Chapter 4. Configuring Capsule Servers for Load Balancing
This chapter outlines how to configure Capsule Servers for load balancing. Proceed to one of the following sections depending on your Satellite Server configuration:
- Section 4.1, “Configuring Capsule Server with Default SSL Certificates for Load Balancing without Puppet”
- Section 4.2, “Configuring Capsule Server with Default SSL Certificates for Load Balancing with Puppet”
- Section 4.3.2, “Configuring Capsule Server with Custom SSL Certificates for Load Balancing without Puppet”
- Section 4.4, “Configuring Capsule Server with Custom SSL Certificates for Load Balancing with Puppet”
Use different file names for the Katello certificates you create for each Capsule Server. For example, name the certificate archive file with Capsule Server FQDN.
4.1. Configuring Capsule Server with Default SSL Certificates for Load Balancing without Puppet
The following section describes how to configure Capsule Servers that use default SSL certificates for load balancing without Puppet. Complete this procedure on each Capsule Server that you want to configure for load balancing.
Procedure
On Satellite Server, generate Katello certificates for Capsule Server:
# capsule-certs-generate \ --certs-tar "/root/capsule.example.com-certs.tar" \ --foreman-proxy-cname loadbalancer.example.com \ --foreman-proxy-fqdn capsule.example.com
Retain a copy of the example
satellite-installer
command that is output by thecapsule-certs-generate
command for installing Capsule Server certificate.Copy the certificate archive file from Satellite Server to Capsule Server.
# scp /root/capsule.example.com-certs.tar root@capsule.example.com:/root/capsule.example.com-certs.tar
Append the following options to the
satellite-installer
command that you obtain from the output of thecapsule-certs-generate
command:--certs-cname "loadbalancer.example.com" \ --enable-foreman-proxy-plugin-remote-execution-script
On Capsule Server, enter the
satellite-installer
command:# satellite-installer --scenario capsule \ --certs-cname "loadbalancer.example.com" \ --certs-tar-file "capsule.example.com-certs.tar" \ --enable-foreman-proxy-plugin-remote-execution-script \ --foreman-proxy-foreman-base-url "https://satellite.example.com" \ --foreman-proxy-oauth-consumer-key "oauth key" \ --foreman-proxy-oauth-consumer-secret "oauth secret" \ --foreman-proxy-register-in-foreman "true" \ --foreman-proxy-trusted-hosts "satellite.example.com" \ --foreman-proxy-trusted-hosts "capsule.example.com"
4.2. Configuring Capsule Server with Default SSL Certificates for Load Balancing with Puppet
The following section describes how to configure Capsule Servers that use default SSL certificates for load balancing with Puppet.
If you use Puppet in your Satellite configuration, you must complete the following procedures:
4.2.1. Configuring Capsule Server with Default SSL Certificates to Generate and Sign Puppet Certificates
Complete this procedure only for the system where you want to configure Capsule Server to generate and sign Puppet certificates for all other Capsule Servers that you configure for load balancing.
Procedure
On Satellite Server, generate Katello certificates for the system where you configure Capsule Server to generate and sign Puppet certificates:
# capsule-certs-generate \ --certs-tar "/root/capsule-ca.example.com-certs.tar" \ --foreman-proxy-cname loadbalancer.example.com \ --foreman-proxy-fqdn capsule-ca.example.com
Retain a copy of the example
satellite-installer
command that is output by thecapsule-certs-generate
command for installing Capsule Server certificate.Copy the certificate archive file from Satellite Server to Capsule Server:
# scp /root/capsule-ca.example.com-certs.tar root@capsule-ca.example.com:capsule-ca.example.com-certs.tar
Append the following options to the
satellite-installer
command that you obtain from the output of thecapsule-certs-generate
command:--certs-cname "loadbalancer.example.com" \ --enable-foreman-proxy-plugin-remote-execution-script \ --foreman-proxy-puppetca "true" \ --puppet-ca-server "capsule-ca.example.com" \ --puppet-dns-alt-names "loadbalancer.example.com" \ --puppet-server-ca "true"
On Capsule Server, enter the
satellite-installer
command:# satellite-installer --scenario capsule \ --certs-cname "loadbalancer.example.com" \ --certs-tar-file "capsule-ca.example.com-certs.tar" \ --enable-foreman-proxy-plugin-remote-execution-script \ --enable-puppet \ --foreman-proxy-foreman-base-url "https://satellite.example.com" \ --foreman-proxy-oauth-consumer-key "oauth key" \ --foreman-proxy-oauth-consumer-secret "oauth secret" \ --foreman-proxy-puppetca "true" \ --foreman-proxy-register-in-foreman "true" \ --foreman-proxy-trusted-hosts "satellite.example.com" \ --foreman-proxy-trusted-hosts "capsule-ca.example.com" \ --puppet-ca-server "capsule-ca.example.com" \ --puppet-dns-alt-names "loadbalancer.example.com" \ --puppet-server true \ --puppet-server-ca "true" \ --puppet-server-foreman-url "https://satellite.example.com"
On Capsule Server, stop the Puppet server:
# puppet resource service puppetserver ensure=stopped
Generate Puppet certificates for all other Capsule Servers that you configure for load balancing, except the first system where you configure Puppet certificates signing:
# puppetserver ca generate \ --ca-client \ --certname capsule.example.com \ --subject-alt-names loadbalancer.example.com
This command creates the following files on the system where you configure Capsule Server to sign Puppet certificates:
-
/etc/puppetlabs/puppet/ssl/certs/capsule.example.com.pem
-
/etc/puppetlabs/puppet/ssl/certs/ca.pem
-
/etc/puppetlabs/puppet/ssl/private_keys/capsule.example.com.pem
-
/etc/puppetlabs/puppet/ssl/public_keys/capsule.example.com.pem
-
Resume the Puppet server:
# puppet resource service puppetserver ensure=running
4.2.2. Configuring Remaining Capsule Servers with Default SSL Certificates for Load Balancing
Complete this procedure on each Capsule Server excluding the system where you configure Capsule Server to sign Puppet certificates.
Procedure
On Satellite Server, generate Katello certificates for Capsule Server:
# capsule-certs-generate \ --certs-tar "/root/capsule.example.com-certs.tar" \ --foreman-proxy-cname loadbalancer.example.com \ --foreman-proxy-fqdn capsule.example.com
Retain a copy of the example
satellite-installer
command that is output by thecapsule-certs-generate
command for installing Capsule Server certificate.Copy the certificate archive file from Satellite Server to Capsule Server:
# scp /root/capsule.example.com-certs.tar root@capsule.example.com:/root/capsule.example.com-certs.tar
On Capsule Server, install the
puppetserver
package:# satellite-maintain packages install puppetserver
On Capsule Server, create directories for puppet certificates:
# mkdir -p /etc/puppetlabs/puppet/ssl/certs/ \ /etc/puppetlabs/puppet/ssl/private_keys/ \ /etc/puppetlabs/puppet/ssl/public_keys/
On Capsule Server, copy the Puppet certificates for this Capsule Server from the system where you configure Capsule Server to sign Puppet certificates:
# scp root@capsule-ca.example.com:/etc/puppetlabs/puppet/ssl/certs/capsule.example.com.pem /etc/puppetlabs/puppet/ssl/certs/capsule.example.com.pem # scp root@capsule-ca.example.com:/etc/puppetlabs/puppet/ssl/certs/ca.pem /etc/puppetlabs/puppet/ssl/certs/ca.pem # scp root@capsule-ca.example.com:/etc/puppetlabs/puppet/ssl/private_keys/capsule.example.com.pem /etc/puppetlabs/puppet/ssl/private_keys/capsule.example.com.pem # scp root@capsule-ca.example.com:/etc/puppetlabs/puppet/ssl/public_keys/capsule.example.com.pem /etc/puppetlabs/puppet/ssl/public_keys/capsule.example.com.pem
On Capsule Server, change the
/etc/puppetlabs/puppet/ssl/
directory ownership to userpuppet
and grouppuppet
:# chown -R puppet:puppet /etc/puppetlabs/puppet/ssl/
On Capsule Server, set the SELinux context for the
/etc/puppetlabs/puppet/ssl/
directory:# restorecon -Rv /etc/puppetlabs/puppet/ssl/
Append the following options to the
satellite-installer
command that you obtain from the output of thecapsule-certs-generate
command:--certs-cname "loadbalancer.example.com" \ --enable-foreman-proxy-plugin-remote-execution-script \ --foreman-proxy-puppetca "false" \ --puppet-ca-server "capsule-ca.example.com" \ --puppet-dns-alt-names "loadbalancer.example.com" \ --puppet-server-ca "false"
On Capsule Server, enter the
satellite-installer
command:# satellite-installer --scenario capsule \ --certs-cname "loadbalancer.example.com" \ --certs-tar-file "capsule.example.com-certs.tar" \ --enable-foreman-proxy-plugin-remote-execution-script \ --foreman-proxy-foreman-base-url "https://satellite.example.com" \ --foreman-proxy-oauth-consumer-key "oauth key" \ --foreman-proxy-oauth-consumer-secret "oauth secret" \ --foreman-proxy-puppetca "false" \ --foreman-proxy-register-in-foreman "true" \ --foreman-proxy-trusted-hosts "satellite.example.com" \ --foreman-proxy-trusted-hosts "capsule.example.com" \ --puppet-ca-server "capsule-ca.example.com" \ --puppet-dns-alt-names "loadbalancer.example.com" \ --puppet-server-ca "false" \ --puppet-server-foreman-url "https://satellite.example.com"
4.3. Configuring Capsule Server with Custom SSL Certificates for Load Balancing without Puppet
The following section describes how to configure Capsule Servers that use custom SSL certificates for load balancing without Puppet.
4.3.1. Creating Custom SSL Certificates for Capsule Server
This procedure outlines how to create a configuration file for the Certificate Signing Request and include the load balancer and Capsule Server as Subject Alternative Names (SAN). Complete this procedure on each Capsule Server that you want to configure for load balancing.
Procedure
On Capsule Server, create a directory to contain all the source certificate files, accessible to only the
root
user:# mkdir /root/capsule_cert # cd /root/capsule_cert
Create a private key with which to sign the Certificate Signing Request (CSR).
Note that the private key must be unencrypted. If you use a password-protected private key, remove the private key password.
If you already have a private key for this Capsule Server, skip this step.
# openssl genrsa -out /root/capsule_cert/capsule_cert_key.pem 4096
Create the certificate request configuration file with the following content:
[ req ] default_bits = 4096 distinguished_name = req_distinguished_name req_extensions = req_ext prompt = no [ req_distinguished_name ] countryName=2 Letter Country Code stateOrProvinceName=State or Province Full Name localityName=Locality Name 0.organizationName=Organization Name organizationalUnitName=Capsule Organization Unit Name commonName=capsule.example.com 1 emailAddress=Email Address [ req_ext ] #authorityKeyIdentifier=keyid,issuer #basicConstraints=CA:FALSE keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment subjectAltName = @alt_names [alt_names] 2 DNS.1 = loadbalancer.example.com DNS.2 = capsule.example.com
- 1
- The certificate’s common name must match the FQDN of Capsule Server. Ensure to change this when running the command on each Capsule Server that you configure for load balancing. You can also set a wildcard value
*
. If you set a wildcard value, you must add the-t capsule
option when you use thekatello-certs-check
command. - 2
- Under
[alt_names]
, include the FQDN of the load balancer asDNS.1
and the FQDN of Capsule Server asDNS.2
.
Create a Certificate Signing Request (CSR) for the SAN certificate:
# openssl req -new \ -key /root/capsule_cert/capsule_cert_key.pem \ 1 -config SAN_config.cfg \ 2 -out /root/capsule_cert/capsule_cert_csr.pem 3
Send the certificate request to the Certificate Authority:
When you submit the request, specify the lifespan of the certificate. The method for sending the certificate request varies, so consult the Certificate Authority for the preferred method. In response to the request, you can expect to receive a Certificate Authority bundle and a signed certificate, in separate files.
- Copy the Certificate Authority bundle and Capsule Server certificate file that you receive from the Certificate Authority, and Capsule Server private key to your Satellite Server.
On Satellite Server, validate Capsule Server certificate input files:
# katello-certs-check \ -c /root/capsule_cert/capsule_cert.pem \ 1 -k /root/capsule_cert/capsule_cert_key.pem \ 2 -b /root/capsule_cert/ca_cert_bundle.pem 3
If you set the
commonName=
to a wildcard value*
, you must add the-t capsule
option to thekatello-certs-check
command.Retain a copy of the example
capsule-certs-generate
command that is output by thekatello-certs-check
command for creating the Certificate Archive File for this Capsule Server.
4.3.2. Configuring Capsule Server with Custom SSL Certificates for Load Balancing without Puppet
The following section describes how to configure Capsule Servers that use custom SSL certificates for load balancing without Puppet. Complete this procedure on each Capsule Server that you want to configure for load balancing.
Procedure
Append the following option to the
capsule-certs-generate
command that you obtain from the output of thekatello-certs-check
command:--foreman-proxy-cname loadbalancer.example.com
On Satellite Server, enter the
capsule-certs-generate
command to generate Capsule certificates:# capsule-certs-generate \ --certs-tar /root/capsule_cert/capsule.tar \ --foreman-proxy-cname loadbalancer.example.com \ --foreman-proxy-fqdn capsule.example.com \ --server-ca-cert /root/capsule_cert/ca_cert_bundle.pem \ --server-cert /root/capsule_cert/capsule.pem \ --server-key /root/capsule_cert/capsule.pem
Retain a copy of the example
satellite-installer
command from the output for installing Capsule Server certificates.Copy the certificate archive file from Satellite Server to Capsule Server:
# scp /root/capsule.example.com-certs.tar root@capsule.example.com:capsule.example.com-certs.tar
Append the following options to the
satellite-installer
command that you obtain from the output of thecapsule-certs-generate
command:--certs-cname "loadbalancer.example.com" \ --enable-foreman-proxy-plugin-remote-execution-script
On Capsule Server, enter the
satellite-installer
command:# satellite-installer --scenario capsule \ --certs-cname "loadbalancer.example.com" \ --certs-tar-file "capsule.example.com-certs.tar" \ --enable-foreman-proxy-plugin-remote-execution-script \ --foreman-proxy-foreman-base-url "https://satellite.example.com" \ --foreman-proxy-oauth-consumer-key "oauth key" \ --foreman-proxy-oauth-consumer-secret "oauth secret" \ --foreman-proxy-register-in-foreman "true" \ --foreman-proxy-trusted-hosts "satellite.example.com" \ --foreman-proxy-trusted-hosts "capsule.example.com"
4.4. Configuring Capsule Server with Custom SSL Certificates for Load Balancing with Puppet
If you use Puppet in your Satellite configuration, then you must complete the following procedures:
4.4.1. Creating Custom SSL Certificates for Capsule Server
This procedure outlines how to create a configuration file for the Certificate Signing Request and include the load balancer and Capsule Server as Subject Alternative Names (SAN). Complete this procedure on each Capsule Server that you want to configure for load balancing.
Procedure
On Capsule Server, create a directory to contain all the source certificate files, accessible to only the
root
user:# mkdir /root/capsule_cert # cd /root/capsule_cert
Create a private key with which to sign the Certificate Signing Request (CSR).
Note that the private key must be unencrypted. If you use a password-protected private key, remove the private key password.
If you already have a private key for this Capsule Server, skip this step.
# openssl genrsa -out /root/capsule_cert/capsule_cert_key.pem 4096
Create the certificate request configuration file with the following content:
[ req ] default_bits = 4096 distinguished_name = req_distinguished_name req_extensions = req_ext prompt = no [ req_distinguished_name ] countryName=2 Letter Country Code stateOrProvinceName=State or Province Full Name localityName=Locality Name 0.organizationName=Organization Name organizationalUnitName=Capsule Organization Unit Name commonName=capsule.example.com 1 emailAddress=Email Address [ req_ext ] #authorityKeyIdentifier=keyid,issuer #basicConstraints=CA:FALSE keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment subjectAltName = @alt_names [alt_names] 2 DNS.1 = loadbalancer.example.com DNS.2 = capsule.example.com
- 1
- The certificate’s common name must match the FQDN of Capsule Server. Ensure to change this when running the command on each Capsule Server that you configure for load balancing. You can also set a wildcard value
*
. If you set a wildcard value, you must add the-t capsule
option when you use thekatello-certs-check
command. - 2
- Under
[alt_names]
, include the FQDN of the load balancer asDNS.1
and the FQDN of Capsule Server asDNS.2
.
Create a Certificate Signing Request (CSR) for the SAN certificate:
# openssl req -new \ -key /root/capsule_cert/capsule_cert_key.pem \ 1 -config SAN_config.cfg \ 2 -out /root/capsule_cert/capsule_cert_csr.pem 3
Send the certificate request to the Certificate Authority:
When you submit the request, specify the lifespan of the certificate. The method for sending the certificate request varies, so consult the Certificate Authority for the preferred method. In response to the request, you can expect to receive a Certificate Authority bundle and a signed certificate, in separate files.
- Copy the Certificate Authority bundle and Capsule Server certificate file that you receive from the Certificate Authority, and Capsule Server private key to your Satellite Server.
On Satellite Server, validate Capsule Server certificate input files:
# katello-certs-check \ -c /root/capsule_cert/capsule_cert.pem \ 1 -k /root/capsule_cert/capsule_cert_key.pem \ 2 -b /root/capsule_cert/ca_cert_bundle.pem 3
If you set the
commonName=
to a wildcard value*
, you must add the-t capsule
option to thekatello-certs-check
command.Retain a copy of the example
capsule-certs-generate
command that is output by thekatello-certs-check
command for creating the Certificate Archive File for this Capsule Server.
4.4.2. Configuring Capsule Server with Custom SSL Certificates to Generate and Sign Puppet Certificates
Complete this procedure only for the system where you want to configure Capsule Server to generate Puppet certificates for all other Capsule Servers that you configure for load balancing.
Procedure
Append the following option to the
capsule-certs-generate
command that you obtain from the output of thekatello-certs-check
command:--foreman-proxy-cname loadbalancer.example.com
On Satellite Server, enter the
capsule-certs-generate
command to generate Capsule certificates:# capsule-certs-generate \ --certs-tar /root/capsule_cert/capsule-ca.tar \ --foreman-proxy-cname loadbalancer.example.com \ --foreman-proxy-fqdn capsule-ca.example.com \ --server-ca-cert /root/capsule_cert/ca_cert_bundle.pem \ --server-cert /root/capsule_cert/capsule-ca.pem \ --server-key /root/capsule_cert/capsule-ca.pem
Retain a copy of the example
satellite-installer
command from the output for installing Capsule Server certificates.- Copy the certificate archive file from Satellite Server to Capsule Server.
Append the following options to the
satellite-installer
command that you obtain from the output of thecapsule-certs-generate
command:--enable-foreman-proxy-plugin-remote-execution-script \ --foreman-proxy-puppetca "true" \ --puppet-ca-server "capsule-ca.example.com" \ --puppet-dns-alt-names "loadbalancer.example.com" \ --puppet-server-ca "true"
On Capsule Server, enter the
satellite-installer
command:# satellite-installer --scenario capsule \ --certs-cname "loadbalancer.example.com" \ --certs-tar-file "certs.tgz" \ --enable-foreman-proxy-plugin-remote-execution-script \ --enable-puppet \ --foreman-proxy-foreman-base-url "https://satellite.example.com" \ --foreman-proxy-oauth-consumer-key "oauth key" \ --foreman-proxy-oauth-consumer-secret "oauth secret" \ --foreman-proxy-puppetca "true" \ --foreman-proxy-register-in-foreman "true" \ --foreman-proxy-trusted-hosts "satellite.example.com" \ --foreman-proxy-trusted-hosts "capsule-ca.example.com" \ --puppet-ca-server "capsule-ca.example.com" \ --puppet-dns-alt-names "loadbalancer.example.com" \ --puppet-server true \ --puppet-server-ca "true" \ --puppet-server-foreman-url "https://satellite.example.com"
On Capsule Server, generate Puppet certificates for all other Capsules that you configure for load balancing, except this first system where you configure Puppet certificates signing:
# puppet cert generate capsule.example.com \ --dns_alt_names=loadbalancer.example.com
This command creates the following files on the Puppet certificate signing Capsule Server instance:
-
/etc/puppetlabs/puppet/ssl/certs/ca.pem
-
/etc/puppetlabs/puppet/ssl/certs/capsule.example.com.pem
-
/etc/puppetlabs/puppet/ssl/private_keys/capsule.example.com.pem
-
/etc/puppetlabs/puppet/ssl/public_keys/capsule.example.com.pem
-
4.4.3. Configuring Remaining Capsule Servers with Custom SSL Certificates for Load Balancing
Complete this procedure for each Capsule Server excluding the system where you configure Capsule Server to sign Puppet certificates.
Procedure
Append the following option to the
capsule-certs-generate
command that you obtain from the output of thekatello-certs-check
command:--foreman-proxy-cname loadbalancer.example.com
On Satellite Server, enter the
capsule-certs-generate
command to generate Capsule certificates:# capsule-certs-generate \ --certs-tar /root/capsule_cert/capsule.tar \ --foreman-proxy-cname loadbalancer.example.com \ --foreman-proxy-fqdn capsule.example.com \ --server-ca-cert /root/capsule_cert/ca_cert_bundle.pem \ --server-cert /root/capsule_cert/capsule.pem \ --server-key /root/capsule_cert/capsule.pem
Retain a copy of the example
satellite-installer
command from the output for installing Capsule Server certificates.Copy the certificate archive file from Satellite Server to Capsule Server.
# scp /root/capsule.example.com-certs.tar root@capsule.example.com:capsule.example.com-certs.tar
On Capsule Server, install the
puppetserver
package:# satellite-maintain packages install puppetserver
On Capsule Server, create directories for puppet certificates:
# mkdir -p /etc/puppetlabs/puppet/ssl/certs/ \ /etc/puppetlabs/puppet/ssl/private_keys/ \ /etc/puppetlabs/puppet/ssl/public_keys/
On Capsule Server, copy the Puppet certificates for this Capsule Server from the system where you configure Capsule Server to sign Puppet certificates:
# scp root@capsule-ca.example.com:/etc/puppetlabs/puppet/ssl/certs/capsule.example.com.pem /etc/puppetlabs/puppet/ssl/certs/capsule.example.com.pem # scp root@capsule-ca.example.com:/etc/puppetlabs/puppet/ssl/certs/ca.pem /etc/puppetlabs/puppet/ssl/certs/ca.pem # scp root@capsule-ca.example.com:/etc/puppetlabs/puppet/ssl/private_keys/capsule.example.com.pem /etc/puppetlabs/puppet/ssl/private_keys/capsule.example.com.pem # scp root@capsule-ca.example.com:/etc/puppetlabs/puppet/ssl/public_keys/capsule.example.com.pem /etc/puppetlabs/puppet/ssl/public_keys/capsule.example.com.pem
On Capsule Server, change the
/etc/puppetlabs/puppet/ssl/
directory ownership to userpuppet
and grouppuppet
:# chown -R puppet:puppet /etc/puppetlabs/puppet/ssl/
On Capsule Server, set the SELinux context for the
/etc/puppetlabs/puppet/ssl/
directory:# restorecon -Rv /etc/puppetlabs/puppet/ssl/
Append the following options to the
satellite-installer
command that you obtain from the output of thecapsule-certs-generate
command:--certs-cname "loadbalancer.example.com" \ --enable-foreman-proxy-plugin-remote-execution-script \ --foreman-proxy-puppetca "false" \ --puppet-ca-server "capsule-ca.example.com" \ --puppet-dns-alt-names "loadbalancer.example.com" \ --puppet-server-ca "false"
On Capsule Server, enter the
satellite-installer
command:# satellite-installer --scenario capsule \ --certs-cname "loadbalancer.example.com" \ --certs-tar-file "capsule.example.com-certs.tar" \ --enable-foreman-proxy-plugin-remote-execution-script \ --foreman-proxy-foreman-base-url "https://satellite.example.com" \ --foreman-proxy-oauth-consumer-key "oauth key" \ --foreman-proxy-oauth-consumer-secret "oauth secret" \ --foreman-proxy-puppetca "false" \ --foreman-proxy-register-in-foreman "true" \ --foreman-proxy-trusted-hosts "satellite.example.com" \ --foreman-proxy-trusted-hosts "capsule.example.com" \ --puppet-ca-server "capsule-ca.example.com" \ --puppet-dns-alt-names "loadbalancer.example.com" \ --puppet-server-ca "false" \ --puppet-server-foreman-url "https://satellite.example.com"