Stop and disable libvirtd-tls.socket in intial clean

[nijinashok]

If the libvirtd-tls.socket service is not disabled, then the libvirtd will fail to start with error "Cannot read certificate '/etc/pki/libvirt/servercert.pem': No such file or directory." if we reattempt after a failed deployment.

The libvirtd will check for the certificates if the tls socket service is enabled and fails with the mentioned error. This issue happens if we reattempt the deployment when it fails after the libvirtd was configured for the vdsm.

[ovirt-infra]

Hello contributor, thanks for submitting a PR for this project!

I am the bot who triggers "standard-CI" builds for this project.
As a security measure, I will not run automated tests on PRs that are not from white-listed contributors.

In order to allow automated tests to run, please ask one of the project maintainers to review the code and then do one of the following:

1. Type ci test please on this PR to trigger automated tests for it.
2. Type ci add to whitelist on this PR to trigger automated tests for it and also add you to the contributor white-list so that your future PRs will be tested automatically. ( keep in mind this list might be overwritten if the job XML is refreshed, for permanent whitelisting, please follow Add generic test for service status #3 option )
3. If you are planning to contribute to more than one project, maybe it's better to ask them to add you to the project organization, so you'll be able to run tests for all the organization's projects.

[sandrobonazzola]

ci add to whitelist

[sandrobonazzola]

looks good to me but maintainers should review

[arachmani]

Thanks @nijinashok, we already added it to the HE cleanup tool ovirt-hosted-engine-cleanup
https://gerrit.ovirt.org/#/c/109131/
So if you will use the cleanup tool (will be available in ovirt-hosted-engine-setup-2.4.5), redeploy should succeed.

[nijinashok]

I think it will be great to add this to deployment as well. Most of the cleanup codes are available in the deployment too and most of the time deployment works without running ovirt-hosted-engine-cleanup.

[eslutsky]

Thanks @nijinashok, we already added it to the HE cleanup tool ovirt-hosted-engine-cleanup
https://gerrit.ovirt.org/#/c/109131/
So if you will use the cleanup tool (will be available in ovirt-hosted-engine-setup-2.4.5), redeploy should succeed.

this commit will bring us closer to redeploy HE without having to perform the manual cleanup.

[arachmani]

I think it will be great to add this to deployment as well. Most of the cleanup codes are available in the deployment too and most of the time deployment works without running ovirt-hosted-engine-cleanup.

I think that you must run the cleanup. If you will not use the cleanup you may have some leftovers (files, IP rules, memory allocation, etc.) on the host and the deployment can fail because of that, and in general, it's bad practice.

[eslutsky]

I think it will be great to add this to deployment as well. Most of the cleanup codes are available in the deployment too and most of the time deployment works without running ovirt-hosted-engine-cleanup.

I think that you must run the cleanup. If you will not use the cleanup you may have some leftovers (files, IP rules, memory allocation, etc.) on the host and the deployment can fail because of that, and in general, it's bad practice.

if we really want to pursue that policy we must also enforce it,
meaning detect that HE already deployed, fail early during the hosted-engine-setup or cockpit phase with a clear error saying to run the cleanup to redeploy if needed.

[eslutsky]

discussed with @arachmani offline, it does make sense to merge since it also fixes https://bugzilla.redhat.com/show_bug.cgi?id=1834422