Skip to content

Latest commit

 

History

History
373 lines (336 loc) · 12 KB

EX403_study_notes.md

File metadata and controls

373 lines (336 loc) · 12 KB
Raw

Study notes for EX403 Satellite 6 Deployment and Systems Management

by Tomas Nevar (tomas@lisenet.com)

Exam objectives:

  • Install Red Hat Satellite Server from an ISO image
  • Create and configure organizations and locations
  • Create and configure Red Hat Satellite users and roles
  • Create GNU Privacy Guard (GPG) keys to sign RPMs
  • Create and configure development life cycles
  • Create a Puppet product repository
  • Configure Red Hat Satellite subscriptions, content, and content views
  • Install a Red Hat Satellite capsule server using an ISO image
  • Build a custom RPM from a source tarball
  • Create a Red Hat Satellite activation key
  • Create a Red Hat Satellite host group
  • Define smart class parameters for a Puppet module
  • Register an existing client to a Red Hat Satellite server
  • Apply errata to client
  • Configure bare-metal deployment on Red Hat Satellite
  • Deploy clients using kick starts

1. What is Red Hat Satellite?

Red Hat Satellite 6 is a federation of several upstream open source projects, including Foreman, Katello, Pulp and Candlepin.

  • Foreman: provisioning on new clients.
  • Pulp: patch and content (package repository) management.
  • Candlepin: subscription and entitlement management.
  • Katello: unified workflow and WebUI for Pulp and Candlepin.
  • Puppet: configuration management.
  • Hammer: CLI tool providing shell equivalents of most Web UI functions.

Red Hat Satellite 6 hardware and software requirements:

  • The latest version of RHEL 6 server or 7 server.
  • A minimum of 2 CPU cores, but 4 CPU cores are recommended.
  • A minimum of 8 GB memory but ideally 12 GB of memory.
  • Use 4 GB of swap space where possible.
  • No Java virtual machine installed on the system.
  • No Puppet RPM files installed on the system.
  • No third-party unsupported yum repositories enabled.
  • Full forward and reverse DNS resolution using a FQDN.
  • At least 10GB of free disk space for disconnected installations.

A lot of the exam objectives are covered in my homelab.

2. Install Red Hat Satellite Server from an ISO image

# firewall-cmd --permanent --add-service={RH-Satellite-6,dhcp,dns,tftp}
# firewall-cmd --permanent --add-port=68/udp
# firewall-cmd --permanent --add-port=8000/tcp
# firewall-cmd --reload

# wget http://example.com/satellite-6-dvd.iso
# mount -o loop ./satellite-6-dvd.iso /mnt

Package installation may take up to 10 minutes:

# cd /mnt && ./install_packages
# cd && umount /mnt

It may take around 20 minutes to install the server. Use satellite-installer to enable/configure DNS, DHCP and TFTP services:

# satellite-installer \
  --scenario satellite \
  --foreman-admin-username admin \
  --foreman-admin-password password \
  --foreman-proxy-dns true \
  --foreman-proxy-dhcp true \
  --foreman-proxy-tftp true \
  --foreman-proxy-dns-interface eth0 \
  --foreman-proxy-dhcp-interface eth0 \
  --foreman-proxy-dns-zone ex403.hl.local \
  --foreman-proxy-dns-forwarders 10.11.1.2 \
  --foreman-proxy-dns-reverse 1.11.10.in-addr.arpa \
  --foreman-proxy-dhcp-range "10.11.1.90 10.11.1.95" \
  --foreman-proxy-dhcp-gateway 10.11.1.1 \
  --foreman-proxy-dhcp-nameservers 10.11.1.70

On the Satellite server, generate a certificate for the capsule:

# capsule-certs-generate --capsule-fqdn capsule.hl.local \
  --certs-tar ~/capsule.hl.local.tar

 To finish the capsule installation, follow these steps:

  satellite-installer --scenario capsule\
    --capsule-parent-fqdn                  "satellite.hl.local"\
    --foreman-proxy-register-in-foreman    "true"\
    --foreman-proxy-foreman-base-url       "https://satellite.hl.local"\
    --foreman-proxy-trusted-hosts          "satellite.hl.local"\
    --foreman-proxy-trusted-hosts          "capsule.hl.local"\
    --foreman-proxy-oauth-consumer-key     "A1EVNBrjxaW9qKV7omorF6nU43BjcMM0"\
    --foreman-proxy-oauth-consumer-secret  "B2tj8K26M8yLTTCFtQrWFAyxb28ssHc0"\
    --capsule-pulp-oauth-secret            "C3nPpEru7UuwMNGDnjRkzGrVNwTGwA90"\
    --capsule-certs-tar                    "/root/capsule.hl.local.tar"
  The full log is at /var/log/capsule-certs-generate.log

# scp /root/capsule.hl.local.tar capsule.hl.local:~/

3. Install a Red Hat Satellite Capsule Server Using an ISO Image

# firewall-cmd --permanent --add-service={RH-Satellite-6,dhcp,dns,tftp}
# firewall-cmd --permanent --add-port=68/udp
# firewall-cmd --permanent --add-port=8000/tcp
# firewall-cmd --reload

# wget http://example.com/satellite-capsule-6-dvd.iso
# mount -o loop ./satellite-capsule-6-dvd.iso /mnt
# cp /mnt/media.repo /etc/yum.repos.d/capsule.repo
# echo "baseurl=file:///mnt/" >> /etc/yum.repos.d/capsule.repo
# chmod 0644 /etc/yum.repos.d/capsule.repo
# yum install -y satellite-capsule

Register capsule to Satellite under the Default Organization:

# yum -y localinstall \
  http://satellite.hl.local/pub/katello-ca-consumer-latest.noarch.rpm
# subscription-manager register --org=Default_Organization

Configure capsule as a content node using the satellite-installer command that was displayed previously in the output of the capsule-certs-generate command executed on the Satellite server:

# satellite-installer --scenario capsule \
 --capsule-parent-fqdn                  "satellite.hl.local" \
 --foreman-proxy-register-in-foreman    "true" \
 --foreman-proxy-foreman-base-url       "https://satellite.hl.local" \
 --foreman-proxy-trusted-hosts          "satellite.hl.local" \
 --foreman-proxy-trusted-hosts          "capsule.hl.local" \
 --foreman-proxy-oauth-consumer-key     "A1EVNBrjxaW9qKV7omorF6nU43BjcMM0" \
 --foreman-proxy-oauth-consumer-secret  "B2tj8K26M8yLTTCFtQrWFAyxb28ssHc0" \
 --capsule-pulp-oauth-secret            "C3nPpEru7UuwMNGDnjRkzGrVNwTGwA90" \
 --capsule-certs-tar                    "/root/capsule.hl.local.tar"

It may take around 5 minutes to configure the capsule.

4. Register an Existing Client to a Red Hat Satellite Server

# yum -y localinstall \
  http://satellite.hl.local/pub/katello-ca-consumer-latest.noarch.rpm
# subscription-manager clean
# subscription-manager register --org=Default_Organization
# yum -y install katello-agent

Once a client has been registered to Satellite server, the web UI can be used to modify the client's configuration.

5. Build a Custom RPM from a Source Tarball

The source code must be in the form of a compressed archive before starting the RPM build process!

In order to package an RPM, you need to:

  1. Download the source code.
  2. Create the spec file (use the rpmdev-newspec command).
  3. Build the package (use the rpmbuild command).
  4. GPG sign the package (use the rpmsign command).
  5. Test the package (use rpm -qip command).

RPM packaging Process

$ sudo yum install rpmdevtools rpm-build rpm-sign rpmlint gcc rng-tools

$ wget http://katello.hl.local/homelab-1.0.tar.gz
$ tar xf homelab-1.0.tar.gz
$ less homelab/README
$ less homelab/Makefile

$ rpmdev-setuptree
$ cp homelab-1.0.tar.gz rpmbuild/SOURCES/
$ cd rpmbuild/SPECS
$ rpmdev-newspec homelab
$ vim homelab.spec
$ rpmlint homelab.spec
$ rpmbuild -ba homelab.spec

Create GNU Privacy Guard (GPG) Keys to Sign RPMs

$ sudo rngd -r /dev/urandom
$ gpg --gen-key
$ gpg --fingerprint

$ echo '%_gpg_name <your_gpg_fingerprint>' >> ~/.rpmmacros
$ rpmsign --addsign ~/rpmbuild/RPMS/x86_64/homelab-1.0-1.el7.x86_64.rpm
$ rpm -qip ~/rpmbuild/RPMS/x86_64/homelab-1.0-1.el7.x86_64.rpm

$ sudo yum localinstall -y --nogpgcheck \
  ~/rpmbuild/RPMS/x86_64/homelab-1.0-1.el7.x86_64.rpm

6. Create and Configure Organizations and Locations

# hammer organization create --name Lisenet
# hammer location create --name HomeLab

7. Create and Configure Red Hat Satellite Users and Roles

# hammer user create \
  --login alice \
  --firstname Alice \
  --lastname Abernathy \
  --mail "alice@hl.local" \
  --organizations Lisenet \
  --locations HomeLab \
  --roles Manager \
  --password changeMe \
  --auth-source-id 1

8. Create and Configure Development Life Cycles

# hammer lifecycle-environment create \
  --organization Lisenet \
  --name dev \
  --prior Library

# hammer lifecycle-environment create \
  --organization Lisenet \
  --name qa \
  --prior dev

# hammer lifecycle-environment create \
  --organization Lisenet \
  --name prod \
  --prior qa

9. Create a Puppet Product Repository

# hammer product create \
  --organization Lisenet \
  --name puppet_stuff \
  --description "Puppet modules"

# hammer repository create \
  --organization Lisenet \
  --name puppet_repo \
  --content-type puppet \
  --product puppet_stuff

# hammer repository upload-content \
  --organization Lisenet \
  --name puppet_repo \
  --product puppet_stuff \
  --path /root/lisenet-lisenet_firewall-1.0.0.tar.gz

10. Configure Red Hat Satellite Subscriptions, Content and Content Views

# hammer content-view create \
  --name puppet_modules \
  --description "Content view for Puppet modules"

# hammer content-view puppet-module add \
  --content-view puppet_modules \
  --name lisenet_firewall

# hammer content-view publish \
  --name puppet_modules \
  --description "Publishing Puppet modules"

# hammer content-view version promote \
  --content-view puppet_modules \
  --version 1.0 \
  --to-lifecycle-environment dev

11.Create a Red Hat Satellite Activation Key

# hammer activation-key create \
  --name el7-key \
  --description "Key to use with EL7" \
  --lifecycle-environment dev \
  --content-view puppet_modules \
  --unlimited-hosts

# hammer activation-key add-subscription \
  --name el7-key \
  --quantity 1 \
  --subscription-id 1

12. Create a Red Hat Satellite Host Group

# hammer hostgroup create \
  --query-organization Lisenet \
  --locations HomeLab \
  --name el7_group \
  --description "Host group for EL7 servers" \
  --lifecycle-environment dev

# hammer hostgroup set-parameter  \
  --name kt_activation_keys \
  --value el7-key \
  --hostgroup el7_group

13. Define Smart Class Parameters for a Puppet Module

Configure lisenet_firewall Smart Class Parameter

14. Apply Errata to Client

Satellite WebUI > Content > Errata

Pick requried errata > Apply Errata > Apply to Content Hosts > Next

15. Configure Bare-metal Deployment on Red Hat Satellite

We may need to implement a workaround so that the PXE configuration for booting off of the local disk would not be misinterpreted by the new host. In order to configure boot from first hard drive, we need to remove the LOCALBOOT 0 entry and replace it with the following:

  COM32 chain.c32
  APPEND hd0

chain.c32 is a COM32 module for Syslinux. It can chainload MBRs, partition boot sectors, Windows bootloaders etc.

If the workaround is not applied, the server will still be provisioned, but might fail to boot off of the local disk.

16. Deploy Clients Using Kick Starts

# hammer template list
# hammer template kinds

# hammer template dump \
  --id "Katello Kickstart Default" > custom_template.txt

Edit the template as required.

# hammer template create \
  --organizations Lisenet \
  --locations HomeLab \
  --file custom_template.txt \
  --name "Katello Kickstart Default Custom" \
  --type provision \
  --operatingsystems "CentOS 7.4.1708"

# hammer host create \
  --name proxy1 \
  --hostgroup el7_group \
  --interface "type=interface,mac=00:22:ff:00:00:19,ip=10.11.1.19,managed=true,primary=true,provision=true"

17. Timeframes for Creating Various Things in the Lab

  • 10 min to install Satellite packages from DVD.
  • 15-20 min to install the Satellite server.
  • 5 min to install and configure the capsule server.
  • 20-40 min to synchronise RPM repositories (depending on their size).
  • 10-20 min for RHEL 7 DVD sync from repo discovery.
  • 5 min to publish content views.
  • 3-5 min to promote content views to lifecycle environments.
  • 10-15 min to kickstart provision a RHEL 7 server using PXE boot.

This should help manage expectations during the exam.