Red Hat Summit Red Hat SummitSupportConsoleDevelopersStart a trialContact

Chapter 4. Using PXE to provision hosts

You can provision bare-metal instances with Satellite by using one of the following methods:

Unattended Provisioning
New hosts are identified by a MAC address. Satellite Server provisions the host by using a PXE boot process.
Unattended Provisioning with Discovery
New hosts use PXE boot to load the Satellite Discovery service. This service identifies hardware information about the host and lists it as an available host to provision. For more information, see Chapter 6, Discovering hosts on a network.
PXE-less Provisioning
New hosts are provisioned with a boot disk image that Satellite Server generates.

BIOS and UEFI support

With Red Hat Satellite, you can perform both BIOS and UEFI based PXE provisioning. Both BIOS and UEFI interfaces work as interpreters between the operating system and firmware of a computer, initializing hardware components and starting the operating system at boot time.

PXE loaders

In Satellite provisioning, the PXE loader option defines the DHCP filename option to use during provisioning.

  • For BIOS systems, select the PXELinux BIOS option to enable a provisioned host to download the pxelinux.0 file over TFTP.
  • For UEFI systems, select the Grub2 UEFI option to enable a TFTP client to download grubx64.efi file, or select the Grub2 UEFI HTTP option to enable an UEFI HTTP client to download grubx64.efi with the HTTP Boot feature.

Red Hat Satellite supports UEFI Secure Boot. SecureBoot PXE loaders enable a client to download the shimx64.efi bootstrap boot loader that then loads the signed grubx64.efi. Use the Grub2 UEFI SecureBoot PXE loader for PXE-boot provisioning.

By default, you can provision the same RHEL version as your Satellite Server on Secure Boot enabled hosts. To provision other versions of Red Hat Enterprise Linux, you have to provide signed shim and GRUB2 binaries of those RHEL versions. For more information, see Section 4.6, “Configuring Capsule to provision Red Hat Enterprise Linux on Secure Boot enabled hosts”.

For more information about supported workflows, see Supported architectures and provisioning scenarios.

Bonded network interfaces

You can configure a bonded interface that Satellite will use during the installation process, for example, to download installation content. After provisioning completes, the provisioned system can also use the bonded interface.

Important

Satellite cannot PXE boot a bonded interface that requires configuration on a network switch as well as on your host.

After your host loads the kernel of an installer or the kernel of an operating system, bonding works as expected. Therefore, you can use a boot disk to work around PXE boot limitations when your bonded interface requires configuration on both a switch and your host.

4.1. Prerequisites for bare-metal provisioning
Copy link

The requirements for bare-metal provisioning include:

  • A Capsule Server managing the network for bare-metal hosts. For unattended provisioning and discovery-based provisioning, Satellite Server requires PXE server settings.

    For more information about networking requirements, see Chapter 3, Preparing networking.

    For more information about the Discovery service, Chapter 6, Discovering hosts on a network.

  • A bare-metal host or a blank VM.
  • You can use synchronized content repositories for Red Hat Enterprise Linux. For more information, see Syncing Repositories in Managing content.
  • Provide an activation key for host registration. For more information, see Creating An Activation Key in Managing content.

For information about the security token for unattended and PXE-less provisioning, see Section 4.2, “Configuring the security token validity duration”.

When performing any kind of provisioning, as a security measure, Satellite automatically generates a unique token and adds this token to the kickstart URL in the PXE configuration file (PXELinux, Grub2). By default, the token is valid for 360 minutes. When you provision a host, ensure that you reboot the host within this time frame. If the token expires, it is no longer valid and you receive a 404 error and the operating system installer download fails.

Procedure

  1. In the Satellite web UI, navigate to Administer > Settings, and click the Provisioning tab.
  2. Find the Token duration option and click the edit icon and edit the duration, or enter 0 to disable token generation. If token generation is disabled, an attacker can spoof client IP address and download kickstart from Satellite Server, including the encrypted root password.

4.3. Creating hosts with unattended provisioning
Copy link

Unattended provisioning is the simplest form of host provisioning. You enter the host details on Satellite Server and boot your host. Satellite Server automatically manages the PXE configuration, organizes networking services, and provides the operating system and configuration for the host.

This method of provisioning hosts uses minimal interaction during the process.

To use the CLI instead of the Satellite web UI, see the CLI procedure.

Procedure

  1. In the Satellite web UI, navigate to Hosts > Create Host.
  2. In the Name field, enter a name for the host.
  3. Optional: Click the Organization tab and change the organization context to match your requirement.
  4. Optional: Click the Location tab and change the location context to match your requirement.
  5. From the Host Group list, select a host group that you want to assign your host to. That host group will populate the form.
  6. Click the Interfaces tab, and on the interface of the host, click Edit.

  7. Verify that the fields are populated with values. Note in particular:

    • Satellite automatically assigns an IP address for the new host.
    • In the MAC address field, enter a MAC address of the provisioning interface of the host. This ensures the identification of the host during the PXE boot process.
    • The Name from the Host tab becomes the DNS name.
    • Ensure that Satellite automatically selects the Managed, Primary, and Provision options for the first interface on the host. If not, select them.
  8. Click OK to save. To add another interface, click Add Interface. You can select only one interface for Provision and Primary.
  9. Click the Operating System tab, and verify that all fields contain values. Confirm each aspect of the operating system.

  10. Optional: Click Resolve in Provisioning template to check the new host can identify the right provisioning templates to use.

    For more information about associating provisioning templates, see Section 2.12, “Provisioning templates”.

  11. On the Parameters tab, click Add parameter. Add a parameter named kt_activation_keys, select the string type, and enter the name of the activation key as the value. The activation key has to belong to the same organization as your host. You can also enter a comma-separated list of multiple activation keys.

  12. Click Submit to save the host details.

    For more information about network interfaces, see Configuring network interfaces in Managing hosts.

This creates the host entry and the relevant provisioning settings. This also includes creating the necessary directories and files for PXE booting the bare-metal host. If you start the physical host and set its boot mode to PXE, the host detects the DHCP service of Satellite Server’s integrated Capsule, receives HTTP endpoint of the Kickstart tree and installs the operating system.

When the installation completes, the host also registers to Satellite Server using the activation key and installs the necessary configuration and management tools from the Red Hat Satellite Client 6 repository.

CLI procedure

  1. Create the host with the hammer host create command: 

    $ hammer host create \
--build true \
--enabled true \
--hostgroup "My_Host_Group" \
--location "My_Location" \
--mac "My_MAC_Address" \
--managed true \
--name "My_Host_Name" \
--organization "My_Organization"

  2. Ensure the network interface options are set using the hammer host interface update command: 

    $ hammer host interface update \
--host "_My_Host_Name_" \
--managed true \
--primary true \
--provision true

4.4. Creating hosts with PXE-less provisioning
Copy link

Some hardware does not provide a PXE boot interface. In Satellite, you can provision a host without PXE boot. This is also known as PXE-less provisioning and involves generating a boot ISO that hosts can use. Using this ISO, the host can connect to Satellite Server, boot the installation media, and install the operating system.

Satellite also provides a PXE-less discovery service that operates without PXE-based services, such as DHCP and TFTP. For more information, see Section 6.4, “Discovery in PXE-less mode”.

Boot ISO types

There are the following types of boot ISOs:

Full host image
A boot ISO that contains the kernel and initial RAM disk image for the specific host. This image is useful if the host fails to chainload correctly. The provisioning template still downloads from Satellite Server.
Subnet image
A boot ISO that is not associated with a specific host. The ISO sends the host’s MAC address to Capsule Server, which matches it against the host entry. The image does not store IP address details and requires access to a DHCP server on the network to bootstrap. This image is generic to all hosts with a provisioning NIC on the same subnet. The image is based on iPXE boot firmware, only a limited number of network cards is supported.
Note

The Full host image is based on SYSLINUX and Grub and works with most network cards. When using a Subnet image, see supported hardware on ipxe.org for a list of network card drivers expected to work with an iPXE-based boot disk.

Full host image contains a provisioning token, therefore the generated image has limited lifespan. For more information about configuring security tokens, see Section 4.2, “Configuring the security token validity duration”.

To use the CLI instead of the Satellite web UI, see the CLI procedure.

Procedure

  1. In the Satellite web UI, navigate to Hosts > Create Host.
  2. In the Name field, enter a name for the host.
  3. Optional: Click the Organization tab and change the organization context to match your requirement.
  4. Optional: Click the Location tab and change the location context to match your requirement.
  5. From the Host Group list, select a host group that you want to assign your host to. That host group will populate the form.
  6. Click the Interfaces tab, and on the interface of the host, click Edit.

  7. Verify that the fields are populated with values. Note in particular:

    • Satellite automatically assigns an IP address for the new host.
    • In the MAC address field, enter a MAC address of the provisioning interface of the host. This ensures the identification of the host during the PXE boot process.
    • The Name from the Host tab becomes the DNS name.
    • Ensure that Satellite automatically selects the Managed, Primary, and Provision options for the first interface on the host. If not, select them.
  8. Click OK to save. To add another interface, click Add Interface. You can select only one interface for Provision and Primary.
  9. Click the Operating System tab, and verify that all fields contain values. Confirm each aspect of the operating system.

  10. Click Resolve in Provisioning Templates to check the new host can identify the right provisioning templates to use.

    For more information about associating provisioning templates, see Section 2.12, “Provisioning templates”.

  11. On the Parameters tab, click Add parameter. Add a parameter named kt_activation_keys, select the string type, and enter the name of the activation key as the value. The activation key has to belong to the same organization as your host. You can also enter a comma-separated list of multiple activation keys.
  12. Click Submit to save the host details. This creates a host entry and the host details page appears.

  13. Download the boot disk from Satellite Server.

    • For Full host image, on the host details page, click the vertical ellipsis and select Full host 'My_Host_Name' image.
    • For Subnet image, navigate to Infrastructure > Subnets, click the dropdown menu in the Actions column of the required subnet and select Subnet generic image.
  14. Write the ISO to a USB storage device using the dd utility or livecd-tools if required.

  15. When you start the host and boot from the ISO or the USB storage device, the host connects to Satellite Server and starts installing operating system from its Kickstart tree.

    When the installation completes, the host also registers to Satellite Server using the activation key and installs the necessary configuration and management tools from the Red Hat Satellite Client 6 repository.

CLI procedure

  1. Create the host using the hammer host create command. 

    $ hammer host create \
--build true \
--enabled true \
--hostgroup "My_Host_Group" \
--location "My_Location" \
--mac "My_MAC_Address" \
--managed true \
--name "My_Host_Name" \
--organization "My_Organization"

  2. Ensure that your network interface options are set using the hammer host interface update command. 

    $ hammer host interface update \
--host "My_Host_Name" \
--managed true \
--primary true \
--provision true

  3. Download the boot disk from Satellite Server using the hammer bootdisk command:

    • For Full host image: 

      $ hammer bootdisk host \
--full true \
--host My_Host_Name

    • For Subnet image: 

      $ hammer bootdisk subnet --subnet My_Subnet_Name

    This creates a boot ISO for your host to use.

  4. Write the ISO to a USB storage device using the dd utility or livecd-tools if required.

  5. When you start the physical host and boot from the ISO or the USB storage device, the host connects to Satellite Server and starts installing operating system from its Kickstart tree.

    When the installation completes, the host also registers to Satellite Server using the activation key and installs the necessary configuration and management tools from the Red Hat Satellite Client 6 repository.

You can provision hosts from Satellite using the UEFI HTTP Boot.

To use the CLI instead of the Satellite web UI, see the CLI procedure.

Prerequisites

  • Ensure that you meet the requirements for HTTP booting. For more information, see HTTP booting in Overview, concepts, and deployment considerations.

Procedure

  1. Enable foreman-proxy-http, foreman-proxy-httpboot, and foreman-proxy-tftp features. 

    # satellite-installer \
--foreman-proxy-http true \
--foreman-proxy-httpboot true \
--foreman-proxy-tftp true
  2. Ensure that the Capsule has TFTP and HTTPBoot features recognized. In the Satellite web UI, navigate to Infrastructure > Capsules and click on Capsule to see the list of recognized features. Click Refresh Features if any of the features are missing.
  3. Ensure that Capsule is associated with the provisioning subnet. In the Satellite web UI, navigate to Infrastructure > Subnets > Edit Subnet > Capsules and select the Capsule for both TFTP and HTTPBoot options.
  4. Click OK to save.
  5. In the Satellite web UI, navigate to Hosts > Create Host.
  6. In the Name field, enter a name for the host.
  7. Optional: Click the Organization tab and change the organization context to match your requirement.
  8. Optional: Click the Location tab and change the location context to match your requirement.
  9. From the Host Group list, select a host group that you want to assign your host to. That host group will populate the form.
  10. Click the Interfaces tab, and on the interface of the host, click Edit.

  11. Verify that the fields are populated with values. Note in particular:

    • Satellite automatically assigns an IP address for the new host.
    • In the MAC address field, enter a MAC address of the provisioning interface of the host. This ensures the identification of the host during the PXE boot process.
    • The Name from the Host tab becomes the DNS name.
    • Ensure that Satellite automatically selects the Managed, Primary, and Provision options for the first interface on the host. If not, select them.
  12. Click OK to save. To add another interface, click Add Interface. You can select only one interface for Provision and Primary.
  13. Click the Operating System tab, and verify that all fields contain values. Confirm each aspect of the operating system.
  14. From the PXE Loader list, select Grub2 UEFI HTTP.

  15. Optional: Click Resolve in Provisioning template to check the new host can identify the right provisioning templates to use.

    For more information about associating provisioning templates, see Section 2.14, “Creating provisioning templates”.

  16. On the Parameters tab, click Add parameter. Add a parameter named kt_activation_keys, select the string type, and enter the name of the activation key as the value. The activation key has to belong to the same organization as your host. You can also enter a comma-separated list of multiple activation keys.

  17. Click Submit to save the host details.

    For more information about network interfaces, see Configuring network interfaces in Managing hosts.

  18. Set the host to boot in UEFI mode from network.
  19. Start the host.
  20. From the boot menu, select Kickstart default PXEGrub2.

This creates the host entry and the relevant provisioning settings. This also includes creating the necessary directories and files for UEFI booting the bare-metal host. When you start the physical host and set its boot mode to UEFI HTTP, the host detects the defined DHCP service, receives HTTP endpoint of Capsule with the Kickstart tree and installs the operating system.

When the installation completes, the host also registers to Satellite Server using the activation key and installs the necessary configuration and management tools from the Red Hat Satellite Client 6 repository.

CLI procedure

  1. Enable foreman-proxy-http, foreman-proxy-httpboot, and foreman-proxy-tftp true features: 

    # satellite-installer \
--foreman-proxy-http true \
--foreman-proxy-httpboot true \
--foreman-proxy-tftp true

  2. Create the host with the hammer host create command. 

    $ hammer host create \
--build true \
--enabled true \
--hostgroup "My_Host_Group" \
--location "My_Location" \
--mac "My_MAC_Address" \
--managed true \
--name "My_Host_Name" \
--organization "My_Organization" \
--pxe-loader "Grub2 UEFI HTTP"

  3. Ensure the network interface options are set using the hammer host interface update command: 

    $ hammer host interface update \
--host "My_Host_Name" \
--managed true \
--primary true \
--provision true
  4. Set the host to boot in UEFI mode from network.
  5. Start the host.
  6. From the boot menu, select Kickstart default PXEGrub2.

This creates the host entry and the relevant provisioning settings. This also includes creating the necessary directories and files for UEFI booting the bare-metal host. When you start the physical host and set its boot mode to UEFI HTTP, the host detects the defined DHCP service, receives HTTP endpoint of Capsule with the Kickstart tree and installs the operating system.

When the installation completes, the host also registers to Satellite Server using the activation key and installs the necessary configuration and management tools from the Red Hat Satellite Client 6 repository.

Secure Boot follows a chain of trust from the start of the host to the loading of Linux kernel modules. The first shim that is loaded determines which distribution can be booted or loaded by using a kexec system call until the next reboot.

You can provision the same RHEL version as your Satellite Server on Secure Boot enabled hosts out of the box and you can skip this procedure. To provision other RHEL versions, you have to provide signed shim and GRUB2 binaries for those RHEL versions.

Important

You have to perform the following configuration steps on each TFTP Capsule for a subnet to provision Secure Boot enabled hosts on that subnet.

Red Hat Enterprise Linux supports Secure Boot on x86_64 architecture only.

Prerequisites

  • Ensure that the cpio package is installed on your Capsule.

Procedure

  1. Set the path for the shim and GRUB2 binaries for the operating system of your host: 

    # BOOTLOADER_PATH="/var/lib/tftpboot/bootloader-universe/pxegrub2/redhat/default/x86_64"

    If you require specific versions of the shim and GRUB2 binaries for the version of the operating system of your host, replace default with the Major and Minor version of the operating system separated by a dot. If no Minor version is set, replace default with the Major version.

    Red Hat recommends to not use version-specific shim and GRUB2 binaries unless it is really necessary.

  2. Create the directory to store the shim and GRUB2 binaries for the operating system of your host: 

    # install -o foreman-proxy -g foreman-proxy -d $BOOTLOADER_PATH
  3. Download the shim and GRUB2 packages for the operating system of your host. You can download the grub2-efi-x64 and shim-x64 packages from Package browser on the Red Hat Customer Portal.

  4. Extract the shim and GRUB2 binaries: 

    # rpm2cpio /tmp/grub2-efi-x64.rpm | cpio -idv --directory /tmp
# rpm2cpio /tmp/shim-x64.rpm | cpio -idv --directory /tmp

  5. Make the shim and GRUB2 binaries available for host provisioning: 

    # cp /tmp/boot/efi/EFI/redhat/grubx64.efi $BOOTLOADER_PATH/grubx64.efi
# cp /tmp/boot/efi/EFI/redhat/shimx64.efi $BOOTLOADER_PATH/shimx64.efi
# ln -sr $BOOTLOADER_PATH/grubx64.efi $BOOTLOADER_PATH/boot.efi
# ln -sr $BOOTLOADER_PATH/shimx64.efi $BOOTLOADER_PATH/boot-sb.efi
# chmod 644 $BOOTLOADER_PATH/grubx64.efi $BOOTLOADER_PATH/shimx64.efi

Verification

  • Verify the contents of your boot loader directory: 

    # tree /var/lib/tftpboot/bootloader-universe
/var/lib/tftpboot/bootloader-universe
└── pxegrub2
    └── redhat
        └── default
            └── x86_64
                ├── boot.efi -> grubx64.efi
                ├── boot-sb.efi -> shimx64.efi
                ├── grubx64.efi
                └── shimx64.efi

Next steps

  • You can now provision Secure Boot enabled Red Hat Enterprise Linux hosts by using the Grub2 UEFI SecureBoot PXE loader.

4.7. Deploying SSH keys during provisioning
Copy link

Use this procedure to deploy SSH keys added to a user during provisioning. For information on adding SSH keys to a user, see Managing SSH Keys for a User in Administering Red Hat Satellite.

Procedure

  1. In the Satellite web UI, navigate to Hosts > Templates > Provisioning Templates.
  2. Create a provisioning template, or clone and edit an existing template. For more information, see Section 2.14, “Creating provisioning templates”.
  3. In the template, click the Template tab.

  4. In the Template editor field, add the create_users snippet to the %post section: 

    <%= snippet('create_users') %>
  5. Select the Default checkbox.
  6. Click the Association tab.
  7. From the Application Operating Systems list, select an operating system.
  8. Click Submit to save the provisioning template.

  9. Create a host that is associated with the provisioning template or rebuild a host using the operating system associated with the modified template. For more information, see Creating a Host in Managing hosts.

    The SSH keys of the Owned by user are added automatically when the create_users snippet is executed during the provisioning process. You can set Owned by to an individual user or a user group. If you set Owned by to a user group, the SSH keys of all users in the user group are added automatically.

Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Theme

© 2026 Red HatBack to top