11.7. Using the VMware vSphere Cloud-init and Userdata Templates for Provisioning
You can use VMware with the Cloud-init and Userdata templates to insert user data into the new virtual machine, to make further VMware customization, and to enable the VMware-hosted virtual machine to call back to Satellite.
You can use the same procedures to set up a VMware compute resource within Satellite, with a few modifications to the work flow.
VMware cloud-init Provisioning Overview
When you set up the compute resource and images for VMware provisioning in Satellite, the following sequence of provisioning events occur:
- The user provisions one or more virtual machines using the Satellite web UI, API, or hammer
- Satellite calls the VMware vCenter to clone the virtual machine template
-
Satellite
userdataprovisioning template adds customized identity information -
When provisioning completes, the
Cloud-initprovisioning template instructs the virtual machine to call back to Capsule whencloud-initruns - VMware vCenter clones the template to the virtual machine
- VMware vCenter applies customization for the virtual machine’s identity, including the host name, IP, and DNS
-
The virtual machine builds,
cloud-initis invoked and calls back Satellite on port80, which then redirects to443
Port and Firewall Requirements
Because of the cloud-init service, the virtual machine always calls back to Satellite even if you register the virtual machine to Capsule. Ensure that you configure port and firewall settings to open any necessary connections.
For more information about port and firewall requirements, see Port and Firewall Requirements in the Installing Satellite and Ports and Firewalls Requirements in Installing Capsule Server.
Associating the userdata and Cloud-init Templates with the Operating System
- In the Satellite web UI, navigate to Hosts > Operating Systems, and select the operating system that you want to use for provisioning.
- Click the Template tab.
- From the Cloud-init template list, select Cloudinit default.
- From the User data template list, select UserData open-vm-tools.
- Click Submit to save the changes.
Preparing an Image to use the cloud-init Template
To prepare an image, you must first configure the settings that you require on a virtual machine that you can then save as an image to use in Satellite.
To use the cloud-init template for provisioning, you must configure a virtual machine so that cloud-init is installed, enabled, and configured to call back to Satellite Server.
For security purposes, you must install a CA certificate to use HTTPs for all communication. This procedure includes steps to clean the virtual machine so that no unwanted information transfers to the image you use for provisioning.
If you have an image with cloud-init, you must still follow this procedure to enable cloud-init to communicate with Satellite because cloud-init is disabled by default.
On the virtual machine that you use to create the image, install
cloud-init,open-vm-tools, andperl:# yum -y install cloud-init open-vm-tools perlCreate a configuration file for
cloud-init:# vi /etc/cloud/cloud.cfg.d/example_cloud-init_config.cfgAdd the following information to the
example_cloud_init_config.cfgfile:datasource_list: [NoCloud] datasource: NoCloud: seedfrom: https://satellite.example.com/userdata/ EOFEnable the CA certificates for the image:
# update-ca-trust enableDownload the
katello-server-ca.crtfile from Satellite Server:# wget -O /etc/pki/ca-trust/source/anchors/cloud-init-ca.crt http://satellite.example.com/pub/katello-server-ca.crtTo update the record of certificates, enter the following command:
# update-ca-trust extractUse the following commands to clean the image:
# systemctl stop rsyslog # systemctl stop auditd # package-cleanup --oldkernels --count=1 # yum clean allUse the following commands to reduce logspace, remove old logs, and truncate logs:
# logrotate -f /etc/logrotate.conf # rm -f /var/log/*-???????? /var/log/*.gz # rm -f /var/log/dmesg.old # rm -rf /var/log/anaconda # cat /dev/null > /var/log/audit/audit.log # cat /dev/null > /var/log/wtmp # cat /dev/null > /var/log/lastlog # cat /dev/null > /var/log/grubbyRemove
udevhardware rules:# rm -f /etc/udev/rules.d/70*Remove the
uuidfromifcfgscripts:# cat > /etc/sysconfig/network-scripts/ifcfg-ens192 <<EOM DEVICE=ens192 ONBOOT=yes EOMRemove the SSH host keys:
# rm -f /etc/ssh/SSH_keysRemove root user’s shell history:
# rm -f ~root/.bash_history # unset HISTFILERemove root user’s SSH history:
# rm -rf ~root/.ssh/known_hosts
You can now create an image from this virtual machine.
You can use the 「Adding VMware vSphere Images to Satellite Server」 section to add the image to Satellite.
Configuring Capsule to Forward the user data Template
If you deploy Satellite with the Capsule templates feature, you must configure Satellite to recognize hosts' IP addresses forwarded over the X-Forwarded-For HTTP header to serve correct template payload.
For security reasons, Satellite recognizes this HTTP header only from localhost. For each individual Capsule, you must configure a regular expression to recognize hosts' IP addresses. From the web UI, you can do this by navigating to Administer > Settings > Provisioning, and changing the Remote address setting. From the CLI, you can do this by entering the following command:
# hammer settings set --name remote_addr --value '(localhost(4|6|4to6)?|192.168.122.(1|2|3))'