Installing Capsule Server

Procedure

1. Open the ports for clients on Capsule Server:

   # firewall-cmd \
   --add-port="8000/tcp" \
   --add-port="9090/tcp"

2. Allow access to services on Capsule Server:

   # firewall-cmd \
   --add-service=dns \
   --add-service=dhcp \
   --add-service=tftp \
   --add-service=http \
   --add-service=https \
   --add-service=puppetmaster

3. Make the changes persistent:

   # firewall-cmd --runtime-to-permanent

Procedure

1. In the Satellite web UI, navigate to Hosts > Register Host.
2. From the Activation Keys list, select the activation keys to assign to your host.
3. Click Generate to create the registration command.
4. Click on the files icon to copy the command to your clipboard.
5. Connect to your host using SSH and run the registration command.
6. Check the /etc/yum.repos.d/redhat.repo file and ensure that the appropriate repositories have been enabled.

CLI procedure

1. Generate the host registration command using the Hammer CLI:

   # hammer host-registration generate-command \
   --activation-keys "My_Activation_Key"

   If your hosts do not trust the SSL certificate of Satellite Server, you can disable SSL validation by adding the --insecure flag to the registration command.

   # hammer host-registration generate-command \
   --activation-keys "My_Activation_Key" \
   --insecure true

2. Connect to your host using SSH and run the registration command.
3. Check the /etc/yum.repos.d/redhat.repo file and ensure that the appropriate repositories have been enabled.

API procedure

1. Generate the host registration command using the Satellite API:

   # curl -X POST https://satellite.example.com/api/registration_commands \
   --user "My_User_Name" \
   -H 'Content-Type: application/json' \
   -d '{ "registration_command": { "activation_keys": ["My_Activation_Key_1, My_Activation_Key_2"] }}'

   If your hosts do not trust the SSL certificate of Satellite Server, you can disable SSL validation by adding the --insecure flag to the registration command.

   # curl -X POST https://satellite.example.com/api/registration_commands \
   --user "My_User_Name" \
   -H 'Content-Type: application/json' \
   -d '{ "registration_command": { "activation_keys": ["My_Activation_Key_1, My_Activation_Key_2"], "insecure": true }}'

   Use an activation key to simplify specifying the environments. For more information, see Managing Activation Keys in Managing content.

   To enter a password as a command line argument, use username:password syntax. Keep in mind this can save the password in the shell history. Alternatively, you can use a temporary personal access token instead of a password. To generate a token in the Satellite web UI, navigate to My Account > Personal Access Tokens.

2. Connect to your host using SSH and run the registration command.
3. Check the /etc/yum.repos.d/redhat.repo file and ensure that the appropriate repositories have been enabled.

1. Update all packages:

   # dnf upgrade

2. Install the Satellite Server packages:

   # dnf install satellite-capsule

Verification

1. In the Satellite web UI, navigate to Infrastructure > Capsules and select any Capsule Server.
2. On the Overview tab, click Refresh features.

Procedure

1. Log into the Satellite web UI.
2. From the Organization list in the upper-left of the screen, select Any Organization.
3. From the Location list in the upper-left of the screen, select Any Location.
4. In the Satellite web UI, navigate to Hosts > All Hosts and select Capsule Server.
5. From the Select Actions list, select Assign Organization.
6. From the Organization list, select the organization where you want to assign this Capsule.
7. Click Fix Organization on Mismatch.
8. Click Submit.
9. Select Capsule Server. From the Select Actions list, select Assign Location.
10. From the Location list, select the location where you want to assign this Capsule.
11. Click Fix Location on Mismatch.
12. Click Submit.
13. In the Satellite web UI, navigate to Administer > Organizations and click the organization to which you have assigned Capsule.
14. Click Capsules tab and ensure that Capsule Server is listed under the Selected items list, then click Submit.
15. In the Satellite web UI, navigate to Administer > Locations and click the location to which you have assigned Capsule.
16. Click Capsules tab and ensure that Capsule Server is listed under the Selected items list, then click Submit.

1. Select the organization from the Organization list.
2. Select the location from the Location list.
3. In the Satellite web UI, navigate to Hosts > All Hosts.
4. In the Satellite web UI, navigate to Infrastructure > Capsules.

Verification

1. List the current trusted proxies using the full help of Satellite installer:

   # satellite-installer --full-help | grep -A 2 "trusted-proxies"

2. The current listing contains all trusted proxies you require.

Procedure

1. Enable the pull-based transport on your Capsule Server:

   # satellite-installer --foreman-proxy-plugin-remote-execution-script-mode=pull-mqtt

2. Configure the firewall to allow the MQTT service on port 1883:

   # firewall-cmd --add-service=mqtt

3. Make the changes persistent:

   # firewall-cmd --runtime-to-permanent

4. In pull-mqtt mode, hosts subscribe for job notifications to either your Satellite Server or any Capsule Server through which they are registered. Ensure that Satellite Server sends remote execution jobs to that same Satellite Server or Capsule Server:

   1. In the Satellite web UI, navigate to Administer > Settings.
   2. On the Content tab, set the value of Prefer registered through Capsule for remote execution to Yes.

Procedure

1. In the Satellite web UI, navigate to Infrastructure > Capsules, and select the Capsule that you want to add a lifecycle to.
2. Click Edit and click the Lifecycle Environments tab.
3. From the left menu, select the lifecycle environments that you want to add to Capsule and click Submit.
4. To synchronize the content on the Capsule, click the Overview tab and click Synchronize.

5. Select either Optimized Sync or Complete Sync.

   For definitions of each synchronization type, see Recovering a Repository.

CLI procedure

1. To display a list of all Capsule Servers, on Satellite Server, enter the following command:

   # hammer capsule list

   Note the Capsule ID of the Capsule to which you want to add a lifecycle.

2. Using the ID, verify the details of your Capsule:

   # hammer capsule info \
   --id My_capsule_ID

3. To view the lifecycle environments available for your Capsule Server, enter the following command and note the ID and the organization name:

   # hammer capsule content available-lifecycle-environments \
   --id My_capsule_ID

4. Add the lifecycle environment to your Capsule Server:

   # hammer capsule content add-lifecycle-environment \
   --id My_capsule_ID \
   --lifecycle-environment-id My_Lifecycle_Environment_ID
   --organization "My_Organization"

   Repeat for each lifecycle environment you want to add to Capsule Server.

5. Synchronize the content from Satellite to Capsule.

   • To synchronize all content from your Satellite Server environment to Capsule Server, enter the following command:

     # hammer capsule content synchronize \
     --id My_capsule_ID

   • To synchronize a specific lifecycle environment from your Satellite Server to Capsule Server, enter the following command:

     # hammer capsule content synchronize \
     --id My_capsule_ID
     --lifecycle-environment-id My_Lifecycle_Environment_ID

   • To synchronize all content from your Satellite Server to your Capsule Server without checking metadata:

     # hammer capsule content synchronize \
     --id My_capsule_ID \
     --skip-metadata-check true

     This equals selecting Complete Sync in the Satellite web UI.

Procedure

1. Copy the /etc/rndc.key file from the external DNS server to Capsule Server:

   # scp root@dns.example.com:/etc/rndc.key /etc/foreman-proxy/rndc.key

2. Configure the ownership, permissions, and SELinux context:

   # restorecon -v /etc/foreman-proxy/rndc.key
   # chown -v root:foreman-proxy /etc/foreman-proxy/rndc.key
   # chmod -v 640 /etc/foreman-proxy/rndc.key

3. To test the nsupdate utility, add a host remotely:

   # echo -e "server DNS_IP_Address\n \
   update add aaa.example.com 3600 IN A Host_IP_Address\n \
   send\n" | nsupdate -k /etc/foreman-proxy/rndc.key
   # nslookup aaa.example.com DNS_IP_Address
   # echo -e "server DNS_IP_Address\n \
   update delete aaa.example.com 3600 IN A Host_IP_Address\n \
   send\n" | nsupdate -k /etc/foreman-proxy/rndc.key

4. Enter the satellite-installer command to make the following persistent changes to the /etc/foreman-proxy/settings.d/dns.yml file:

   # satellite-installer --foreman-proxy-dns=true \
   --foreman-proxy-dns-managed=false \
   --foreman-proxy-dns-provider=nsupdate \
   --foreman-proxy-dns-server="DNS_IP_Address" \
   --foreman-proxy-keyfile=/etc/foreman-proxy/rndc.key

5. In the Satellite web UI, navigate to Infrastructure > Capsules.
6. Locate the Capsule Server and select Refresh from the list in the Actions column.
7. Associate the DNS service with the appropriate subnets and domain.

1. Section 4.2.1, “Configuring an external DHCP server to use with Capsule Server”
2. Section 4.2.2, “Configuring Satellite Server with an external DHCP server”

Procedure

1. Create the TFTP directory for NFS:

   # mkdir -p /mnt/nfs/var/lib/tftpboot

2. In the /etc/fstab file, add the following line:

   TFTP_Server_IP_Address:/exports/var/lib/tftpboot /mnt/nfs/var/lib/tftpboot nfs rw,vers=3,auto,nosharecache,context="system_u:object_r:tftpdir_rw_t:s0" 0 0

3. Mount the file systems in /etc/fstab:

   # mount -a

4. Enter the satellite-installer command to make the following persistent changes to the /etc/foreman-proxy/settings.d/tftp.yml file:

   # satellite-installer \
   --foreman-proxy-tftp-root /mnt/nfs/var/lib/tftpboot \
   --foreman-proxy-tftp=true

5. If the TFTP service is running on a different server than the DHCP service, update the tftp_servername setting with the FQDN or IP address of the server that the TFTP service is running on:

   # satellite-installer --foreman-proxy-tftp-servername=TFTP_Server_FQDN

6. In the Satellite web UI, navigate to Infrastructure > Capsules.
7. Locate the Capsule Server and select Refresh from the list in the Actions column.
8. Associate the TFTP service with the appropriate subnets and domain.

1. Install the ipa-client package on Satellite Server or Capsule Server:

   # satellite-maintain packages install ipa-client

2. Configure the server as a Identity Management client:

   # ipa-client-install

3. Create a realm proxy user, realm-capsule, and the relevant roles in Identity Management:

   # foreman-prepare-realm admin realm-capsule

   Note the principal name that returns and your Identity Management server configuration details because you require them for the following procedure.

1. Copy the /root/freeipa.keytab file to any Capsule Server that you want to include in the same principal and realm:

   # scp /root/freeipa.keytab root@capsule.example.com:/etc/foreman-proxy/freeipa.keytab

2. Move the /root/freeipa.keytab file to the /etc/foreman-proxy directory and set the ownership settings to the foreman-proxy user:

   # mv /root/freeipa.keytab /etc/foreman-proxy
   # chown foreman-proxy:foreman-proxy /etc/foreman-proxy/freeipa.keytab

3. Enter the following command on all Capsules that you want to include in the realm. If you use the integrated Capsule on Satellite, enter this command on Satellite Server:

   # satellite-installer --foreman-proxy-realm true \
   --foreman-proxy-realm-keytab /etc/foreman-proxy/freeipa.keytab \
   --foreman-proxy-realm-principal realm-capsule@EXAMPLE.COM \
   --foreman-proxy-realm-provider freeipa

   You can also use these options when you first configure the Satellite Server.

4. Ensure that the most updated versions of the ca-certificates package is installed and trust the Identity Management Certificate Authority:

   # cp /etc/ipa/ca.crt /etc/pki/ca-trust/source/anchors/ipa.crt
   # update-ca-trust enable
   # update-ca-trust

5. Optional: If you configure Identity Management on an existing Satellite Server or Capsule Server, complete the following steps to ensure that the configuration changes take effect:

   1. Restart the foreman-proxy service:

      # systemctl restart foreman-proxy

   2. In the Satellite web UI, navigate to Infrastructure > Capsules.
   3. Locate the Capsule you have configured for Identity Management and from the list in the Actions column, select Refresh.

Procedure

1. In the Satellite web UI, navigate to Infrastructure > Realms and click Create Realm.
2. In the Name field, enter a name for the realm.
3. From the Realm Type list, select the type of realm.
4. From the Realm Capsule list, select Capsule Server where you have configured Identity Management.
5. Click the Locations tab and from the Locations list, select the location where you want to add the new realm.
6. Click the Organizations tab and from the Organizations list, select the organization where you want to add the new realm.
7. Click Submit.

1. In the Satellite web UI, navigate to Configure > Host Groups, select the host group that you want to update, and click the Network tab.
2. From the Realm list, select the realm you create as part of this procedure, and then click Submit.

To add hosts to a Identity Management host group:

1. On the Identity Management server, create a host group:

   # ipa hostgroup-add hostgroup_name --desc=hostgroup_description

2. Create an automembership rule:

   # ipa automember-add --type=hostgroup hostgroup_name automember_rule

   Where you can use the following options:

   • automember-add flags the group as an automember group.
   • --type=hostgroup identifies that the target group is a host group, not a user group.
   • automember_rule adds the name you want to identify the automember rule by.

3. Define an automembership condition based on the userclass attribute:

   # ipa automember-add-condition --key=userclass --type=hostgroup --inclusive-regex=^webserver hostgroup_name
   ----------------------------------
   Added condition(s) to "hostgroup_name"
   ----------------------------------
   Automember Rule: automember_rule
   Inclusive Regex: userclass=^webserver
   ----------------------------
   Number of conditions added 1
   ----------------------------

   Where you can use the following options:

   • automember-add-condition adds regular expression conditions to identify group members.
   • --key=userclass specifies the key attribute as userclass.
   • --type=hostgroup identifies that the target group is a host group, not a user group.
   • --inclusive-regex= ^webserver identifies matching values with a regular expression pattern.
   • hostgroup_name – identifies the target host group’s name.

Procedure

1. On your Capsule, install the required packages:

   # satellite-maintain packages install bind-utils

2. Generate a key:

   # dnssec-keygen -r /dev/urandom -a HMAC-MD5 -b 512 -n HOST omapi_key
   # cat Komapi_key.+*.private | grep ^Key|cut -d ' ' -f2-

3. Use satellite-installer to secure the dhcpd API:

   # satellite-installer \
   --foreman-proxy-dhcp-key-name "My_Name" \
   --foreman-proxy-dhcp-key-secret "My_Secret"

Procedure

1. On Capsule Server, enter the following command:

   # satellite-installer --enable-foreman-proxy-plugin-dhcp-infoblox \
   --foreman-proxy-dhcp true \
   --foreman-proxy-dhcp-provider infoblox \
   --foreman-proxy-dhcp-server infoblox.example.com \
   --foreman-proxy-plugin-dhcp-infoblox-username admin \
   --foreman-proxy-plugin-dhcp-infoblox-password infoblox \
   --foreman-proxy-plugin-dhcp-infoblox-record-type fixedaddress \
   --foreman-proxy-plugin-dhcp-infoblox-dns-view default \
   --foreman-proxy-plugin-dhcp-infoblox-network-view default

2. Optional: In the Satellite web UI, navigate to Infrastructure > Capsules, select the Capsule with the DHCP Infoblox module, and ensure that the dhcp feature is listed.
3. In the Satellite web UI, navigate to Infrastructure > Subnets.
4. For all subnets managed through Infoblox, ensure that the IP address management (IPAM) method of the subnet is set to DHCP.

Procedure

1. On Capsule Server, enter the following command to configure the Infoblox module:

   # satellite-installer --enable-foreman-proxy-plugin-dns-infoblox \
   --foreman-proxy-dns true \
   --foreman-proxy-dns-provider infoblox \
   --foreman-proxy-plugin-dns-infoblox-dns-server infoblox.example.com \
   --foreman-proxy-plugin-dns-infoblox-username admin \
   --foreman-proxy-plugin-dns-infoblox-password infoblox \
   --foreman-proxy-plugin-dns-infoblox-dns-view default

   Optionally, you can change the value of the --foreman-proxy-plugin-dns-infoblox-dns-view option to specify an Infoblox DNS view other than the default view.

2. Optional: In the Satellite web UI, navigate to Infrastructure > Capsules, select the Capsule with the Infoblox DNS module, and ensure that the dns feature is listed.
3. In the Satellite web UI, navigate to Infrastructure > Domains.
4. For all domains managed through Infoblox, ensure that the DNS Proxy is set for those domains.
5. In the Satellite web UI, navigate to Infrastructure > Subnets.
6. For all subnets managed through Infoblox, ensure that the DNS Capsule and Reverse DNS Capsule are set for those subnets.