EN
Currency:
EUR – €
Choose a currency
  • Euro EUR – €
  • United States dollar USD – $
VAT:
OT 0%
Choose your country (VAT)
  • OT All others 0%
Choose a language
  • Choose a currency
    Choose you country (VAT)
    Dedicated Servers
  • Instant
  • Custom
  • Single CPU servers
  • Dual CPU servers
  • Servers with 4th Gen CPUs
  • Servers with AMD Ryzen and Intel Core i9
  • Storage Servers
  • Servers with 10Gbps ports
  • Hosting virtualization nodes
  • GPU
  • Sale
  • VPS
    GPU
  • Dedicated GPU server
  • VM with GPU
  • Tesla A100 80GB & H100 Servers
  • Sale
    Apps
    Cloud
  • VMware and RedHat's oVirt Сlusters
  • Proxmox VE
  • Colocation
  • Colocation in the Netherlands
  • Remote smart hands
  • Services
  • DDoS L7 Protection
  • L3-L4 DDoS Protection
  • Network equipment
  • IPv4 and IPv6 address
  • Managed servers
  • SLA packages for technical support
  • Monitoring
  • Software
  • VLAN
  • Announcing your IP or AS (BYOIP)
  • USB flash/key/flash drive
  • Traffic
  • Hardware delivery for EU data centers
  • About
  • Careers at HOSTKEY
  • Server Control Panel & API
  • Data Centers
  • Network
  • Speed test
  • Hot deals
  • Sales contact
  • Reseller program
  • Affiliate Program
  • Grants for winners
  • Grants for scientific projects and startups
  • News
  • Our blog
  • Payment terms and methods
  • Legal
  • Abuse
  • Looking Glass
  • The KYC Verification
  • Hot Deals

    02.10.2023

    Monitoring oVirt SSL Certificates

    server one
    HOSTKEY
    Rent dedicated and virtual servers with instant deployment in reliable TIER III class data centers in the Netherlands and the USA. Free protection against DDoS attacks included, and your server will be ready for work in as little as 15 minutes. 24/7 Customer Support.

    Author: Stepan Vakheta, DevOps specialist at the Hostkey company

    At Hostkey we use oVirt as our main virtualization system. It is extremely important to keep the system running at a high level despite the constant growth of the infrastructure to dozens and even hundreds of physical servers. In this article, we will briefly describe our company's approach to oVirt certificate monitoring.

    In past articles, we described options for using Prometheus + Alertmanager + Node Exporter and HTTP and SSL via Prometheus Blackbox_Exporter.

    Today we are going to talk about monitoring certificates in local storage of two main components of oVirt: oVirt Engine and oVirt Node. It is through these certificates that communication between these components takes place.

    • The oVirt Engine is the central management component that controls all virtualization hosts, disk shares and virtual networks.
    • oVirt Node is a component installed on each individual host that manages all the resources of that host and the virtual machines running on it.

    Depending on the architecture, oVirt nodes can be combined into clusters. In this case, it is important to maintain a high level of reliability of communication between system components.

    Communication between the oVirt Engine and oVirt hosts is performed over an encrypted SSL connection based on the certificates of these components. Depending on the oVirt version, the validity period of these certificates may vary: before version 4.5 it was 398 days, and from version 4.5 it has been increased to 5 years.

    It is important not to miss the next certificate reissuance. Once they expire, Engine hosts will not be able to communicate, making it impossible to manage virtual machines entailing considerable investment in time to restore performance.

    The best solution to the problem is to prevent it from occurring in the first place. Accordingly, we will collect the necessary metrics using SSL Exporter - it allows you to assign a target parameter to collect metrics in the form of local files, which is ideal for our task.

    After installing and launching the exporter, it is necessary to define the target parameters (targets) for each of the system components. According to the Documentation, the certificates of interest for each of the components are located in the following paths:

    • for ovirt-engine — /etc/pki/ovirt-engine;
    • for ovirt-host — /etc/pki/vdsm/ and /etc/pki/libvirt/.

    This exporter has the ability to search and sample multiple files simultaneously (using the doublestar package), which we will use in our query.

    Target parameter for the oVirt Engine:

    http://<engine_address>:9219/probe?module=file&target=/etc/pki/ovirt-engine/**/**.pem

    Target parameter for the oVirt Hosts:

    http://<node_address>:9219/probe?module=file&target=/etc/pki/vdsm/**/**.pem
    http://<node_address>:9219/probe?module=file&target=/etc/pki/libvirt/**/**.pem

    A sample of the metrics collected:

    Then it is necessary to describe the configuration for Prometheus and add it to the database. For clarity, we will divide it by job_name for further visualization in the AlertManager panel:

    /etc/prometheus/prometheus.yml

    - job_name: ssl_file_engine
    metrics_path: /probe
    params:
    	module:
    	- file
    	target:
    	- /etc/pki/ovirt-engine/**/**.pem
    static_configs:
    - targets:
    	- engine_address:9219
    	- engine_address:9219
    
    - job_name: ssl_file_vdsm_node
    metrics_path: /probe
    params:
    	module:
    	- file
    	target:
    	- /etc/pki/vdsm/**/**.pem
    static_configs:
    - targets:
    	- node_address:9219
    	- node_address:9219
    
    - job_name: ssl_file_libvirt_node
    metrics_path: /probe
    params:
    	module:
    	- file
    	target:
    	- /etc/pki/libvirt/**/**.pem
    static_configs:
    - targets:
    	- node_address:9219
    	- node_address:9219

    Next we need to describe a configuration file with rules for triggering alerts. We will be interested in the certificate expiration date.

    Let's add a rule that will be triggered 70 days or less before the certificate expiration date.

    ssl_file_engine.yml

    groups:
    - name: ssl_file_engine
    	rules:
    	- alert: SSLCertExpiringSoon
    	expr:  ssl_file_cert_not_after{job="ssl_file_engine"} - time() < 86400 * 70
    	for: 10m
    	labels:
    		severity: critical
    	annotations:
    		description: "SSL certificate will expire in {{ $value | humanizeDuration }} (instance {{ $labels.instance }}) (instance {{ $labels.file }})"

    ssl_file_libvirt_node.yml

    groups:
    - name: ssl_file_libvirt_node
    	rules:
    	- alert: SSLCertExpiringSoon
    	expr:  ssl_file_cert_not_after{job="ssl_file_libvirt_node"} - time() < 86400 * 70
    	for: 10m
    	labels:
    		severity: critical
    	annotations:
    		description: "SSL certificate will expire in {{ $value | humanizeDuration }} (instance {{ $labels.instance }}) (instance {{ $labels.file }})"

    ssl_file_vdsm_node.yml

    groups:
    - name: ssl_file_vdsm_node
    	rules:
    	- alert: SSLCertExpiringSoon
    	expr:  ssl_file_cert_not_after{job="ssl_file_vdsm_node"} - time() < 86400 * 70
    	for: 10m
    	labels:
    		severity: critical
    	annotations:
    		description: "SSL certificate will expire in {{ $value | humanizeDuration }} (instance {{ $labels.instance }}) (instance {{ $labels.file }})"

    When the specified deadline expires, we will get the following visualization in the AlertManager panel:

    Monitoring in this way helps prevent failures due to the tardy replacement of SSL certificates and ensures the stable operation of the virtual infrastructure. With a few simple steps, you can avoid problems that would otherwise cause downtime for a large number of resources.

    Rent dedicated and virtual servers with instant deployment in reliable TIER III class data centers in the Netherlands and the USA. Free protection against DDoS attacks included, and your server will be ready for work in as little as 15 minutes. 24/7 Customer Support.

    Other articles

    16.09.2024

    10 Tips for Open WebUI to Enhance Your Work with AI

    Unleash the true power of Open WebUI and transform your AI workflow with these 10 indispensable tips.

    27.08.2024

    Comparison of SaaS solutions for online store on Wix and WordPress.com versus an on-premise solution on a VPS with WordPress and WooCommerce

    This article compares the simplicity and cost of SaaS platforms like Wix and WordPress.com versus the flexibility and control of a VPS with WordPress and WooCommerce for e-commerce businesses.

    08.07.2024

    Let's build a customer support chatbot using RAG and your company's documentation in OpenWebUI

    We'll share our journey creating a technical support chatbot designed to assist our front-line team by answering user questions (and eventually becoming a part of our team itself).

    01.07.2024

    VPS or Dedicated Server: Optimal Hosting Solutions

    Discover whether VPS or Dedicated Servers are the perfect fit for your project. Our article breaks down the pros and cons of each, helping you make an informed decision tailored to your specific needs.

    26.06.2024

    Seeking a self-hosted alternative to Slack? We recommend investigating Rocket.Chat

    If you're looking for a way to maintain complete control over your team's communication, while also ensuring the security of sensitive information and avoiding costly subscription fees, then exploring open-source alternatives to Slack is definitely worth considering.

    HOSTKEY Dedicated servers and cloud solutions Pre-configured and custom dedicated servers. AMD, Intel, GPU cards, Free DDoS protection amd 1Gbps unmetered port 30
    4.3 67 67
    Upload