Appendix C. Building Cloud Images for Red Hat Satellite

Procedure

1. In the Satellite web UI, navigate to Hosts > Register Host.
2. Optional: Select a different Organization.
3. Optional: Select a different Location.
4. Optional: From the Host Group list, select the host group to associate the hosts with. Fields that inherit value from Host group: Operating system, Activation Keys and Lifecycle environment.
5. Optional: From the Operating system list, select the operating system of hosts that you want to register.
6. Optional: From the Capsule list, select the Capsule to register hosts through.

7. Optional: Select the Insecure option, if you want to make the first call insecure. During this first call, hosts download the CA file from Satellite. Hosts will use this CA file to connect to Satellite with all future calls making them secure.

   Red Hat recommends that you avoid insecure calls.

   If an attacker, located in the network between Satellite and a host, fetches the CA file from the first insecure call, the attacker will be able to access the content of the API calls to and from the registered host and the JSON Web Tokens (JWT). Therefore, if you have chosen to deploy SSH keys during registration, the attacker will be able to access the host using the SSH key.

   Instead, you can manually copy and install the CA file on each host before registering the host.

   To do this, find where Satellite stores the CA file by navigating to Administer > Settings > Authentication and locating the value of the SSL CA file setting.

   Copy the CA file to the /etc/pki/ca-trust/source/anchors/ directory on hosts and enter the following commands:

   # update-ca-trust enable
   # update-ca-trust

   Copy to Clipboard Toggle word wrap

   Then register the hosts with a secure curl command, such as:

   # curl -sS https://satellite.example.com/register ...

   Copy to Clipboard Toggle word wrap

   The following is an example of the curl command with the --insecure option:

   # curl -sS --insecure https://satellite.example.com/register ...

   Copy to Clipboard Toggle word wrap
8. Select the Advanced tab.

9. From the Setup REX list, select whether you want to deploy Satellite SSH keys to hosts or not.

   If set to Yes, public SSH keys will be installed on the registered host. The inherited value is based on the host_registration_remote_execution parameter. It can be inherited, for example from a host group, an operating system, or an organization. When overridden, the selected value will be stored on host parameter level.

10. From the Setup Insights list, select whether you want to install insights-client and register the hosts to Insights.

    The Insights tool is available for Red Hat Enterprise Linux only. It has no effect on other operating systems.

    You must enable the following repositories on a registered machine:

    • RHEL 6: rhel-6-server-rpms
    • RHEL 7: rhel-7-server-rpms

    • RHEL 8: rhel-8-for-x86_64-appstream-rpms

      The insights-client package is installed by default on RHEL 8 except in environments whereby RHEL 8 was deployed with "Minimal Install" option.

11. Optional: In the Install packages field, list the packages (separated with spaces) that you want to install on the host upon registration. This can be set by the host_packages parameter.
12. Optional: Select the Update packages option to update all packages on the host upon registration. This can be set by the host_update_packages parameter.
13. Optional: In the Repository field, enter a repository to be added before the registration is performed. For example, it can be useful to make the subscription-manager package available for the purpose of the registration. For Red Hat family distributions, enter the URL of the repository, for example http://rpm.example.com/.
14. Optional: In the Repository GPG key URL field, specify the public key to verify the signatures of GPG-signed packages. It needs to be specified in the ASCII form with the GPG public key header.

15. Optional: In the Token lifetime (hours) field, change the validity duration of the JSON Web Token (JWT) that Satellite uses for authentication. The duration of this token defines how long the generated curl command works. You can set the duration to 0 – 999 999 hours or unlimited.

    Note that Satellite applies the permissions of the user who generates the curl command to authorization of hosts. If the user loses or gains additional permissions, the permissions of the JWT change too. Therefore, do not delete, block, or change permissions of the user during the token duration.

    The scope of the JWTs is limited to the registration endpoints only and cannot be used anywhere else.

16. Optional: In the Remote Execution Interface field, enter the identifier of a network interface that hosts must use for the SSH connection. If you keep this field blank, Satellite uses the default network interface.
17. In the Activation Keys field, enter one or more activation keys to assign to hosts.
18. Optional: Select the Lifecycle environment.
19. Optional: Select the Ignore errors option if you want to ignore subscription manager errors.
20. Optional: Select the Force option if you want to remove any katello-ca-consumer rpms before registration and run subscription-manager with the --force argument.
21. Click the Generate button.
22. Copy the generated curl command.
23. On the host that you want to register, run the curl command as root.

Procedure

1. Install the katello-agent package:

   # yum install katello-agent

   Copy to Clipboard Toggle word wrap

2. Start the goferd service:

   # systemctl start goferd

   Copy to Clipboard Toggle word wrap

Procedure

1. Log in to the host as the root user.

2. Install the Puppet agent package.

   • On hosts running Red Hat Enterprise Linux 8 and above:

     # dnf install puppet-agent

     Copy to Clipboard Toggle word wrap

   • On hosts running Red Hat Enterprise Linux 7 and below:

     # yum install puppet-agent

     Copy to Clipboard Toggle word wrap

3. Add the Puppet agent to PATH in your current shell using the following script:

   . /etc/profile.d/puppet-agent.sh

   Copy to Clipboard Toggle word wrap

4. Configure the Puppet agent. Set the environment parameter to the name of the Puppet environment to which the host belongs:

   # puppet config set server satellite.example.com --section agent
   # puppet config set environment My_Puppet_Environment --section agent

   Copy to Clipboard Toggle word wrap

5. Start the Puppet agent service:

   # puppet resource service puppet ensure=running enable=true

   Copy to Clipboard Toggle word wrap

6. Create a certificate for the host:

   # puppet ssl bootstrap

   Copy to Clipboard Toggle word wrap
7. In the Satellite web UI, navigate to Infrastructure > Capsules.
8. From the list in the Actions column for the required Capsule Server, select Certificates.
9. Click Sign to the right of the required host to sign the SSL certificate for the Puppet agent.

10. On the host, run the Puppet agent again:

    # puppet ssl bootstrap

    Copy to Clipboard Toggle word wrap

Procedure

1. Update the system:

   # {package-update}

   Copy to Clipboard Toggle word wrap

2. Install the cloud-init packages:

   # yum install cloud-utils-growpart cloud-init

   Copy to Clipboard Toggle word wrap

3. Open the /etc/cloud/cloud.cfg configuration file:

   # vi /etc/cloud/cloud.cfg

   Copy to Clipboard Toggle word wrap

4. Under the heading cloud_init_modules, add:

   - resolv-conf

   Copy to Clipboard Toggle word wrap

   The resolv-conf option automatically configures the resolv.conf when an instance boots for the first time. This file contains information related to the instance such as nameservers, domain and other options.

5. Open the /etc/sysconfig/network file:

   # vi /etc/sysconfig/network

   Copy to Clipboard Toggle word wrap

6. Add the following line to avoid problems accessing the EC2 metadata service:

   NOZEROCONF=yes

   Copy to Clipboard Toggle word wrap

7. Un-register the virtual machine so that the resulting image does not contain the same subscription details for every instance cloned based on it:

   # subscription-manager repos --disable=*
   # subscription-manager unregister

   Copy to Clipboard Toggle word wrap

8. Power off the instance:

   # poweroff

   Copy to Clipboard Toggle word wrap

9. On your Red Hat Enterprise Linux Workstation, connect to the terminal as the root user and navigate to the /var/lib/libvirt/images/ directory:

   # cd /var/lib/libvirt/images/

   Copy to Clipboard Toggle word wrap

10. Reset and clean the image using the virt-sysprep command so it can be used to create instances without issues:

    # virt-sysprep -d rhel7

    Copy to Clipboard Toggle word wrap

11. Reduce image size using the virt-sparsify command. This command converts any free space within the disk image back to free space within the host:

    # virt-sparsify --compress rhel7.qcow2 rhel7-cloud.qcow2

    Copy to Clipboard Toggle word wrap

    This creates a new rhel7-cloud.qcow2 file in the location where you enter the command.

Procedure

1. Update the system:

   # {package-update}

   Copy to Clipboard Toggle word wrap

2. Install the cloud-init packages:

   # yum install cloud-utils-growpart cloud-init

   Copy to Clipboard Toggle word wrap

3. Edit the /etc/cloud/cloud.cfg configuration file and under cloud_init_modules add:

   - resolv-conf

   Copy to Clipboard Toggle word wrap

   The resolv-conf option automatically configures the resolv.conf configuration file when an instance boots for the first time. This file contains information related to the instance such as nameservers, domain, and other options.

4. To prevent network issues, create the /etc/udev/rules.d/75-persistent-net-generator.rules file as follows:

   # echo "#" > /etc/udev/rules.d/75-persistent-net-generator.rules

   Copy to Clipboard Toggle word wrap

   This prevents /etc/udev/rules.d/70-persistent-net.rules file from being created. If /etc/udev/rules.d/70-persistent-net.rules is created, networking might not function properly when booting from snapshots (the network interface is created as "eth1" rather than "eth0" and IP address is not assigned).

5. Add the following line to /etc/sysconfig/network to avoid problems accessing the EC2 metadata service:

   NOZEROCONF=yes

   Copy to Clipboard Toggle word wrap

6. Un-register the virtual machine so that the resulting image does not contain the same subscription details for every instance cloned based on it:

   # subscription-manager repos --disable=*
   # subscription-manager unregister
   # yum clean all

   Copy to Clipboard Toggle word wrap

7. Power off the instance:

   # poweroff

   Copy to Clipboard Toggle word wrap

8. On your Red Hat Enterprise Linux Workstation, log in as root and reset and clean the image using the virt-sysprep command so it can be used to create instances without issues:

   # virt-sysprep -d rhel6

   Copy to Clipboard Toggle word wrap

9. Reduce image size using the virt-sparsify command. This command converts any free space within the disk image back to free space within the host:

   # virt-sparsify --compress rhel6.qcow2 rhel6-cloud.qcow2

   Copy to Clipboard Toggle word wrap

   This creates a new rhel6-cloud.qcow2 file in the location where you enter the command.

   Note

   You must manually resize the partitions of instances based on the image in accordance with the disk space in the flavor that is applied to the instance.