Red Hat Summit Red Hat SummitSupportConsoleDéveloppeursCommencer un essaiContact

Ce contenu n'est pas disponible dans la langue sélectionnée.

Chapter 3. Performing Additional Configuration on Capsule Server

Use this chapter to configure additional settings on your Capsule Server.

Use this procedure to configure Capsule so that you can register and provision hosts using your Capsule Server instead of your Satellite Server.

Procedure

  • On Satellite Server, add the Capsule to the list of trusted proxies.

    This is required for Satellite to recognize hosts' IP addresses forwarded over the X-Forwarded-For HTTP header set by Capsule. For security reasons, Satellite recognizes this HTTP header only from localhost by default. You can enter trusted proxies as valid IPv4 or IPv6 addresses of Capsules, or network ranges.

    Warning

    Do not use a network range that is too wide, because that poses a potential security risk.

    Enter the following command. Note that the command overwrites the list that is currently stored in Satellite. Therefore, if you have set any trusted proxies previously, you must include them in the command as well: 

    # satellite-installer \
--foreman-trusted-proxies "127.0.0.1/8" \
--foreman-trusted-proxies "::1" \
--foreman-trusted-proxies "My_IP_address" \
--foreman-trusted-proxies "My_IP_range"
    Copy to Clipboard Toggle word wrap

    The localhost entries are required, do not omit them.

Verification

  1. List the current trusted proxies using the full help of Satellite installer: 

    # satellite-installer --full-help | grep -A 2 "trusted-proxies"
    Copy to Clipboard Toggle word wrap
  2. The current listing contains all trusted proxies you require.

3.2. Enabling Katello Agent on External Capsules
Copier lien

Remote Execution is the primary method of managing packages on Content Hosts. To be able to use the deprecated Katello Agent it must be enabled on each Capsule.

Procedure

  • To enable Katello Agent infrastructure, enter the following command: 

    # satellite-installer --scenario capsule \
--foreman-proxy-content-enable-katello-agent=true
    Copy to Clipboard Toggle word wrap

3.3. Configuring Remote Execution for Pull Client
Copier lien

By default, Remote Execution uses SSH as the transport mechanism for the Script provider. However, Remote Execution also offers pull-based transport, which you can use if your infrastructure prohibits outgoing connections from Capsule to hosts.

This is comprised of pull-mqtt mode on Capsule in combination with a pull client running on hosts. Configure the pull-mqtt mode to migrate from Katello Agent, which is a deprecated method of pull-based transport.

Note

The pull-mqtt mode works only with the Script provider. Ansible and other providers will continue to use their default transport settings.

The mode is configured per Capsule. Some Capsules can be configured to use pull-mqtt mode while others use SSH. If this is the case, it is possible that one remote job on a given host will use the pull client and the next job on the same host will use SSH. If you wish to avoid this scenario, configure all Capsules to use the same mode.

Procedure

  1. Enable the pull-based transport on each relevant Capsule Server: 

     # satellite-installer --scenario capsule \
--foreman-proxy-plugin-remote-execution-script-mode pull-mqtt
    Copy to Clipboard Toggle word wrap

  2. Configure the firewall to allow MQTT service on port 1883: 

    # firewall-cmd --add-port="1883/tcp"
# firewall-cmd --runtime-to-permanent
    Copy to Clipboard Toggle word wrap
  3. In pull-mqtt mode, hosts subscribe for job notifications to the Capsule through which they are registered. Therefore, it is recommended to ensure that Satellite Server sends remote execution jobs to that same Capsule. To do this, in the Satellite web UI, navigate to Administer > Settings. On the Content tab, set the value of Prefer registered through Capsule for remote execution to Yes.
  4. After you set up the pull-based transport on Capsule, you must also configure it on each host. For more information, see Transport Modes for Remote Execution in Managing Hosts.

3.4. Enabling OpenSCAP on Capsule Servers
Copier lien

On Satellite Server and the integrated Capsule of your Satellite Server, OpenSCAP is enabled by default. To use the OpenSCAP plug-in and content on external Capsules, you must enable OpenSCAP on each Capsule.

Procedure

  • To enable OpenSCAP, enter the following command: 

    # satellite-installer --scenario capsule \
--enable-foreman-proxy-plugin-openscap \
--foreman-proxy-plugin-openscap-puppet-module true
    Copy to Clipboard Toggle word wrap

    If you want to use Puppet to deploy compliance policies, you must enable it first. For more information, see Managing Configurations Using Puppet Integration in Red Hat Satellite.

3.5. Adding Life Cycle Environments to Capsule Servers
Copier lien

If your Capsule Server has the content functionality enabled, you must add an environment so that Capsule can synchronize content from Satellite Server and provide content to host systems.

Do not assign the Library lifecycle environment to your Capsule Server because it triggers an automated Capsule sync every time the CDN updates a repository. This might consume multiple system resources on Capsules, network bandwidth between Satellite and Capsules, and available disk space on Capsules.

You can use Hammer CLI on Satellite Server or the Satellite web UI.

Procedure

  1. In the Satellite web UI, navigate to Infrastructure > Capsules, and select the Capsule that you want to add a life cycle to.
  2. Click Edit and click the Life Cycle Environments tab.
  3. From the left menu, select the life cycle environments that you want to add to Capsule and click Submit.
  4. To synchronize the content on the Capsule, click the Overview tab and click Synchronize.

  5. Select either Optimized Sync or Complete Sync.

    For definitions of each synchronization type, see Recovering a Repository.

CLI procedure

  1. To display a list of all Capsule Servers, on Satellite Server, enter the following command: 

    # hammer capsule list
    Copy to Clipboard Toggle word wrap

    Note the Capsule ID of the Capsule that you want to add a life cycle to.

  2. Using the ID, verify the details of your Capsule: 

    # hammer capsule info \
--id My_capsule_ID
    Copy to Clipboard Toggle word wrap

  3. To view the life cycle environments available for your Capsule Server, enter the following command and note the ID and the organization name: 

    # hammer capsule content available-lifecycle-environments \
--id My_capsule_ID
    Copy to Clipboard Toggle word wrap

  4. Add the life cycle environment to your Capsule Server: 

    # hammer capsule content add-lifecycle-environment \
--id My_capsule_ID \
--lifecycle-environment-id My_Lifecycle_Environment_ID
--organization "My_Organization"
    Copy to Clipboard Toggle word wrap

    Repeat for each life cycle environment you want to add to Capsule Server.

  5. Synchronize the content from Satellite to Capsule.

    • To synchronize all content from your Satellite Server environment to Capsule Server, enter the following command: 

      # hammer capsule content synchronize \
--id My_capsule_ID
      Copy to Clipboard Toggle word wrap

    • To synchronize a specific life cycle environment from your Satellite Server to Capsule Server, enter the following command: 

      # hammer capsule content synchronize \
--id My_capsule_ID
--lifecycle-environment-id My_Lifecycle_Environment_ID
      Copy to Clipboard Toggle word wrap

3.6. Enabling Power Management on Managed Hosts
Copier lien

To perform power management tasks on managed hosts using the intelligent platform management interface (IPMI) or a similar protocol, you must enable the baseboard management controller (BMC) module on Capsule Server.

Prerequisites

Procedure

  • To enable BMC, enter the following command: 

    # satellite-installer --scenario capsule \
--foreman-proxy-bmc "true" \
--foreman-proxy-bmc-default-provider "freeipmi"
    Copy to Clipboard Toggle word wrap

3.7. Configuring DNS, DHCP, and TFTP on Capsule Server
Copier lien

To configure the DNS, DHCP, and TFTP services on Capsule Server, use the satellite-installer command with the options appropriate for your environment. To view a complete list of configurable options, enter the satellite-installer --scenario satellite --help command.

Any changes to the settings require entering the satellite-installer command again. You can enter the command multiple times and each time it updates all configuration files with the changed values.

To use external DNS, DHCP, and TFTP services instead, see Chapter 4, Configuring Capsule Server with External Services.

Adding Multihomed DHCP details

If you want to use Multihomed DHCP, you must inform the installer.

Prerequisites

  • You must have the correct network name (dns-interface) for the DNS server.
  • You must have the correct interface name (dhcp-interface) for the DHCP server.
  • Contact your network administrator to ensure that you have the correct settings.

Procedure

  • Enter the satellite-installer command with the options appropriate for your environment. The following example shows configuring full provisioning services: 

    # satellite-installer --scenario capsule \
--foreman-proxy-dns true \
--foreman-proxy-dns-managed true \
--foreman-proxy-dns-interface eth0 \
--foreman-proxy-dns-zone example.com \
--foreman-proxy-dns-reverse 2.0.192.in-addr.arpa \
--foreman-proxy-dhcp true \
--foreman-proxy-dhcp-managed true \
--foreman-proxy-dhcp-interface eth0 \
--foreman-proxy-dhcp-additional-interfaces eth1 \
--foreman-proxy-dhcp-additional-interfaces eth2 \
--foreman-proxy-dhcp-range "192.0.2.100 192.0.2.150" \
--foreman-proxy-dhcp-gateway 192.0.2.1 \
--foreman-proxy-dhcp-nameservers 192.0.2.2 \
--foreman-proxy-tftp true \
--foreman-proxy-tftp-managed true \
--foreman-proxy-tftp-servername 192.0.2.3
    Copy to Clipboard Toggle word wrap

For more information about configuring DHCP, DNS, and TFTP services, see Configuring Network Services in Provisioning Hosts.

Retour au début
Red Hat logoGithubredditYoutubeTwitter

Apprendre

Essayez, achetez et vendez

Communautés

À propos de la documentation Red Hat

Nous aidons les utilisateurs de Red Hat à innover et à atteindre leurs objectifs grâce à nos produits et services avec un contenu auquel ils peuvent faire confiance. Découvrez nos récentes mises à jour.

Rendre l’open source plus inclusif

Red Hat s'engage à remplacer le langage problématique dans notre code, notre documentation et nos propriétés Web. Pour plus de détails, consultez le Blog Red Hat.

À propos de Red Hat

Nous proposons des solutions renforcées qui facilitent le travail des entreprises sur plusieurs plates-formes et environnements, du centre de données central à la périphérie du réseau.

Theme

© 2025 Red Hat