Chapter 1. Client tools and components
RHEL client tools such as insights-client, subscription-manager, and rhc client handle system registration, entitlement management, and proactive remediation. These tools integrate with each other to help you connect your RHEL system to Red Hat services.
1.1. Client tools and components overview Copy linkLink copied to clipboard!
Red Hat Enterprise Linux (RHEL) includes several client tools that work together to register your systems and connect them to Red Hat services.
- rhc client
- The primary registration tool for connecting RHEL systems to the Red Hat Hybrid Cloud Console. It coordinates with the other two clients to handle registration, configuration, and remote management in a single workflow.
- subscription-manager
- Handles system identity and subscription entitlements, and provides access to Red Hat package repositories through the Content Delivery Network (CDN).
- insights-client
- Gathers system data and sends it to Red Hat Lightspeed for analysis. It depends on subscription-manager for system identity.
1.2. The rhc client Copy linkLink copied to clipboard!
The rhc client is the recommended tool to register and manage your RHEL systems that are connected to the Red Hat Hybrid Cloud Console.
To register and connect systems with Red Hat Satellite or Capsule, see the Red Hat Satellite product documentation.
The rhc client works with insights-client and subscription-manager to offer a unified client experience. This experience includes system registration to Red Hat, feature level configuration, and remote management.
The remote host configuration service has two main components:
- The rhc client remote host configuration client (a client-side daemon)
- The remote host configuration manager (a server-side service)
1.2.1. RHC client capabilities Copy linkLink copied to clipboard!
The remote host configuration (rhc) client provides easy registration and remote remediation capabilities for RHEL systems connected to Red Hat Lightspeed.
- Easy registration
- With the rhc client, you can register systems to Red Hat Subscription Management (RHSM) and Red Hat Lightspeed.
- Remediations and Tasks from Red Hat Lightspeed
- When you connect systems to Red Hat Lightspeed with the rhc client, registered systems can run tasks and remediation playbooks that Red Hat Lightspeed generates automatically from remediation plans by using the Automation Toolkit.
1.2.2. RHC client components and support Copy linkLink copied to clipboard!
The rhc client is preinstalled and fully supported with all Red Hat Enterprise Linux (RHEL) 8.6 and later installations, with the exception of minimal installations.
The rhc client consists of the following utility programs:
-
The
yggdrasil(rhcdon version RHEL 9 and earlier) daemon runs on the system and listens for messages from the Hybrid Cloud Console. On properly configured systems, theyggdrasildaemon can receive and run playbooks that are generated by Red Hat Lightspeed remediation plans. -
The
rhccommand-line utility for RHEL.
1.3. The subscription-manager client Copy linkLink copied to clipboard!
The subscription-manager client establishes your system’s identity and provides access to the Red Hat Content Delivery Network (CDN) for updates and packages. This registration method provides limited Red Hat Subscription Management features.
For additional features provided by Red Hat Lightspeed, consider using the rhc client.
1.4. The insights-client Copy linkLink copied to clipboard!
The insights-client collects system data and sends it to Red Hat Lightspeed for analysis. The insights-client relies on the subscription-manager client to establish the identity of the system.
The insights-client is available for these RHEL releases.
| RHEL release | Comments |
|---|---|
| RHEL 10 | Distributed with insights-client pre-installed. |
| RHEL 9 | Distributed with insights-client pre-installed. |
| RHEL 8 | Distributed with insights-client pre-installed, unless RHEL 8 was installed as a minimal installation. |
| RHEL 7 | Distributed with the insights-client RPM package loaded but not installed. |
1.5. Manage user permissions for Red Hat Lightspeed services Copy linkLink copied to clipboard!
Manage user permissions to control access to Red Hat Lightspeed applications. Use the User Access feature to apply role-based access control (RBAC). Red Hat provides predefined groups and roles to help Organization Administrators manage user permissions.
1.5.1. User Access overview Copy linkLink copied to clipboard!
You can simplify access management in the Red Hat Hybrid Cloud Console by using role-based access control (RBAC). The User Access feature assigns specific permissions to roles instead of individual users, which are then inherited when roles are assigned to user groups.
You can also create custom groups and roles to provide more fine-tuned control over specific features of Red Hat Lightspeed to suit the needs of your organization.
If you are an Organization Administrator, you can use the User Access feature under
- Control user permissions and organize roles.
- Create groups that include roles and their corresponding permissions.
- Assign users to these groups, allowing them to inherit the permissions associated with their group’s roles.
1.5.2. Predefined groups in User Access Copy linkLink copied to clipboard!
The two predefined groups available in User Access, Default access and Default admin access provide different baseline privilege levels for users in your organization. You can also create custom groups to align permissions with specific personas, job functions, or teams in your organization.
- The Default access group
- By default, the Default access group is assigned many granular predefined roles, so that group members have basic visibility. Because all users in your organization are members of the Default access group, they inherit all permissions assigned to that group. The Default access group is automatically updated by Red Hat.
If your Organization Administrator modifies the Default access group, for example, by removing roles to restrict access to specific applications or to use the consolidated roles, the group is automatically renamed to Custom default access. Once converted, this group is no longer automatically updated by Red Hat.
- The Default admin access group
- The Default admin access group contains only users who have Organization Administrator permissions. This group is automatically maintained, and users and roles in this group cannot be changed.
The Default admin access group includes many (but not all) predefined roles that provide update and delete permissions. The roles in this group usually include administrator in their names.
To view the roles included in the Default access or Default admin access group, log in to the Hybrid Cloud Console, navigate to Groups in User Access, and select the group.
1.5.3. Predefined roles assigned to groups Copy linkLink copied to clipboard!
Understand how predefined roles in Red Hat Hybrid Cloud Console bundle permissions across multiple Red Hat Lightspeed applications to align with common user personas. Use predefined roles to reduce administrative effort, or create custom roles for more fine-tuned control over specific features.
The predefined roles are a starting point to help you control and manage user permissions. You can then use these roles to create custom roles that are tailored to your specific use cases and organization. For example, you can use the predefined granular roles to create custom roles that provide more fine-tuned control over specific features of Red Hat Lightspeed.
By default, Red Hat provides a set of consolidated roles and a set of granular roles in the Red Hat Hybrid Cloud Console User Access UI. The consolidated roles significantly reduce the administrative effort required to manage user permissions, while the granular roles provide more fine-tuned control over specific features of Red Hat Lightspeed.
You can use the predefined consolidated and granular roles in User Access simultaneously, but using consolidated roles can significantly reduce the administrative effort.
- Select from the predefined consolidated roles library
The Red Hat Hybrid Cloud Console provides three predefined, consolidated User Access roles to help you manage user permissions to Red Hat Lightspeed applications and services that run on registered Red Hat Enterprise Linux systems. These roles help simplify how the Organization Administrator creates groups and permissions for various levels of access to the Red Hat Lightspeed services. If you want to reduce the administrative effort required to manage user permissions and your use case aligns with the permissions included in these roles, select from the consolidated roles library.
The consolidated roles are as follows:
RHEL viewer: The RHEL viewer role provides users visibility without the ability to make changes. It allows read-only access to Red Hat Lightspeed. You can view system configurations, compliance reports, inventory data, patch information, vulnerabilities, and overall resource states and activities. The only action permitted with this role is to generate activation keys.
RHEL operator: The RHEL operator role allows active management of your Red Hat Lightspeed environment. With this role, you can edit system configurations, inventory details, policies, and notification/integration settings. The RHEL operator role allows many of the RHEL administrator role functions, but it is restricted from editing compliance policies, content source templates, policies, or tasks. In addition, the RHEL operator role cannot execute remediation plans.
RHEL administrator: The RHEL administrator role provides comprehensive administrative privileges across your RHEL systems and Red Hat Lightspeed. With this role, you can manage system configurations, inventory, compliance policies, notifications, patch management, remediations, malware detection, and advisor recommendations. The role can also view and modify all vulnerability settings.
ImportantTo use the consolidated roles effectively, you might need to remove the granular RHEL roles from the Default access group to prevent permission conflicts. This action automatically changes the name of the predefined Default access group to Custom default access group, after which, it is no longer automatically updated by Red Hat.
See Predefined User Access roles for a list of the roles included in the Default admin access group and a reference table that lists most of the predefined groups and roles that are available in the Red Hat Hybrid Cloud Console and the permissions included in each role.
- Granular roles
- The granular roles are specific roles for individual services that allow for fine-tuned control over specific features of Red Hat Lightspeed, for example, Inventory Hosts administrator or Compliance viewer. If you want to have more control over specific features of Red Hat Lightspeed and your use case does not align with the permissions included in the consolidated roles, use the granular predefined roles.
Across the Red Hat Lightspeed product documentation, the Prerequisites section for each procedure lists which predefined roles provide the permissions needed to use the features in that procedure. For example, if a procedure requires permissions to create and view remediations, the Prerequisites section for that procedure lists the Remediations user or other valid role as a recommended predefined role to use for that procedure.
1.5.4. Check your permissions Copy linkLink copied to clipboard!
Verify your current permissions and the roles or groups assigned to you in the Red Hat Hybrid Cloud Console. Check your permissions to troubleshoot access issues or understand your level of access to Red Hat Lightspeed applications.
Only users with the Organization Administrator role can view the permissions of other users in the User Access settings and manage user permissions to Red Hat Lightspeed services. For more information, see the Configure user permissions section.
Prerequisites
- You are logged in to the Red Hat Hybrid Cloud Console.
Procedure
Verification
All of the applications that you have permissions to access are listed on this page and are grouped by product, for example, RHEL, OpenShift Container Platform, and Ansible Automation Platform.
You can also filter your permissions by application, for example, by advisor, cost management, inventory, and remediations.
1.5.5. Configure user permissions Copy linkLink copied to clipboard!
If you are an Organization Administrator, you can view and manage user permissions for all users in your organization. Control access to Red Hat Lightspeed and other Red Hat Hybrid Cloud Console services through the User Access interface.
Prerequisites
- You have logged in to the Red Hat Hybrid Cloud Console as an Organization Administrator, or you have the required administrator User Access role permissions.
Verification
From here, you can create and manage:
1.5.6. User Access roles for using the remote host configuration manager Copy linkLink copied to clipboard!
Understand the predefined roles that control permissions to manage and remediate your RHEL systems remotely using the remote host configuration manager with Red Hat Lightspeed. Use these role definitions to assign appropriate permissions to users based on their responsibilities.
The following User Access roles enable standard or enhanced access to the remote host configuration manager in the Red Hat Hybrid Cloud Console:
| User Access role | Grants permissions to … | Included in the Default access group |
|---|---|---|
| RHC administrator |
| |
| RHC user |
| X |
| RHEL administrator |
| |
| RHEL operator |
Note The RHEL operator role is restricted from editing compliance policies, content source templates, policies, or tasks. Also, the RHEL operator role cannot execute remediation plans. | |
| RHEL viewer |
Note Cannot perform actions other than generating activation keys. |
See also the following information about the required User Access roles for remotely executing remediation plans in the Red Hat Hybrid Cloud Console:
1.6. Install the insights-client Copy linkLink copied to clipboard!
The insights-client is automatically installed with default RHEL installations. Manual installation is required for deployments such as minimal and cloud-based installations.
Installation steps vary slightly depending on your RHEL version and installation type. After you install the insights-client, register your system. Some registration methods require activation keys.
1.6.1. Install insights-client on existing Red Hat Cloud Access-managed systems Copy linkLink copied to clipboard!
You can install insights-client on an existing Red Hat Enterprise Linux (RHEL) system that is connected to Red Hat Cloud Access. Installing insights-client gives you automated system health checks and other services to find and fix issues before they cause problems with systems in your organization.
1.6.2. Install insights-client on an existing system managed by Red Hat Update Infrastructure Copy linkLink copied to clipboard!
Install the insights-client on an existing Red Hat Enterprise Linux system purchased from a cloud marketplace and managed by Red Hat Update Infrastructure (RHUI). The insights-client provides automated health checks and services to find and fix issues before they affect your systems.
Prerequisites
- Root-level access for the system.
Procedure
Enter the following command to install the current version of the insights-client package:
RHEL versions 6 and 7
[root@server ~]# yum install insights-clientRHEL version 8 and later
[root@server ~]# dnf install insights-client
Verification
Run the following command to confirm successful installation of the insights-client:
+
[root@server ~]# insights-client --version
1.7. Client command-line interface and configuration interaction Copy linkLink copied to clipboard!
The insights-client runs automatically based on its scheduler settings. By default, it runs every 24 hours. To run the client interactively, enter the insights-client command.
When you run insights-client, the following values and settings determine the results:
-
Values that you enter when you run
insights-clientfrom the command line temporarily override the preset configuration file settings and system environment settings. Any values that you enter for options in theinsights-clientcommand are used only for that instance of insights-client. -
Settings in the configuration file (
/etc/insights-client/insights-client.conf) override system environment settings. -
Values of any system environment variables (
printenv) are not affected by the commands entered on the command line or the client configuration files.