Installing Capsule Server

Procedure

1. On Satellite Server, enter the following command to open the port for Capsule to Satellite communication:

   # firewall-cmd --add-port="5646/tcp"

2. Make the changes persistent:

   # firewall-cmd --runtime-to-permanent

Procedure

1. On the base operating system on which you want to install Capsule, enter the following command to open the ports for Satellite Server and clients communication to Capsule Server:

   # firewall-cmd --add-port="53/udp" --add-port="53/tcp" \
   --add-port="67/udp" --add-port="69/udp" \
   --add-port="80/tcp" --add-port="443/tcp" \
   --add-port="5000/tcp" --add-port="5647/tcp" \
   --add-port="8000/tcp" --add-port="8140/tcp" \
   --add-port="8443/tcp" --add-port="9090/tcp"

2. Make the changes persistent:

   # firewall-cmd --runtime-to-permanent

1. Configure the firewall on Satellite Server:

   # firewall-cmd --add-port="5000/tcp" \
   --add-port="5646/tcp" --add-port="443/tcp" \
   --add-port="5647/tcp" --add-port="80/tcp"

2. Make the changes persistent:

   # firewall-cmd --runtime-to-permanent

Register to Satellite Server

1. Install the Satellite Server’s CA certificate on the base system on which you want to install Capsule.

   # rpm -Uvh http://satellite.example.com/pub/katello-ca-consumer-latest.noarch.rpm

2. Register the base system on which you want to install Capsule with the environments that you want the future Capsule to belong to. Use an activation key to simplify specifying the environments.

   # subscription-manager register --org=organization_name --activationkey=example_activation_key

1. Identify your Capsule Server subscription.

   # subscription-manager list --all --available --matches='Red Hat Satellite Infrastructure Subscription'

   The command displays output similar to the following:

   +-------------------------------------------+
       Available Subscriptions
   +-------------------------------------------+
   
   Subscription Name: Red Hat Satellite Capsule Server
   Provides:          Red Hat Satellite Proxy
                      Red Hat Satellite Capsule
                      Red Hat Software Collections (for RHEL Server)
                      Red Hat Satellite Capsule
                      Red Hat Enterprise Linux Server
                      Red Hat Enterprise Linux High Availability (for RHEL Server)
                      Red Hat Software Collections (for RHEL Server)
                      Red Hat Enterprise Linux Load Balancer (for RHEL Server)
   SKU:               MCT0369
   Pool ID:           9e4cc4e9b9fb407583035861bb6be501
   Available:         3
   Suggested:         1
   Service Level:     Premium
   Service Type:      L1-L3
   Multi-Entitlement: No
   Ends:              10/07/2022
   System Type:       Physical

2. Make a note of the Pool ID so that you can attach it to your Satellite host. Your Pool ID is different than the example provided.

3. Attach your subscription to your Capsule Server, using your Pool ID:

   # subscription-manager attach --pool=pool_id

   The outputs displays something similar to the following:

   Successfully attached a subscription for: Red Hat Capsule Server

4. To verify that the subscriptions are successfully attached, enter the following command:

   # subscription-manager list --consumed

1. Disable all existing repositories.

   # subscription-manager repos --disable "*"

2. Enable the Red Hat Satellite Capsule, Red Hat Enterprise Linux, and Red Hat Software Collections repositories.

   The Red Hat Software Collections repository provides a later version of Ruby required by some Red Hat Satellite Capsule features, including the Remote Execution feature.

   # subscription-manager repos --enable rhel-7-server-rpms \
   --enable rhel-7-server-satellite-capsule-6.4-rpms \
   --enable rhel-server-rhscl-7-rpms \
   --enable rhel-7-server-satellite-maintenance-6-rpms \
   --enable rhel-7-server-ansible-2.6-rpms

3. Clear out any metadata left from any non-Red Hat yum repositories.

   # yum clean all

4. Verify that the repositories have been enabled.

   # yum repolist enabled

Synchronizing Time using chronyd

1. Install chronyd.

   # yum install chrony

2. Start and enable the chronyd service.

   # systemctl start chronyd
   # systemctl enable chronyd

1. Update all packages.

   # yum update

2. Install the installation package.

   # yum install satellite-capsule

To Install katello-agent:

1. Log into the system.

2. Enable the Satellite tools repository for this version of Satellite.

   # subscription-manager repos \
   --enable=rhel-7-server-satellite-tools-6.4-rpms

3. Install the package.

   # yum install katello-agent

1. In the Satellite web UI, navigate to Infrastructure > Capsules, and select the Capsule that you want to add a life cycle to.
2. Click Edit and click the Life Cycle Environments tab.
3. From the left menu, select the life cycle environments that you want to add to Capsule, and then click Submit.
4. To synchronize Capsule’s content, click the Overview tab, and then click Synchronize.
5. Select either Optimized Sync or Complete Sync.

For CLI Users

1. To display a list of all Capsule Servers, enter the following command:

   # hammer capsule list

   Note the ID that returns.

2. Using the ID, verify the details of your Capsule Server:

   # hammer capsule info --id capsule_id

3. Verify the life cycle environments available and note the environment ID:

   # hammer capsule content available-lifecycle-environments \
   --id capsule_id

4. To view the life cycle environments available for your Capsule Server, enter the following command and note the ID and the organization name:

   # hammer capsule content available-lifecycle-environments --id capsule_id

5. Add the life cycle environment to your Capsule Server:

   # hammer capsule content add-lifecycle-environment \
   --id capsule_id --organization "My_Organization" \
   --environment-id environment_id

   Repeat for each life cycle environment you want to add to Capsule Server.

   To synchronize all content from your Satellite Server environment to Capsule Server, enter the following command:

   # hammer capsule content synchronize --id capsule_id

   To synchronize a specific life cycle environment from your Satellite Server to Capsule Server, enter the following command:

   # hammer capsule content synchronize --id external_capsule_id \
   --environment-id environment_id

Enable Power Management on Managed Hosts

1. Run the installer with the options to enable BMC.

   # satellite-installer --scenario capsule \
   --foreman-proxy-bmc "true" \
   --foreman-proxy-bmc-default-provider "freeipmi"

Configure DNS, DHCP, and TFTP on Capsule Server

1. Run capsule installer with the options applicable to your environment.

   The following example shows full provisioning services:

   # satellite-installer --scenario capsule \
   --foreman-proxy-dns true \
   --foreman-proxy-dns-managed true \
   --foreman-proxy-dns-interface eth0 \
   --foreman-proxy-dns-zone example.com \
   --foreman-proxy-dns-forwarders 172.17.13.1 \
   --foreman-proxy-dns-reverse 13.17.172.in-addr.arpa \
   --foreman-proxy-dhcp true \
   --foreman-proxy-dhcp-managed true \
   --foreman-proxy-dhcp-interface eth0 \
   --foreman-proxy-dhcp-range "172.17.13.100 172.17.13.150" \
   --foreman-proxy-dhcp-gateway 172.17.13.1 \
   --foreman-proxy-dhcp-nameservers 172.17.13.2 \
   --foreman-proxy-tftp true \
   --foreman-proxy-tftp-managed true \
   --foreman-proxy-tftp-servername $(hostname)

1. Section 3.7.1, “Obtain an SSL Certificate for Capsule Server”
2. Section 3.7.2, “Validate the Capsule Server’s SSL Certificate”
3. Section 3.7.3, “Create the Capsule Server’s Certificate Archive File”
4. Section 3.7.4, “Install the Capsule Server’s Custom Certificate”
5. Section 3.7.5, “Install the Capsule Server’s New Certificate on All Hosts”

1. Configure the Firewall.

   # firewall-cmd  --direct --add-rule ipv4 filter OUTPUT 0 -o lo -p \
   tcp -m tcp --dport 27017 -m owner --uid-owner apache -j ACCEPT \
   && firewall-cmd  --direct --add-rule ipv6 filter OUTPUT 0 -o lo -p \
   tcp -m tcp --dport 27017 -m owner --uid-owner apache -j ACCEPT \
   && firewall-cmd  --direct --add-rule ipv4 filter OUTPUT 0 -o lo -p \
   tcp -m tcp --dport 27017 -m owner --uid-owner root -j ACCEPT \
   && firewall-cmd  --direct --add-rule ipv6 filter OUTPUT 0 -o lo -p \
   tcp -m tcp --dport 27017 -m owner --uid-owner root -j ACCEPT \
   && firewall-cmd  --direct --add-rule ipv4 filter OUTPUT 1 -o lo -p \
   tcp -m tcp --dport 27017 -j DROP \
   && firewall-cmd  --direct --add-rule ipv6 filter OUTPUT 1 -o lo -p \
   tcp -m tcp --dport 27017 -j DROP \
   && firewall-cmd  --direct --add-rule ipv4 filter OUTPUT 0 -o lo -p \
   tcp -m tcp --dport 28017 -m owner --uid-owner apache -j ACCEPT \
   && firewall-cmd  --direct --add-rule ipv6 filter OUTPUT 0 -o lo -p \
   tcp -m tcp --dport 28017 -m owner --uid-owner apache -j ACCEPT \
   && firewall-cmd  --direct --add-rule ipv4 filter OUTPUT 0 -o lo -p \
   tcp -m tcp --dport 28017 -m owner --uid-owner root -j ACCEPT \
   && firewall-cmd  --direct --add-rule ipv6 filter OUTPUT 0 -o lo -p \
   tcp -m tcp --dport 28017 -m owner --uid-owner root -j ACCEPT \
   && firewall-cmd  --direct --add-rule ipv4 filter OUTPUT 1 -o lo -p \
   tcp -m tcp --dport 28017 -j DROP \
   && firewall-cmd  --direct --add-rule ipv6 filter OUTPUT 1 -o lo -p \
   tcp -m tcp --dport 28017 -j DROP

2. Make the changes persistent:

   # firewall-cmd --runtime-to-permanent

1. On the Red Hat Enterprise Linux Server, install the ISC DNS Service.

   # yum install bind bind-utils

   Ensure that the nsupdate utility was installed. The Capsule uses the nsupdate utility to update DNS records on the remote server.

2. Copy the /etc/rndc.key file from the services server to the Capsule Server.

   # scp localfile username@hostname:remotefile

3. Ensure that the ownership, permissions, and SELinux context are correct.

   # restorecon -v /etc/rndc.key
   # chown -v root:named /etc/rndc.key
   # chmod -v 640 /etc/rndc.key

4. Test the nsupdate utility by adding a host remotely.

   # echo -e "server 192.168.38.2\n \
   update add aaa.virtual.lan 3600 IN A 192.168.38.10\n \
   send\n" | nsupdate -k /etc/rndc.key
   # nslookup aaa.virtual.lan 192.168.38.2
   # echo -e "server 192.168.38.2\n \
   update delete aaa.virtual.lan 3600 IN A 192.168.38.10\n \
   send\n" | nsupdate -k /etc/rndc.key

5. Run the satellite-installer script to make the following persistent changes to the /etc/foreman-proxy/settings.d/dns.yml file.

   # satellite-installer --foreman-proxy-dns=true \
   --foreman-proxy-dns-managed=false \
   --foreman-proxy-dns-provider=nsupdate \
   --foreman-proxy-dns-server="192.168.38.2" \
   --foreman-proxy-keyfile=/etc/rndc.key \
   --foreman-proxy-dns-ttl=86400

6. Restart the foreman-proxy service.

   # systemctl restart foreman-proxy

7. Log in to the Satellite Server web UI.
8. Go to Infrastructure > Capsules. Locate the appropriate Capsule Server and from the Actions drop-down list, select Refresh. The DNS feature should appear.
9. Associate the DNS service with the appropriate subnets and domain.

To configure the DHCP server and share the DHCP configuration and lease files

1. Deploy a Red Hat Enterprise Linux Server and install the ISC DHCP Service and Berkeley Internet Name Domain (BIND).

   # yum install dhcp bind

2. Generate a security token in an empty directory.

   # dnssec-keygen -a HMAC-MD5 -b 512 -n HOST omapi_key

   The above command can take a long time, for less-secure proof-of-concept deployments you can use a non-blocking random number generator.

   # dnssec-keygen -r /dev/urandom -a HMAC-MD5 -b 512 -n HOST omapi_key

   This creates the key pair in two files in the current directory.

3. Copy the secret hash from the key.

   # cat Komapi_key.+*.private |grep ^Key|cut -d ' ' -f2

4. Edit the dhcpd configuration file for all of the subnets and add the key as in the example:

   # cat /etc/dhcp/dhcpd.conf
   default-lease-time 604800;
   max-lease-time 2592000;
   log-facility local7;
   
   subnet 192.168.38.0 netmask 255.255.255.0 {
   	range 192.168.38.10 192.168.38.100;
   	option routers 192.168.38.1;
   	option subnet-mask 255.255.255.0;
   	option domain-search "virtual.lan";
   	option domain-name "virtual.lan";
   	option domain-name-servers 8.8.8.8;
   }
   
   omapi-port 7911;
   key omapi_key {
   	algorithm HMAC-MD5;
   	secret "jNSE5YI3H1A8Oj/tkV4...A2ZOHb6zv315CkNAY7DMYYCj48Umw==";
   };
   omapi-key omapi_key;

5. Delete the two key files from the directory where you created them.

6. Define each subnet on the Satellite Server.

   It is recommended to set up a lease range and reservation range separately to prevent conflicts. For example, the lease range is 192.168.38.10 to 192.168.38.100 so the reservation range (defined in the Satellite web UI) is 192.168.38.101 to 192.168.38.250. Do not set DHCP Capsule for the defined Subnet yet.

7. Configure the firewall for external access to the DHCP server.

   # firewall-cmd --add-service dhcp \
   && firewall-cmd --runtime-to-permanent

8. Determine the UID and GID numbers of the foreman user on the Satellite Server.

   # id -u foreman
   993
   # id -g foreman
   990

9. Create the same user and group with the same IDs on the DHCP server.

   # groupadd -g 990 foreman
   # useradd -u 993 -g 990 -s /sbin/nologin foreman

10. To make the configuration files readable, restore the read and execute flags.

    # chmod o+rx /etc/dhcp/
    # chmod o+r /etc/dhcp/dhcpd.conf
    # chattr +i /etc/dhcp/ /etc/dhcp/dhcpd.conf

11. Start the DHCP service.

    # systemctl start dhcpd

12. Export the DHCP configuration and leases files using NFS.

    # yum install nfs-utils
    # systemctl enable rpcbind nfs-server
    # systemctl start rpcbind nfs-server nfs-lock nfs-idmapd

13. Create the DHCP configuration and leases files to be exported using NFS.

    # mkdir -p /exports/var/lib/dhcpd /exports/etc/dhcp

14. Add the following line to the /etc/fstab file to create mount points for the newly created directories.

    /var/lib/dhcpd /exports/var/lib/dhcpd none bind,auto 0 0
    /etc/dhcp /exports/etc/dhcp none bind,auto 0 0

15. Mount the file systems in /etc/fstab.

    # mount -a

16. Ensure the following lines are present in /etc/exports:

    /exports 192.168.38.1(rw,async,no_root_squash,fsid=0,no_subtree_check)
    
    /exports/etc/dhcp 192.168.38.1(ro,async,no_root_squash,no_subtree_check,nohide)
    
    /exports/var/lib/dhcpd 192.168.38.1(ro,async,no_root_squash,no_subtree_check,nohide)

17. Reload the NFS server.

    # exportfs -rva

18. Configure the firewall for the DHCP omapi port 7911 for the Satellite Server.

    # firewall-cmd --add-port="7911/tcp" \
    && firewall-cmd --runtime-to-permanent

19. If required, configure the firewall for external access to NFS.

    Clients are configured using NFSv3.

    • Use the firewalld daemon’s NFS service to configure the firewall.

      # firewall-cmd --zone public --add-service mountd \
      && firewall-cmd --zone public --add-service rpc-bind \
      && firewall-cmd --zone public --add-service nfs \
      && firewall-cmd --runtime-to-permanent

To Configure Capsule Server with External DHCP

1. Install the NFS client.

   # yum install nfs-utils

2. Create the DHCP directories for NFS.

   # mkdir -p /mnt/nfs/etc/dhcp /mnt/nfs/var/lib/dhcpd

3. Change the file owner.

   # chown -R foreman-proxy /mnt/nfs

4. Verify communication with the NFS server and RPC communication paths.

   # showmount -e your_DHCP_server_FQDN
   # rpcinfo -p your_DHCP_server_FQDN

5. Add the following lines to the /etc/fstab file:

   your_DHCP_server_FQDN:/exports/etc/dhcp /mnt/nfs/etc/dhcp nfs
   ro,vers=3,auto,nosharecache,context="system_u:object_r:dhcp_etc_t:s0" 0 0
   
   your_DHCP_server_FQDN:/exports/var/lib/dhcpd /mnt/nfs/var/lib/dhcpd nfs
   ro,vers=3,auto,nosharecache,context="system_u:object_r:dhcpd_state_t:s0" 0 0

6. Mount the file systems on /etc/fstab.

   # mount -a

7. Read the relevant files.

   # su foreman-proxy -s /bin/bash
   bash-4.2$ cat /mnt/nfs/etc/dhcp/dhcpd.conf
   bash-4.2$ cat /mnt/nfs/var/lib/dhcpd/dhcpd.leases
   bash-4.2$ exit

8. Run the satellite-installer script to make the following persistent changes to the /etc/foreman-proxy/settings.d/dhcp.yml file.

   # satellite-installer --foreman-proxy-dhcp=true \
   --foreman-proxy-dhcp-provider=remote_isc \
   --foreman-proxy-plugin-dhcp-remote-isc-dhcp-config /mnt/nfs/etc/dhcp/dhcpd.conf \
   --foreman-proxy-plugin-dhcp-remote-isc-dhcp-leases /mnt/nfs/var/lib/dhcpd/dhcpd.leases \
   --foreman-proxy-plugin-dhcp-remote-isc-key-name=omapi_key \
   --foreman-proxy-plugin-dhcp-remote-isc-key-secret=jNSE5YI3H1A8Oj/tkV4...A2ZOHb6zv315CkNAY7DMYYCj48Umw== \
   --foreman-proxy-plugin-dhcp-remote-isc-omapi-port=7911 \
   --enable-foreman-proxy-plugin-dhcp-remote-isc \
   --foreman-proxy-dhcp-server=your_DHCP_server_FQDN

9. Restart the foreman-proxy service.

   # systemctl restart foreman-proxy

10. Log in to the Satellite Server web UI.
11. Go to Infrastructure > Capsules. Locate the appropriate Capsule Server and from the Actions drop-down list, select Refresh. The DHCP feature should appear.
12. Associate the DHCP service with the appropriate subnets and domain.

1. Create the TFTP directory to prepare for NFS.

   # mkdir -p /mnt/nfs/var/lib/tftpboot

2. Add the following line in the /etc/fstab file:

   192.168.38.2:/exports/var/lib/tftpboot /mnt/nfs/var/lib/tftpboot nfs rw,vers=3,auto,nosharecache,context="system_u:object_r:tftpdir_rw_t:s0" 0 0

3. Mount the file systems in /etc/fstab.

   # mount -a

4. Run the satellite-installer script to make the following persistent changes to the /etc/foreman-proxy/settings.d/tftp.yml file.

   # satellite-installer --foreman-proxy-tftp=true \
   --foreman-proxy-tftp-root /mnt/nfs/var/lib/tftpboot

5. If the TFTP service is running on a different server than the DHCP service, update the tftp_servername setting with the FQDN or IP address of that server.

   # satellite-installer --foreman-proxy-tftp-servername=new_FQDN

   This updates all configuration files with the new value.

6. Log in to the Satellite Server web UI.
7. Go to Infrastructure > Capsules. Locate the appropriate Capsule Server and from the Actions drop-down list, select Refresh. The TFTP feature should appear.
8. Associate the TFTP service with the appropriate subnets and domain.