Configuring Satellite to use Ansible

Procedure

1. Add the roles to the /etc/ansible/roles directory on the Satellite and all Capsules from where you want to use the roles. If you want to use custom or third party Ansible roles, ensure to configure an external version control system to synchronize roles between Satellite and Capsules.

2. On all Capsules that you want to use to run Ansible roles on hosts, enable the Ansible plug-in:

   # satellite-installer --scenario capsule \
   --enable-foreman-proxy-plugin-ansible

3. Distribute SSH keys to enable Capsules to connect to hosts using SSH. For more information, see Distributing SSH Keys for Remote Execution in the Managing Hosts guide. Satellite runs Ansible roles the same way it runs remote execution jobs.
4. Import the Ansible roles into Satellite.
5. Proceed to Using Ansible Roles to Automate Repetitive Tasks on Satellite Hosts in Configuring Satellite To Use Ansible.

1. In the Satellite web UI, navigate to Configure > Roles and click the Capsule that contains the roles and variables that you want to import.
2. Click Submit.

Procedure

1. In the Satellite web UI, navigate to Configure > Variables.
2. Select the Ansible variable that you want to override and manage with Satellite.
3. Navigate to the Default Behavior area, and select the Override check box.
4. From the Parameter Type select the value type for validation. For example, a string or boolean variable.
5. In the Default Value field, enter the default value that you want to use if there is no match for the variable.
6. Optional: If you do not want to display the Ansible variable in plain text, select the Hidden Values check box to display the content of the variable as asterisks in the Satellite web UI.
7. To save the override settings, click Submit.

For a Host Group:

1. In the Satellite web UI, navigate to Configure > Host Groups, and select the host group that you want to use.
2. Click the Parameters tab, and in the Host Group Parameters area, click Add Parameter.
3. In the Name field, add the Ansible variable name.
4. From the Type list, select the type of the variable for validation.
5. In the Value field, enter the value for the variable.

For a Host:

1. In the Satellite web UI, navigate to Hosts > All Hosts, and on the host that you want to use, click the Edit button.
2. Click the Parameters tab, and in the Host Parameters area, click Add Parameter.
3. In the Name field, add the Ansible variable name.
4. From the Type list, select the type of the variable for validation.
5. In the Value field, enter the value for the variable.

To add as a Global Parameter:

1. In the Satellite web UI, navigate to Configure > Global Parameters, and click Create Parameter.
2. In the Name field, add the Ansible variable name.
3. From the Type list, select the type of the variable for validation.
4. In the Value field, enter the value for the variable.
5. Optional: If you do not want to display the Ansible variable in plain text, select the Hidden Values check box to display the content of the variable as asterisks in the Satellite web UI.

Procedure

1. Ensure that the rhel-7-server-extras-rpms repository is enabled.

   # subscription-manager repos --enable=rhel-7-server-extras-rpms

2. Install the rhel-system-roles package.

   # satellite-maintain packages install rhel-system-roles

   The rhel-system-roles package downloads to /usr/share/ansible/roles/. You can view and make any modifications that you want to the files before you import.

3. In the Satellite web UI, navigate to Configure > Roles and click the Capsule that contains the roles that you want to import.
4. From the list of Ansible roles, select the check box of the roles you want to import, and then click Update.

Procedure

1. In the Satellite web UI, navigate to Hosts > All Hosts.
2. On the host you want to assign an Ansible role to, click Edit.
3. Select the Ansible Roles tab, and in the All items list, search for the roles that you want to add.
4. Select the roles that you want to add, and click the arrow icon to move the roles to the Selected items list.
5. Click Submit.

Procedure

1. In the Satellite web UI, navigate to Hosts > All Hosts.
2. Select the check box of the host that contains the Ansible role you want to run.
3. From the Select Action list, select Play Ansible roles.

Procedure

1. In the Satellite web UI, navigate to Configure > Host Groups.
2. From the list of host groups, click the host group name that you want to add an Ansible Role to.
3. Select the Ansible Roles tab, and in the All items list, search for the roles that you want to add.
4. Select the roles that you want to add, and click the arrow icon to move the roles to the Selected items list.
5. Click Submit.

Procedure

1. In the Satellite web UI, navigate to Configure > Host Groups.
2. From the list in the Actions column for the host group, select Run all Ansible roles.

Procedure

1. In the Satellite web UI, navigate to Hosts > All Hosts.
2. Click Edit for the host you want to enable check mode for.
3. In the Parameters tab, ensure that the host has a parameter named ansible_roles_check_mode with type boolean set to true.
4. Click Submit.

1. Satellite finds the host’s interfaces that have the Remote execution check box selected.
2. Satellite finds the subnets of these interfaces.
3. Satellite finds remote execution Capsules assigned to these subnets.
4. From this set of Capsules, Satellite selects the Capsule that has the least number of running jobs. By doing this, Satellite ensures that the jobs load is balanced between remote execution Capsules.

5. If Satellite does not find a remote execution Capsule at this stage, and if the Fallback to Any Capsule setting is enabled, Satellite adds another set of Capsules to select the remote execution Capsule from. Satellite selects the most lightly loaded Capsule from the following types of Capsules that are assigned to the host:

   • DHCP, DNS and TFTP Capsules assigned to the host’s subnets
   • DNS Capsule assigned to the host’s domain
   • Realm Capsule assigned to the host’s realm
   • Puppet Master Capsule
   • Puppet CA Capsule
   • OpenSCAP Capsule
6. If Satellite does not find a remote execution Capsule at this stage, and if the Enable Global Capsule setting is enabled, Satellite selects the most lightly loaded remote execution Capsule from the set of all Capsules in the host’s organization and location to execute a remote job.

Procedure

1. Navigate to Hosts > Job templates.
2. Click New Job Template.
3. Click the Template tab, and in the Name field, enter a unique name for your job template.
4. Select Default to make the template available for all organizations and locations.
5. Create the template directly in the template editor or upload it from a text file by clicking Import.
6. Optional: In the Audit Comment field, add information about the change.
7. Click the Job tab, and in the Job category field, enter your own category or select from the default categories listed in Default Job Template Categories.
8. Optional: In the Description Format field, enter a description template. For example, Install package %{package_name}. You can also use %{template_name} and %{job_category} in your template.
9. From the Provider Type list, select SSH for shell scripts and Ansible for Ansible tasks or playbooks.
10. Optional: In the Timeout to kill field, enter a timeout value to terminate the job if it does not complete.
11. Optional: Click Add Input to define an input parameter. Parameters are requested when executing the job and do not have to be defined in the template. For examples, see the Help tab.
12. Optional: Click Foreign input set to include other templates in this job.
13. Optional: In the Effective user area, configure a user if the command cannot use the default remote_execution_effective_user setting.
14. Optional: If this template is a snippet to be included in other templates, click the Type tab and select Snippet.
15. Click the Location tab and add the locations where you want to use the template.
16. Click the Organizations tab and add the organizations where you want to use the template.
17. Click Submit to save your changes.

CLI procedure

1. To create a job template using a template-definition file, enter the following command:

   # hammer job-template create \
   --file "path_to_template_file" \
   --name "template_name" \
   --provider-type SSH \
   --job-category "category_name"

Procedure

1. In the Satellite web UI, navigate to Administer > Settings.
2. Click RemoteExecution.
3. Configure the Fallback to Any Capsule setting.

Procedure

1. In the Satellite web UI, navigate to Administer > Settings.
2. Click RemoteExection.
3. Configure the Enable Global Capsule setting.

Procedure

1. Create a new directory, for example new_place:

   # mkdir /remote_working_dir

2. Copy the SELinux context from the default var directory:

   # chcon --reference=/var /remote_working_dir

3. Configure the system:

1. Section 3.9, “Distributing SSH Keys for Remote Execution Manually”.
2. Section 3.10, “Using the Satellite API to Obtain SSH Keys for Remote Execution”.
3. Section 3.11, “Configuring a Kickstart Template to Distribute SSH Keys during Provisioning”.
4. For new Satellite hosts, you can deploy SSH keys to Satellite hosts during registration using the global registration template. For more information, see Registering a Host to Red Hat Satellite Using the Global Registration Template.

Procedure

1. Enter the following command on Capsule. Repeat for each target host you want to manage:

   # ssh-copy-id -i ~foreman-proxy/.ssh/id_rsa_foreman_proxy.pub root@target.example.com

2. To confirm that the key was successfully copied to the target host, enter the following command on Capsule:

   # ssh -i ~foreman-proxy/.ssh/id_rsa_foreman_proxy root@target.example.com

Procedure

1. On the target host, create the ~/.ssh directory to store the SSH key:

   # mkdir ~/.ssh

2. Download the SSH key from Capsule:

   # curl https://capsule.example.com:9090/ssh/pubkey >> ~/.ssh/authorized_keys

3. Configure permissions for the ~/.ssh directory:

   # chmod 700 ~/.ssh

4. Configure permissions for the authorized_keys file:

   # chmod 600 ~/.ssh/authorized_keys

Procedure

1. Find the ID of the foreman-proxy user:

   # id -u foreman-proxy

2. Modify the umask value so that new files have the permissions 600:

   # umask 077

3. Create the directory for the keytab:

   # mkdir -p "/var/kerberos/krb5/user/USER_ID"

4. Create a keytab or copy an existing keytab to the directory:

   # cp your_client.keytab /var/kerberos/krb5/user/USER_ID/client.keytab

5. Change the directory owner to the foreman-proxy user:

   # chown -R foreman-proxy:foreman-proxy "/var/kerberos/krb5/user/USER_ID"

6. Ensure that the keytab file is read-only:

   # chmod -wx "/var/kerberos/krb5/user/USER_ID/client.keytab"

7. Restore the SELinux context:

   # restorecon -RvF /var/kerberos/krb5

Procedure

1. To install and enable Kerberos authentication for remote execution, enter the following command:

   # satellite-installer --scenario satellite \
    --foreman-proxy-plugin-remote-execution-ssh-ssh-kerberos-auth true

2. To edit the default user for remote execution, in the Satellite web UI, navigate to Administer > Settings and click the RemoteExecution tab. In the SSH User row, edit the second column and add the user name for the Kerberos account.
3. Navigate to remote_execution_effective_user and edit the second column to add the user name for the Kerberos account.

Procedure

1. To clone a template, in the Actions column, select Clone.
2. Enter a unique name for the clone and click Submit to save the changes.

Procedure

1. Navigate to Hosts > All Hosts and select the target hosts on which you want to execute a remote job. You can use the search field to filter the host list.
2. From the Select Action list, select Schedule Remote Job.
3. On the Job invocation page, define the main job settings:
4. Select the Job category and the Job template you want to use.
5. Optional: Select a stored search string in the Bookmark list to specify the target hosts.
6. Optional: Further limit the targeted hosts by entering a Search query. The Resolves to line displays the number of hosts affected by your query. Use the refresh button to recalculate the number after changing the query. The preview icon lists the targeted hosts.
7. The remaining settings depend on the selected job template. See Creating a Job Template for information on adding custom parameters to a template.

8. Optional: To configure advanced settings for the job, click Display advanced fields. Some of the advanced settings depend on the job template, the following settings are general:

   • Effective user defines the user for executing the job, by default it is the SSH user.
   • Concurrency level defines the maximum number of jobs executed at once, which can prevent overload of systems' resources in a case of executing the job on a large number of hosts.
   • Timeout to kill defines time interval in seconds after which the job should be killed, if it is not finished already. A task which could not be started during the defined interval, for example, if the previous task took too long to finish, is canceled.
   • Type of query defines when the search query is evaluated. This helps to keep the query up to date for scheduled tasks.

   • Execution ordering determines the order in which the job is executed on hosts: alphabetical or randomized.

     Concurrency level and Timeout to kill settings enable you to tailor job execution to fit your infrastructure hardware and needs.

9. To run the job immediately, ensure that Schedule is set to Execute now. You can also define a one-time future job, or set up a recurring job. For recurring tasks, you can define start and end dates, number and frequency of runs. You can also use cron syntax to define repetition. For more information about cron, see the Automating System Tasks section of the Red Hat Enterprise Linux 7 System Administrator’s Guide.
10. Click Submit. This displays the Job Overview page, and when the job completes, also displays the status of the job.

1. Find the ID of the job template you want to use:

   # hammer job-template list

2. Show the template details to see parameters required by your template:

   # hammer job-template info --id template_ID

3. Execute a remote job with custom parameters:

   # hammer job-invocation create \
   --job-template "template_name" \
   --inputs key1="value",key2="value",... \
   --search-query "query"

   Replace query with the filter expression that defines hosts, for example "name ~ rex01". For more information about executing remote commands with hammer, enter hammer job-template --help and hammer job-invocation --help.

Procedure

1. Navigate to the Job page. This page is automatically displayed if you triggered the job with the Execute now setting. To monitor scheduled jobs, navigate to Monitor > Jobs and select the job run you wish to inspect.
2. On the Job page, click the Hosts tab. This displays the list of hosts on which the job is running.
3. In the Host column, click the name of the host that you want to inspect. This displays the Detail of Commands page where you can monitor the job execution in real time.
4. Click Back to Job at any time to return to the Job Details page.

1. Find the ID of a job:

   # hammer job-invocation list

2. Monitor the job output:

   # hammer job-invocation output \
   --id job_ID \
   --host host_name

3. Optional: to cancel a job, enter the following command:

   # hammer job-invocation cancel \
   --id job_ID

Procedure

1. In the Ansible Tower web UI, create a credential for your Satellite. For more information about creating credentials, see Add a New Credential and Red Hat Satellite 6 Credentials in the Ansible Tower User Guide.

   Table 4.1. Satellite Credentials

   Credential Type:	Red Hat Satellite 6
   Satellite 6 URL:	https://satellite.example.com
   Username:	The username of the Satellite user with the integration role.
   Password:	The password of the Satellite user.

2. Add an Ansible Tower user to the new credential. For more information about adding a user to a credential, see Getting Started with Credentials in the Ansible Tower User Guide.
3. Add a new inventory. For more information, see Add a new inventory in the Ansible Tower User Guide.

4. In the new inventory, add Satellite Server as the inventory source, specifying the following inventory source options. For more information, see Add Source in the Ansible Tower User Guide.

   Table 4.2. Inventory Source Options

   Source	Red Hat Satellite 6
   Credential	The credential you create for Satellite Server.
   Overwrite	Select
   Overwrite Variables	Select
   Update on Launch	Select
   Cache Timeout	90

5. Ensure that you synchronize the source that you add.

1. ansible_provisioning_callback
2. ansible_tower_callback_script
3. ansible_tower_callback_service

1. Create a machine credential for your new host. Ensure that you enter the same password in the credential that you plan to assign to the host that you create in Satellite. For more information, see Add a New Credential in the Ansible Tower User Guide.
2. Create a project. For more information, see Projects in the Ansible Tower User Guide.
3. Add a job template to your project. For more information, see Job Templates in the Ansible Tower User Guide.
4. In your job template, you must enable provisioning callbacks, generate the host configuration key, and note the template_ID of your job template. For more information about job templates, see Job Templates in the Ansible Tower User Guide.

Procedure

1. In the Red Hat Satellite web UI, navigate to Configure > Host Group.
2. Create a host group or edit an existing host group.
3. In the Host Group window, click the Parameters tab.
4. Click Add Parameter.

5. Enter the following information for each new parameter:

   Table 4.3. Host Parameters

   Name	Value	Description
   ansible_tower_provisioning	true	Enables Provisioning Callback.
   ansible_tower_fqdn	tower.example.com	The fully qualified domain name (FQDN) of your Ansible Tower. Do not add https because this is appended by Ansible Tower.
   ansible_job_template_id	template_ID	The ID of your provisioning template that you can find in the URL of the template: /templates/job_template/5.
   ansible_host_config_key	config_KEY	The host configuration key that your job template generates in Ansible Tower.

6. Click Submit.
7. Create a host using the host group.

8. On the new host, enter the following command to start the ansible-callback service:

   # systemctl start ansible-callback

9. On the new host, enter the following command to output the status of the ansible-callback service:

   # systemctl status ansible-callback

   Provisioning callback is configured correctly if the command returns the following output:

   SAT_host systemd[1]: Started Provisioning callback to Ansible Tower...