Oracle KVM (oVirt / OLVM)

Thinfinity® Cloud Manager connects to Oracle KVM environments through the oVirt REST API, which is also the underlying API for Oracle Linux Virtualization Manager (OLVM). Authentication uses a local or domain user account with sufficient privileges on the oVirt/OLVM engine. This article documents the Cloud Manager credential form for Oracle KVM, the minimum oVirt roles, and common configuration errors.

Info

Oracle KVM support in Cloud Manager is provided through the oVirt API. This applies to both standalone oVirt deployments and Oracle Linux Virtualization Manager (OLVM), which is Oracle’s downstream distribution of oVirt.

Info

All API calls from Cloud Manager originate from the Thinfinity® Workspace server. Ensure outbound HTTPS (port 443) is open from that host to the oVirt/OLVM engine. See Prerequisites for the full network requirements.

Prerequisites

Before adding Oracle KVM credentials in Cloud Manager, the following must be in place on the oVirt/OLVM side:

The oVirt or OLVM engine is installed, reachable, and its web interface is accessible from the Thinfinity Workspace server.
A dedicated user account exists for Cloud Manager. Cybele Software recommends a dedicated user rather than the built-in admin@internal account.
That user is assigned the oVirt roles listed in Minimum oVirt Roles below.
The Workspace server can reach the engine host on port 443.
(Optional, recommended for production) The engine’s CA certificate is available in PEM format, so that TLS verification can be enabled in the credential form.

For how to create users, assign roles, and obtain the engine CA certificate, refer to the oVirt documentation or the Oracle Linux Virtualization Manager documentation.

Minimum oVirt Roles

The service account must be assigned the following oVirt roles.

Role	Required For
VmOperator	All operations — start, stop, and manage virtual machines
DiskOperator	All operations — browse and manage VM disks
VmCreator	VDI/DaaS Models only — create new VMs from a Custom Terraform template

Engine CA Certificate

If you plan to enable TLS verification, the engine CA certificate is available at:

https://<engine-host>/ovirt-engine/services/pki-resource?resource=ca-certificate&format=X509-PEM-CA

Replace <engine-host> with the FQDN or IP address of your oVirt/OLVM engine. Save the downloaded file with a .pem extension — you will upload it in the credential form.

Authentication Method

Cloud Manager authenticates to oVirt/OLVM exclusively with a username and password against the engine’s REST API. By default, TLS verification is disabled — this matches the self-signed CA certificate that oVirt and OLVM installations typically use. For production environments, obtain the engine CA certificate, turn off Disable TLS Verification, and upload the certificate to establish a validated, encrypted connection.

Add the Credentials in Cloud Manager

In Cloud Manager, go to Credentials and click + New.
Select Oracle KVM as the provider.
Fill in the fields below and click Save.

For the full Add / Edit / Delete procedure, see Managing Credentials.

Oracle KVM Credential Fields

Field	Description
Server URL	The full HTTPS URL of the oVirt/OLVM engine. Cloud Manager automatically appends `/ovirt-engine/api` to the URL you provide, so you may enter just the host (e.g., `https://engine.corp.local`). Trailing slashes and any pre-existing `/ovirt-engine` path are normalized away. The `https://` scheme is added automatically when missing.
User Name/Email	The oVirt/OLVM user account in `username@domain` format (e.g., `thinfinity-cm@internal` for users in the built-in Internal domain).
Password	The password for the oVirt/OLVM user account.
Disable TLS Verification	When enabled, Cloud Manager skips SSL certificate validation for the engine connection. Enabled by default. Disable this option and provide a trusted CA certificate for production environments.
Trusted Certificate (.PEM)	Upload the engine CA certificate in PEM format. Visible and required only when Disable TLS Verification is turned off. See Engine CA Certificate above for how to obtain it.

Disable TLS Verification

is enabled by default because oVirt and OLVM installations typically use a self-signed CA certificate that is not trusted by the Workspace server out of the box. For production environments, obtain the engine CA certificate, disable this option, and upload the certificate.

Verification

After saving, Cloud Manager validates the credentials by connecting to the oVirt/OLVM API and querying the VM inventory. If validation succeeds, the credential status shows as Ok.

Common Errors

Error	Likely Cause	Resolution
`401 Unauthorized`	Incorrect username format, wrong password, or the account is locked.	Verify the username uses `username@domain` format (e.g., `thinfinity-cm@internal`). Check account status in the Administration Portal.
`SSL certificate error`	Disable TLS Verification is off but no trusted certificate has been uploaded, or the uploaded certificate does not match the engine CA.	Re-enable Disable TLS Verification, or upload the correct engine CA certificate.
`Connection refused` / `Connection timed out`	The Server URL is incorrect, the engine is not running, or a firewall is blocking port 443.	Verify the URL, confirm the engine service is running, and check firewall rules between the Workspace server and the engine host.
`404 Not Found`	The host portion of the Server URL is incorrect, or the engine web root is unreachable.	Cloud Manager appends `/ovirt-engine/api` automatically — the URL you enter does not need to include it. Verify the host is correct and the engine web interface is reachable.
`403 Forbidden`	The user account lacks the required permissions on the target resources.	Review role assignments against the Minimum oVirt Roles table.

Security Recommendations

Use a dedicated service account with the minimum required roles. Avoid using the built-in admin@internal account for automated integrations.
Disable TLS Verification only in isolated, fully trusted networks. In any environment accessible from outside the data center, upload the engine CA certificate and enable full certificate validation.
Rotate the service account password periodically and update the credential in Cloud Manager immediately after each rotation to avoid connectivity loss.
Restrict API access at the network level to allow connections to the oVirt/OLVM engine on port 443 only from the Thinfinity® Workspace server IP.

See Also