Chapter 2. Installing Capsule Server
Before you install Capsule Server, you should ensure that your environment meets the requirements for installation. Capsule Server has the same requirements for installation as Satellite Server, with the additional requirement that you have not configured it to use a proxy to connect to the Red Hat CDN. For more information, see Section 1.1, “System Requirements”.
2.1. Registering to Satellite Server
Use this procedure to register the base system on which you want to install Capsule to Satellite Server.
Subscription Manifest Considerations
- The Satellite Server must have a manifest installed with the appropriate repositories for the organization you want the future Capsule to belong to.
- The manifest must contain repositories for the base system on which you want to install Capsule, as well as any clients that you want to connect to the Capsule.
- The repositories must be synchronized.
For more information on manifests and repositories, see Managing Subscriptions in the Red Hat Satellite Content Management Guide.
Proxy and Network Considerations
- The Satellite Server’s base system must be able to resolve the host name of the base system on which you want to install Capsule and vice versa.
- You must revert any changes related to the use of proxies which prevent access to Red Hat Satellite.
- You must have configured host and network-based firewalls. For more information, see Section 1.4, “Ports and Firewalls Requirements”.
- You must have a Satellite Server user name and password. For more information, see Configuring External Authentication in Administering Red Hat Satellite.
Register to Satellite Server
Install the Satellite Server’s CA certificate on the base system on which you want to install Capsule.
# rpm -Uvh http://satellite.example.com/pub/katello-ca-consumer-latest.noarch.rpm
Register the base system on which you want to install Capsule with the environments that you want the future Capsule to belong to. Use an activation key to simplify specifying the environments.
# subscription-manager register --org=organization_name --activationkey=example_activation_key
2.2. Identifying and Attaching the Capsule Server Subscription
After you have registered the Capsule Server, you must identify your subscription Pool ID and attach an available subscription. The Red Hat Satellite Infrastructure subscription provides access to the Red Hat Satellite, Red Hat Enterprise Linux, and Red Hat Software Collections (RHSCL) content. This is the only subscription required.
Red Hat Satellite Infrastructure is included with all subscriptions that include Smart Management. For more information, see the Red Hat Knowledgebase solution Satellite Infrastructure Subscriptions MCT3718 MCT3719.
Identify your Capsule Server subscription.
# subscription-manager list --all --available --matches='Red Hat Satellite Infrastructure Subscription'
The command displays output similar to the following:
Subscription Name: Red Hat Satellite Infrastructure Subscription Provides: Red Hat Beta Red Hat Satellite Red Hat Satellite with Embedded Oracle Red Hat Satellite 5 Managed DB Red Hat Satellite Proxy Red Hat Software Collections (for RHEL Server) Red Hat Satellite Capsule Red Hat Software Collections Beta (for RHEL Server) Red Hat Enterprise Linux High Availability for x86_64 Red Hat Ansible Engine Red Hat Enterprise Linux Load Balancer (for RHEL Server) Red Hat Enterprise Linux Server SKU: MCT3718 Contract: Account: 540155 Serial: 6960416325892182336 Pool ID: 8a85f999655dc45a01658350d80d7164 Provides Management: Yes Active: True Quantity Used: 1 Service Level: Premium Service Type: L1-L3 Status Details: Subscription is current Subscription Type: Standard Starts: 08/28/2018 Ends: 09/19/2019 System Type: Physical- Make a note of the Pool ID so that you can attach it to your Satellite host. Your Pool ID is different than the example provided.
Attach your subscription to your Capsule Server, using your Pool ID:
# subscription-manager attach --pool=pool_idThe outputs displays something similar to the following:
Successfully attached a subscription for: Red Hat Capsule Server
To verify that the subscriptions are successfully attached, enter the following command:
# subscription-manager list --consumed
2.3. Configuring Repositories
Disable all existing repositories.
# subscription-manager repos --disable "*"
Enable the Red Hat Satellite Capsule, Red Hat Enterprise Linux, and Red Hat Software Collections repositories.
The Red Hat Software Collections repository provides a later version of Ruby required by some Red Hat Satellite Capsule features, including the Remote Execution feature.
# subscription-manager repos --enable rhel-7-server-rpms \ --enable rhel-7-server-satellite-capsule-6.5-rpms \ --enable rhel-server-rhscl-7-rpms \ --enable rhel-7-server-satellite-maintenance-6-rpms \ --enable rhel-7-server-ansible-2.6-rpms
Clear out any metadata left from any non-Red Hat
yumrepositories.# yum clean all
Verify that the repositories have been enabled.
# yum repolist enabled
2.4. Synchronizing Time
You must start and enable a time synchronizer on the host operating system to minimize the effects of time drift. If a system’s time is incorrect, certificate verification can fail.
Two NTP based time synchronizers are available: chronyd and ntpd. The chronyd implementation is specifically recommended for systems that are frequently suspended and for systems that have intermittent network access. The ntpd implementation should only be used when you specifically need support for a protocol or driver not yet supported by chronyd.
For more information about the differences between ntpd and chronyd, see Differences Between ntpd and chronyd in the Red Hat Enterprise Linux 7 System Administrator’s Guide.
Synchronizing Time using chronyd
Install chronyd.
# yum install chrony
Start and enable the chronyd service.
# systemctl start chronyd # systemctl enable chronyd
2.5. Installing Capsule Server
Update all packages.
# yum update
Install the installation package.
# yum install satellite-capsule
2.6. Performing Initial Configuration of Capsule Server
This section demonstrates a default installation of Capsule Server, including use of default certificates, DNS, and DHCP configuration. For details of more advanced configuration options, see Performing Additional Configuration on Capsule Server.
2.6.1. Configuring Capsule Server with a Default Server Certificate
You can use the default certificate authority (CA) that comes with Capsule Server, which is used by both the server and the client SSL certificates for the authentication of subservices.
If you configured Satellite Server to use a custom SSL certificate, proceed to Section 3.7, “Configuring Capsule Server with a Custom Server Certificate”.
Before You Begin
-
Ensure that Capsule is installed and
satellite-installerpackage is available on Capsule Server. - You must have configured host and network-based firewalls. For more information, see Section 1.4, “Ports and Firewalls Requirements”.
-
You must have installed the
katello-ca-consumer-latestpackage. For more information, see Section 2.1, “Registering to Satellite Server”. - You must have registered your Capsule Server to the Satellite Server.
- You must have attached the required subscription to the Capsule Server.
Configure Capsule Server with a Default Server Certificate
On Satellite Server, create the certificates archive:
# capsule-certs-generate \ --foreman-proxy-fqdn mycapsule.example.com \ --certs-tar mycapsule.example.com-certs.tar
Retain a copy of the
satellite-installercommand that is output by thecapsule-certs-generatecommand for installing the Capsule Server certificates.-
Copy the generated archive
.tarfile from Satellite Server to Capsule Server. On Capsule Server, run the
satellite-installercommand that thecapsule-certs-generatecommand outputs to install Capsule Server certificates:# satellite-installer --scenario capsule \ --foreman-proxy-content-parent-fqdn satellite.example.com \ --foreman-proxy-register-in-foreman true \ --foreman-proxy-foreman-base-url https://satellite.example.com \ --foreman-proxy-trusted-hosts satellite.example.com \ --foreman-proxy-trusted-hosts mycapsule.example.com \ --foreman-proxy-oauth-consumer-key UVrAZfMaCfBiiWejoUVLYCZHT2xhzuFV \ --foreman-proxy-oauth-consumer-secret ZhH8p7M577ttNU3WmUGWASag3JeXKgUX \ --foreman-proxy-content-certs-tar mycapsule.example.com-certs.tar \ --puppet-server-foreman-url "https://satellite.example.com"
NoteWhen network connections or ports to the Satellite are not yet open, you can set the
--foreman-proxy-register-in-foremanoption tofalseto prevent Capsule from attempting to connect to Satellite and reporting errors. Run the installer again with this option set totruewhen the network and firewalls are correctly configured.
