Chapter 4. Configuring and Setting Up Remote Jobs

1. Satellite finds the host’s interfaces that have the Remote execution checkbox selected.
2. Satellite finds the subnets of these interfaces.
3. Satellite finds remote execution Capsules assigned to these subnets.
4. From this set of Capsules, Satellite selects the Capsule that has the least number of running jobs. By doing this, Satellite ensures that the jobs load is balanced between remote execution Capsules.

Procedure

1. Install the katello-pull-transport-migrate package on your host:

   • On Red Hat Enterprise Linux 8 and Red Hat Enterprise Linux 9 hosts:

     # dnf install katello-pull-transport-migrate

   • On Red Hat Enterprise Linux 7 hosts:

     # yum install katello-pull-transport-migrate

   The package installs foreman_ygg_worker and yggdrasil as dependencies and enables the pull mode on the host. The host’s subscription-manager configuration and consumer certificates are used to configure the yggdrasil client on the host, and the pull mode client worker is started.

2. Optional: To verify that the pull client is running and configured properly, check the status of the yggdrasild service:

   # systemctl status yggdrasild

3. Optional: After the package is installed, you can remove katello-agent from the host.

   Warning

   If your host is installed on Red Hat Virtualization version 4.4 or lower, do not remove the katello-agent package because the removed dependencies corrupt the host.

Procedure

1. In the Satellite web UI, navigate to Hosts > Job templates.
2. Click New Job Template.
3. Click the Template tab, and in the Name field, enter a unique name for your job template.
4. Select Default to make the template available for all organizations and locations.
5. Create the template directly in the template editor or upload it from a text file by clicking Import.
6. Optional: In the Audit Comment field, add information about the change.
7. Click the Job tab, and in the Job category field, enter your own category or select from the default categories listed in Default Job Template Categories in Managing Hosts.
8. Optional: In the Description Format field, enter a description template. For example, Install package %{package_name}. You can also use %{template_name} and %{job_category} in your template.
9. From the Provider Type list, select SSH for shell scripts and Ansible for Ansible tasks or playbooks.
10. Optional: In the Timeout to kill field, enter a timeout value to terminate the job if it does not complete.
11. Optional: Click Add Input to define an input parameter. Parameters are requested when executing the job and do not have to be defined in the template. For examples, see the Help tab.
12. Optional: Click Foreign input set to include other templates in this job.
13. Optional: In the Effective user area, configure a user if the command cannot use the default remote_execution_effective_user setting.
14. Optional: If this template is a snippet to be included in other templates, click the Type tab and select Snippet.
15. Click the Location tab and add the locations where you want to use the template.
16. Click the Organizations tab and add the organizations where you want to use the template.
17. Click Submit to save your changes.

Procedure

1. Fetch the available Ansible playbooks by using the following API request:

   # curl -X GET -H 'Content-Type: application/json' https://satellite.example.com/ansible/api/v2/ansible_playbooks/fetch?proxy_id=My_capsule_ID

2. Select the Ansible playbook you want to import and note its name.

3. Import the Ansible playbook by its name:

   # curl -X PUT -H 'Content-Type: application/json' -d '{ "playbook_names": ["My_Playbook_Name"] }' https://satellite.example.com/ansible/api/v2/ansible_playbooks/sync?proxy_id=My_capsule_ID

   You get a notification in the Satellite web UI after the import completes.

Procedure

1. In the Satellite web UI, navigate to Administer > Settings.
2. Click Remote Execution.
3. Configure the Fallback to Any Capsule setting.

Procedure

1. In the Satellite web UI, navigate to Administer > Settings.
2. Click Remote Execution.
3. Configure the Enable Global Capsule setting.

Procedure

1. On your Satellite Server or Capsule Server, create a new directory:

   # mkdir /My_Remote_Working_Directory

2. Copy the SELinux context from the default /tmp directory:

   # chcon --reference=/tmp /My_Remote_Working_Directory

3. Configure your Satellite Server or Capsule Server to use the new directory:

   # satellite-installer \
   --foreman-proxy-plugin-ansible-working-dir /My_Remote_Working_Directory

Procedure

1. Navigate to Administer > Settings.
2. Select the Remote Execution tab.
3. Click the value of the Effective User Method setting.
4. Select the new value.
5. Click Submit.

1. Section 4.14, “Distributing SSH Keys for Remote Execution Manually”.
2. Section 4.16, “Using the Satellite API to Obtain SSH Keys for Remote Execution”.
3. Section 4.17, “Configuring a Kickstart Template to Distribute SSH Keys During Provisioning”.
4. For new Satellite hosts, you can deploy SSH keys to Satellite hosts during registration using the global registration template. For more information, see Registering a Host to Red Hat Satellite Using the Global Registration Template in Managing Hosts.

Procedure

1. On the target host, create the ~/.ssh directory to store the SSH key:

   # mkdir ~/.ssh

2. Download the SSH key from Capsule:

   # curl https://capsule.example.com:9090/ssh/pubkey >> ~/.ssh/authorized_keys

3. Configure permissions for the ~/.ssh directory:

   # chmod 700 ~/.ssh

4. Configure permissions for the authorized_keys file:

   # chmod 600 ~/.ssh/authorized_keys

Procedure

1. Find the ID of the foreman-proxy user:

   # id -u foreman-proxy

2. Modify the umask value so that new files have the permissions 600:

   # umask 077

3. Create the directory for the keytab:

   # mkdir -p "/var/kerberos/krb5/user/My_User_ID"

4. Create a keytab or copy an existing keytab to the directory:

   # cp My_Client.keytab /var/kerberos/krb5/user/My_User_ID/client.keytab

5. Change the directory owner to the foreman-proxy user:

   # chown -R foreman-proxy:foreman-proxy "/var/kerberos/krb5/user/My_User_ID"

6. Ensure that the keytab file is read-only:

   # chmod -wx "/var/kerberos/krb5/user/My_User_ID/client.keytab"

7. Restore the SELinux context:

   # restorecon -RvF /var/kerberos/krb5

Procedure

1. To install and enable Kerberos authentication for remote execution, enter the following command:

   # satellite-installer --scenario satellite \
   --foreman-proxy-plugin-remote-execution-script-ssh-kerberos-auth true

2. To edit the default user for remote execution, in the Satellite web UI, navigate to Administer > Settings and click the Remote Execution tab. In the SSH User row, edit the second column and add the user name for the Kerberos account.
3. Navigate to remote_execution_effective_user and edit the second column to add the user name for the Kerberos account.

Procedure

1. To clone a template, in the Actions column, select Clone.
2. Enter a unique name for the clone and click Submit to save the changes.

Procedure

1. In the Satellite web UI, navigate to Hosts > All Hosts and select the target hosts on which you want to execute a remote job. You can use the search field to filter the host list.
2. From the Select Action list, select Schedule a Job.
3. On the Job invocation page, define the main job settings:
4. Select the Job category and the Job template you want to use.
5. Optional: Select a stored search string in the Bookmark list to specify the target hosts.
6. Optional: Further limit the targeted hosts by entering a Search query. The Resolves to line displays the number of hosts affected by your query. Use the refresh button to recalculate the number after changing the query. The preview icon lists the targeted hosts.
7. The remaining settings depend on the selected job template. See Creating a Job Template for information on adding custom parameters to a template.

8. Optional: To configure advanced settings for the job, click Display advanced fields. Some of the advanced settings depend on the job template, the following settings are general:

   • Effective user defines the user for executing the job, by default it is the SSH user.
   • Concurrency level defines the maximum number of jobs executed at once, which can prevent overload of systems' resources in a case of executing the job on a large number of hosts.
   • Timeout to kill defines time interval in seconds after which the job should be killed, if it is not finished already. A task which could not be started during the defined interval, for example, if the previous task took too long to finish, is canceled.
   • Type of query defines when the search query is evaluated. This helps to keep the query up to date for scheduled tasks.

   • Execution ordering determines the order in which the job is executed on hosts: alphabetical or randomized.

     Concurrency level and Timeout to kill settings enable you to tailor job execution to fit your infrastructure hardware and needs.

9. To run the job immediately, ensure that Schedule is set to Execute now. You can also define a one-time future job, or set up a recurring job. For recurring tasks, you can define start and end dates, number and frequency of runs. You can also use cron syntax to define repetition. For more information about cron, see Automate your Linux system tasks with cron.
10. Click Submit. You can view status of the jobs in the Recent Jobs section on the same page.

CLI procedure

1. Enter the following command on Satellite:

   # hammer settings set \
   --name=remote_execution_global_proxy \
   --value=false

2. Find the ID of the job template you want to use:

   # hammer job-template list

3. Show the template details to see parameters required by your template:

   # hammer job-template info --id My_Template_ID

4. Execute a remote job with custom parameters:

   # hammer job-invocation create \
   --inputs My_Key_1="My_Value_1",My_Key_2="My_Value_2",... \
   --job-template "My_Template_Name" \
   --search-query "My_Search_Query"

   Replace My_Search_Query with the filter expression that defines hosts, for example "name ~ My_Pattern". For more information about executing remote commands with hammer, enter hammer job-template --help and hammer job-invocation --help.

Procedure

1. In the Satellite web UI, navigate to Hosts > All Hosts and select the target host on which you want to execute a remote job.
2. On the Ansible tab, select Jobs.
3. Click Schedule recurring job.
4. Define the repetition frequency, start time, and date of the first run in the Create New Recurring Ansible Run window.
5. Click Submit.
6. Optional: View the scheduled Ansible job in host overview or by navigating to Ansible > Jobs.

Procedure

1. In the Satellite web UI, navigate to Configure > Host groups.
2. In the Actions column, select Configure Ansible Job for the host group you want to schedule an Ansible roles run for.
3. Click Schedule recurring job.
4. Define the repetition frequency, start time, and date of the first run in the Create New Recurring Ansible Run window.
5. Click Submit.

Procedure

1. In the Satellite web UI, navigate to Monitor > Jobs. This page is automatically displayed if you triggered the job with the Execute now setting. To monitor scheduled jobs, navigate to Monitor > Jobs and select the job run you wish to inspect.
2. On the Job page, click the Hosts tab. This displays the list of hosts on which the job is running.
3. In the Host column, click the name of the host that you want to inspect. This displays the Detail of Commands page where you can monitor the job execution in real time.
4. Click Back to Job at any time to return to the Job Details page.

CLI procedure

1. Find the ID of a job:

   # hammer job-invocation list

2. Monitor the job output:

   # hammer job-invocation output \
   --host "My_Host_Name" \
   --id My_Job_ID

3. Optional: To cancel a job, enter the following command:

   # hammer job-invocation cancel \
   --id My_Job_ID