Chapter 1. Configuring DNS integration

Procedure

1. Configure Satellite or Capsule as DNS server:

   # satellite-installer \
   --foreman-proxy-dns true \
   --foreman-proxy-dns-provider nsupdate \
   --foreman-proxy-dns-managed true \
   --reset-foreman-proxy-dns-server

2. For each affected Capsule, update the configuration of that Capsule in the Satellite web UI. For more information, see Section 1.8, “Associating the DNS service with a domain and subnet”.

Procedure

1. Set the local, self-managed DNS service on your Satellite Server or Capsule Server:

   # satellite-installer \
   --foreman-proxy-dns true \
   --foreman-proxy-dns-provider nsupdate \
   --foreman-proxy-dns-managed false \
   --foreman-proxy-dns-server "127.0.0.1"

2. For each affected Capsule, update the configuration of that Capsule in the Satellite web UI. For more information, see Section 1.8, “Associating the DNS service with a domain and subnet”.

Procedure

1. Update the permissions on /etc/foreman-proxy/rndc.key to enable members of the foreman-proxy group to read this file:

   # chown -v root:foreman-proxy /etc/foreman-proxy/rndc.key
   # chmod -v 640 /etc/foreman-proxy/rndc.key

2. Restore the SELinux context on /etc/foreman-proxy/rndc.key:

   # restorecon -v /etc/foreman-proxy/rndc.key

3. Optional: Verify if you can use the key file to manually manage DNS entries:

   1. Create a test DNS entry. For example, host test.example.com with an A record of 192.168.25.20 on the DNS server at 192.168.25.1.

      # echo -e "server 192.168.25.1\n \
      update add test.example.com 3600 IN A 192.168.25.20\n \
      send\n" | nsupdate -k /etc/foreman-proxy/rndc.key

   2. Verify that you can query the new DNS entry:

      # host test.example.com 192.168.25.1

      Example output:

      Using domain server:
      Name: 192.168.25.1
      Address: 192.168.25.1#53
      Aliases:
      
      test.example.com has address 192.168.25.20

   3. If resolved successfully, remove the test DNS entry:

      # echo -e "server 192.168.25.1\n \
      update delete test.example.com 3600 IN A 192.168.25.20\n \
      send\n" | nsupdate -k /etc/foreman-proxy/rndc.key

   4. Confirm that the DNS entry was removed:

      # host test.example.com 192.168.25.1

      If the command returns Host test.example.com not found: 3(NXDOMAIN), the record was successfully deleted.

4. Configure Satellite Server or Capsule Server to use the DNS server:

   # satellite-installer \
   --foreman-proxy-dns true \
   --foreman-proxy-dns-provider nsupdate \
   --foreman-proxy-dns-managed false \
   --foreman-proxy-dns-server "dns_server_ip_address" \
   --foreman-proxy-keyfile /etc/foreman-proxy/rndc.key

5. For the affected Capsule, update the configuration of that Capsule in the Satellite web UI. For more information, see Section 1.8, “Associating the DNS service with a domain and subnet”.

Procedure

1. Perform the following steps on the Identity Management Server:

   1. Insert the following settings at the top of the /etc/named.conf file:

      include "/etc/rndc.key";
      controls {
          inet Identity Management_server_ip_address port 953 allow { Satellite_ip_address; } keys { "rndc-key"; };
      };

   2. Reload the named service:

      # systemctl reload named

2. In the Identity Management web UI:

   1. Navigate to Network Services > DNS > DNS Zones
   2. Click the name of the zone.
   3. Open the Settings tab.

   4. Enter in the BIND update policy field:

      grant "rndc-key" zonesub ANY;

   5. Set Dynamic update to True.
   6. Click Update to save the changes.
3. Configure dynamic DNS updates in Satellite Server or Capsule Server. For more information, see Section 1.4, “Integrating a generic RFC 2136-compatible remote DNS server”.

Procedure

1. Download the certificate from the Infoblox server, and store it in the /etc/pki/ca-trust/source/anchors/infoblox.crt file:

   # openssl s_client -showcerts -connect infoblox.example.com:443 </dev/null | \
   openssl x509 -text >/etc/pki/ca-trust/source/anchors/infoblox.crt

   The hostname must match the one for the Infoblox application in the X.509 certificate.

2. Add the Infoblox certificate to the system truststore:

   # update-ca-trust extract

3. Test the CA certificate by using it in a query to the Infoblox API:

   # curl -u admin:password https://infoblox.example.com/wapi/v2.0/network

   Example of a positive response:

   [
       {
           "_ref": "network/ZG5zLm5ldHdvcmskMTkyLjE2OC4yMDIuMC8yNC8w:infoblox.example.com/24/default",
           "network": "192.168.202.0/24",
           "network_view": "default"
       }
   ]

4. Configure Satellite Server or Capsule Server to connect to the Infoblox DNS service:

   # satellite-installer \
   --foreman-proxy-dns true \
   --foreman-proxy-dns-provider infoblox \
   --enable-foreman-proxy-plugin-dns-infoblox \
   --foreman-proxy-plugin-dns-infoblox-dns-server infoblox.example.com \
   --foreman-proxy-plugin-dns-infoblox-username admin \
   --foreman-proxy-plugin-dns-infoblox-password password \
   --foreman-proxy-plugin-dns-infoblox-dns-view view_name

   Omit the --foreman-proxy-plugin-dns-infoblox-dns-view option if you use the default view in Infoblox DNS.

5. For each affected Capsule, update the configuration of that Capsule in the Satellite web UI. For more information, see Section 1.8, “Associating the DNS service with a domain and subnet”.

Procedure

1. Configure the domain:

   1. In the Satellite web UI, navigate to Infrastructure > Domains.
   2. Select the domain name.
   3. On the Domain tab, ensure DNS Capsule is set to the Capsule where the subnet is connected.

2. Configure the subnet:

   1. Navigate to Infrastructure > Subnets.
   2. Select the subnet name.
   3. On the Domains tab, select the domains that are valid on the subnet.
   4. In the Capsules tab, ensure Reverse DNS Capsule is set to the Capsule where the subnet is connected.
   5. Click Submit.

Procedure

1. In the Satellite web UI, navigate to Infrastructure > Subnets.

2. For each subnet that is associated with the DNS Capsule:

   1. Select the subnet.
   2. On the Capsules tab, clear the Reverse DNS Capsule field.
   3. Click Submit.
3. Navigate to Infrastructure > Domains.

4. For each domain that is associated with the DNS Capsule:

   1. Select the domain.
   2. Clear the DNS Capsule field.
   3. Click Submit.

5. On Satellite Server, enter:

   # satellite-installer --foreman-proxy-dns false

   Note

   Satellite does not perform orchestration when a Capsule is not set for a given subnet and domain. When you disable Capsule associations, orchestration commands for existing hosts can fail if the expected records and configuration files are not present.