  • Payment terms and methods
  • Legal
  • Abuse
  • Looking Glass
  • The KYC Verification
  • Hot Deals

    02.10.2023

    Monitoring oVirt SSL Certificates

    server one
    HOSTKEY
    Rent dedicated and virtual servers with instant deployment in reliable TIER III class data centers in the Netherlands and the USA. Free protection against DDoS attacks included, and your server will be ready for work in as little as 15 minutes. 24/7 Customer Support.

    Author: Stepan Vakheta, DevOps specialist at the Hostkey company

    At Hostkey we use oVirt as our main virtualization system. It is extremely important to keep the system running at a high level despite the constant growth of the infrastructure to dozens and even hundreds of physical servers. In this article, we will briefly describe our company's approach to oVirt certificate monitoring.

    In past articles, we described options for using Prometheus + Alertmanager + Node Exporter and HTTP and SSL via Prometheus Blackbox_Exporter.

    Today we are going to talk about monitoring certificates in local storage of two main components of oVirt: oVirt Engine and oVirt Node. It is through these certificates that communication between these components takes place.

    • The oVirt Engine is the central management component that controls all virtualization hosts, disk shares and virtual networks.
    • oVirt Node is a component installed on each individual host that manages all the resources of that host and the virtual machines running on it.

    Depending on the architecture, oVirt nodes can be combined into clusters. In this case, it is important to maintain a high level of reliability of communication between system components.

    Communication between the oVirt Engine and oVirt hosts is performed over an encrypted SSL connection based on the certificates of these components. Depending on the oVirt version, the validity period of these certificates may vary: before version 4.5 it was 398 days, and from version 4.5 it has been increased to 5 years.

    It is important not to miss the next certificate reissuance. Once they expire, Engine hosts will not be able to communicate, making it impossible to manage virtual machines entailing considerable investment in time to restore performance.

    The best solution to the problem is to prevent it from occurring in the first place. Accordingly, we will collect the necessary metrics using SSL Exporter - it allows you to assign a target parameter to collect metrics in the form of local files, which is ideal for our task.

    After installing and launching the exporter, it is necessary to define the target parameters (targets) for each of the system components. According to the Documentation, the certificates of interest for each of the components are located in the following paths:

    • for ovirt-engine — /etc/pki/ovirt-engine;
    • for ovirt-host — /etc/pki/vdsm/ and /etc/pki/libvirt/.

    This exporter has the ability to search and sample multiple files simultaneously (using the doublestar package), which we will use in our query.

    Target parameter for the oVirt Engine:

    http://<engine_address>:9219/probe?module=file&target=/etc/pki/ovirt-engine/**/**.pem

    Target parameter for the oVirt Hosts:

    http://<node_address>:9219/probe?module=file&target=/etc/pki/vdsm/**/**.pem
    http://<node_address>:9219/probe?module=file&target=/etc/pki/libvirt/**/**.pem

    A sample of the metrics collected:

    Then it is necessary to describe the configuration for Prometheus and add it to the database. For clarity, we will divide it by job_name for further visualization in the AlertManager panel:

    /etc/prometheus/prometheus.yml

    - job_name: ssl_file_engine
    metrics_path: /probe
    params:
    	module:
    	- file
    	target:
    	- /etc/pki/ovirt-engine/**/**.pem
    static_configs:
    - targets:
    	- engine_address:9219
    	- engine_address:9219
    
    - job_name: ssl_file_vdsm_node
    metrics_path: /probe
    params:
    	module:
    	- file
    	target:
    	- /etc/pki/vdsm/**/**.pem
    static_configs:
    - targets:
    	- node_address:9219
    	- node_address:9219
    
    - job_name: ssl_file_libvirt_node
    metrics_path: /probe
    params:
    	module:
    	- file
    	target:
    	- /etc/pki/libvirt/**/**.pem
    static_configs:
    - targets:
    	- node_address:9219
    	- node_address:9219

    Next we need to describe a configuration file with rules for triggering alerts. We will be interested in the certificate expiration date.

    Let's add a rule that will be triggered 70 days or less before the certificate expiration date.

    ssl_file_engine.yml

    groups:
    - name: ssl_file_engine
    	rules:
    	- alert: SSLCertExpiringSoon
    	expr:  ssl_file_cert_not_after{job="ssl_file_engine"} - time() < 86400 * 70
    	for: 10m
    	labels:
    		severity: critical
    	annotations:
    		description: "SSL certificate will expire in {{ $value | humanizeDuration }} (instance {{ $labels.instance }}) (instance {{ $labels.file }})"

    ssl_file_libvirt_node.yml

    groups:
    - name: ssl_file_libvirt_node
    	rules:
    	- alert: SSLCertExpiringSoon
    	expr:  ssl_file_cert_not_after{job="ssl_file_libvirt_node"} - time() < 86400 * 70
    	for: 10m
    	labels:
    		severity: critical
    	annotations:
    		description: "SSL certificate will expire in {{ $value | humanizeDuration }} (instance {{ $labels.instance }}) (instance {{ $labels.file }})"

    ssl_file_vdsm_node.yml

    groups:
    - name: ssl_file_vdsm_node
    	rules:
    	- alert: SSLCertExpiringSoon
    	expr:  ssl_file_cert_not_after{job="ssl_file_vdsm_node"} - time() < 86400 * 70
    	for: 10m
    	labels:
    		severity: critical
    	annotations:
    		description: "SSL certificate will expire in {{ $value | humanizeDuration }} (instance {{ $labels.instance }}) (instance {{ $labels.file }})"

    When the specified deadline expires, we will get the following visualization in the AlertManager panel:

    Monitoring in this way helps prevent failures due to the tardy replacement of SSL certificates and ensures the stable operation of the virtual infrastructure. With a few simple steps, you can avoid problems that would otherwise cause downtime for a large number of resources.

    Rent dedicated and virtual servers with instant deployment in reliable TIER III class data centers in the Netherlands and the USA. Free protection against DDoS attacks included, and your server will be ready for work in as little as 15 minutes. 24/7 Customer Support.

    Other articles

    23.05.2024

    The Capabilities of Large Language Models: Hacking or Helping?

    Exploring the Capabilities of LLM Agents: A Study on Website Hacking

    01.05.2024

    Checklist: 10 Points to Choose a Hosting Service That Won't Let You Down

    How to choose the best hosting for your projects? We have prepared a checklist of 10 questions you should ask the hosting service that will help you make a decision.

    17.04.2024

    How to choose the right server with suitable CPU/GPU for your AI?

    Let's talk about the most important components that influence the choice of server for artificial intelligence.

    04.04.2024

    VPS, Website Hosting or Website Builder? Where to host a website for business?

    We have compared website hosting options, including VPS, shared hosting, and website builders.

    15.03.2024

    How AI is fighting the monopoly in sports advertising with GPUs and servers

    AI and AR technologies allow sports advertising to be customized to different audiences in real time using cloud-based GPU solutions.

    HOSTKEY Dedicated servers and cloud solutions Pre-configured and custom dedicated servers. AMD, Intel, GPU cards, Free DDoS protection amd 1Gbps unmetered port 30
    4.3 67 67
    Upload