Chapter 4. Configuring and setting up remote jobs

1. Satellite finds the host’s interfaces that have the Remote execution checkbox selected.
2. Satellite finds the subnets of these interfaces.
3. Satellite finds remote execution Capsules assigned to these subnets.
4. From this set of Capsules, Satellite selects the Capsule that has the least number of running jobs. By doing this, Satellite ensures that the jobs load is balanced between remote execution Capsules.

Procedure

1. In the Satellite web UI, navigate to Hosts > Templates > Job templates.
2. Click New Job Template.
3. Click the Template tab, and in the Name field, enter a unique name for your job template.
4. Select Default to make the template available for all organizations and locations.
5. Create the template directly in the template editor or upload it from a text file by clicking Import.
6. Optional: In the Audit Comment field, add information about the change.
7. Click the Job tab, and in the Job category field, enter your own category or select from the default categories listed in Default Job Template Categories in Managing hosts.
8. Optional: In the Description Format field, enter a description template. For example, Install package %{package_name}. You can also use %{template_name} and %{job_category} in your template.
9. From the Provider Type list, select SSH for shell scripts and Ansible for Ansible tasks or playbooks.
10. Optional: In the Timeout to kill field, enter a timeout value to terminate the job if it does not complete.
11. Optional: Click Add Input to define an input parameter. Parameters are requested when executing the job and do not have to be defined in the template. For examples, see the Help tab.
12. Optional: Click Foreign input set to include other templates in this job.
13. Optional: In the Effective user area, configure a user if the command cannot use the default remote_execution_effective_user setting.
14. Optional: If this template is a snippet to be included in other templates, click the Type tab and select Snippet.
15. Optional: If you use the Ansible provider, click the Ansible tab. Select Enable Ansible Callback to allow hosts to send facts, which are used to create configuration reports, back to Satellite after a job finishes.
16. Click the Location tab and add the locations where you want to use the template.
17. Click the Organizations tab and add the organizations where you want to use the template.
18. Click Submit to save your changes.

Procedure

1. Fetch the available Ansible playbooks by using the following API request:

   # curl -X GET -H 'Content-Type: application/json' https://satellite.example.com/ansible/api/v2/ansible_playbooks/fetch?proxy_id=My_capsule_ID

2. Select the Ansible playbook you want to import and note its name.

3. Import the Ansible playbook by its name:

   # curl -X PUT -H 'Content-Type: application/json' -d '{ "playbook_names": ["My_Playbook_Name"] }' https://satellite.example.com/ansible/api/v2/ansible_playbooks/sync?proxy_id=My_capsule_ID

   You get a notification in the Satellite web UI after the import completes.

Procedure

1. In the Satellite web UI, navigate to Administer > Settings.
2. Click Remote Execution.
3. Configure the Fallback to Any Capsule setting.

Procedure

1. In the Satellite web UI, navigate to Administer > Settings.
2. Click Remote Execution.
3. Configure the Enable Global Capsule setting.

Procedure

1. On your Satellite Server or Capsule Server, create a new directory:

   # mkdir /My_Remote_Working_Directory

2. Copy the SELinux context from the default /tmp directory:

   # chcon --reference=/tmp /My_Remote_Working_Directory

3. Configure your Satellite Server or Capsule Server to use the new directory:

   # satellite-installer \
   --foreman-proxy-plugin-ansible-working-dir /My_Remote_Working_Directory

Procedure

1. Navigate to Administer > Settings.
2. Select the Remote Execution tab.
3. Click the value of the Effective User Method setting.
4. Select the new value.
5. Click Submit.

1. Section 4.14, “Distributing SSH keys for remote execution manually”.
2. Section 4.16, “Using the Satellite API to obtain SSH keys for remote execution”.
3. Section 4.17, “Configuring a Kickstart template to distribute SSH keys during provisioning”.
4. For new Satellite hosts, you can deploy SSH keys to Satellite hosts during registration using the global registration template. For more information, see Registering a Host to Red Hat Satellite Using the Global Registration Template in Managing hosts.

Procedure

1. On the target host, create the ~/.ssh directory to store the SSH key:

   # mkdir ~/.ssh

2. Download the SSH key from Capsule:

   # curl https://capsule.example.com:9090/ssh/pubkey >> ~/.ssh/authorized_keys

3. Configure permissions for the ~/.ssh directory:

   # chmod 700 ~/.ssh

4. Configure permissions for the authorized_keys file:

   # chmod 600 ~/.ssh/authorized_keys

Procedure

1. Find the ID of the foreman-proxy user:

   # id -u foreman-proxy

2. Modify the umask value so that new files have the permissions 600:

   # umask 077

3. Create the directory for the keytab:

   # mkdir -p "/var/kerberos/krb5/user/My_User_ID"

4. Create a keytab or copy an existing keytab to the directory:

   # cp My_Client.keytab /var/kerberos/krb5/user/My_User_ID/client.keytab

5. Change the directory owner to the foreman-proxy user:

   # chown -R foreman-proxy:foreman-proxy "/var/kerberos/krb5/user/My_User_ID"

6. Ensure that the keytab file is read-only:

   # chmod -wx "/var/kerberos/krb5/user/My_User_ID/client.keytab"

7. Restore the SELinux context:

   # restorecon -RvF /var/kerberos/krb5

Procedure

1. To install and enable Kerberos authentication for remote execution, enter the following command:

   # satellite-installer --foreman-proxy-plugin-remote-execution-script-ssh-kerberos-auth true

2. To edit the default user for remote execution, in the Satellite web UI, navigate to Administer > Settings and click the Remote Execution tab. In the SSH User row, edit the second column and add the user name for the Kerberos account.
3. Navigate to remote_execution_effective_user and edit the second column to add the user name for the Kerberos account.

Procedure

1. To clone a template, in the Actions column, select Clone.
2. Enter a unique name for the clone and click Submit to save the changes.

Procedure

1. In the Satellite web UI, navigate to Monitor > Jobs and click Run job.
2. Select the Job category and the Job template you want to use, then click Next.

3. Select hosts on which you want to run the job. If you do not select any hosts, the job will run on all hosts you can see in the current context.

   Note

   If you want to select a host group and all of its subgroups, it is not sufficient to select the host group as the job would only run on hosts directly in that group and not on hosts in subgroups. Instead, you must either select the host group and all of its subgroups or use this search query:

   hostgroup_fullname ~ "My_Host_Group*"

   Replace My_Host_Group with the name of the top-level host group.

4. If required, provide inputs for the job template. Different templates have different inputs and some templates do not have any inputs. After entering all the required inputs, click Next.
5. Optional: To configure advanced settings for the job, fill in the Advanced fields. To learn more about advanced settings, see Section 4.22, “Advanced settings in the job wizard”.
6. Click Next.

7. Schedule time for the job.

   • To execute the job immediately, keep the pre-selected Immediate execution.
   • To execute the job in future time, select Future execution.
   • To execute the job on regular basis, select Recurring execution.

8. Optional: If you selected future or recurring execution, select the Query type, otherwise click Next.

   • Static query means that job executes on the exact list of hosts that you provided.
   • Dynamic query means that the list of hosts is evaluated just before the job is executed. If you entered the list of hosts based on some filter, the results can be different from when you first used that filter.

   Click Next after you have selected the query type.

9. Optional: If you selected future or recurring execution, provide additional details:

   • For Future execution, enter the Starts at date and time. You also have the option to select the Starts before date and time. If the job cannot start before that time, it will be canceled.
   • For Recurring execution, select the start date and time, frequency, and the condition for ending the recurring job. You can choose the recurrence to never end, end at a certain time, or end after a given number of repetitions. You can also add Purpose - a special label for tracking the job. There can only be one active job with a given purpose at a time.

   Click Next after you have entered the required information.

10. Review job details. You have the option to return to any part of the job wizard and edit the information.
11. Click Submit to schedule the job for execution.

CLI procedure

1. Enter the following command on Satellite:

   # hammer settings set \
   --name=remote_execution_global_proxy \
   --value=false

2. Find the ID of the job template you want to use:

   # hammer job-template list

3. Show the template details to see parameters required by your template:

   # hammer job-template info --id My_Template_ID

4. Execute a remote job with custom parameters:

   # hammer job-invocation create \
   --inputs My_Key_1="My_Value_1",My_Key_2="My_Value_2",... \
   --job-template "My_Template_Name" \
   --search-query "My_Search_Query"

   Replace My_Search_Query with the filter expression that defines hosts, for example "name ~ My_Pattern". For more information about executing remote commands with hammer, enter hammer job-template --help and hammer job-invocation --help.

Procedure

1. In the Satellite web UI, navigate to Hosts > All Hosts and select the target host on which you want to execute a remote job.
2. On the Ansible tab, select Jobs.
3. Click Schedule recurring job.
4. Define the repetition frequency, start time, and date of the first run in the Create New Recurring Ansible Run window.
5. Click Submit.
6. Optional: View the scheduled Ansible job in host overview or by navigating to Ansible > Jobs.

Procedure

1. In the Satellite web UI, navigate to Configure > Host groups.
2. In the Actions column, select Configure Ansible Job for the host group you want to schedule an Ansible roles run for.
3. Click Schedule recurring job.
4. Define the repetition frequency, start time, and date of the first run in the Create New Recurring Ansible Run window.
5. Click Submit.

Procedure

1. In the Satellite web UI, navigate to Monitor > Jobs. This page is automatically displayed if you triggered the job with the Execute now setting. To monitor scheduled jobs, navigate to Monitor > Jobs and select the job run you wish to inspect.
2. On the Job page, click the Hosts tab. This displays the list of hosts on which the job is running.
3. In the Host column, click the name of the host that you want to inspect. This displays the Detail of Commands page where you can monitor the job execution in real time.
4. Click Back to Job at any time to return to the Job Details page.

CLI procedure

1. Find the ID of a job:

   # hammer job-invocation list

2. Monitor the job output:

   # hammer job-invocation output \
   --host My_Host_Name \
   --id My_Job_ID

3. Optional: To cancel a job, enter the following command:

   # hammer job-invocation cancel \
   --id My_Job_ID

Procedure

1. In the Satellite web UI, navigate to Administer > Remote Execution Features.
2. Find each feature whose name contains by_search.
3. Change the job template for these features from Katello Script Default to Katello Ansible Default.
4. Click Submit.