Smart Proxy - Omaha
This plug-in adds support for the Omaha Procotol to Foreman's Smart Proxy. It is used when updating CoreOS clusters. The Smart Proxy Omaha plugin acts as a mirror for Omaha releases and sends reports to Foreman about the update activity of the managed hosts. It needs the Foreman Omaha plugin installed to work properly.
How it works
The operatingsystem packages install a cronjob, that runs the binary
smart-proxy-omaha-sync nightly to sync omaha content from the upstream mirror servers.
Your CoreOS hosts can then be configured to update against the smart proxy. The proxy then uploads facts and reports to Foreman.
Omaha content is served directly from the proxy.
|Foreman Proxy Version||Plugin Version|
To be able to use Foreman for your Omaha updates, you need to install the Foreman Omaha plugin, install this smart-proxy plugin and configure your CoreOS hosts.
For the Smart Proxy plugin, follow the smart-proxy plugin installation instructions. You usually just need to install the
rubygem-smart_proxy_omaha package and restart the
For the initial sync of releases you need to run the binary
Do not forget to register the smart proxy in Foreman via the user interface.
You need to configure your CoreOS hosts to connect to the Omaha smart-proxy for updates. You can either configure your servers manually or use cloud-config.
If your smart-proxy uses a self-signed ssl certificate, you have to add the CA certificate to the CoreOS truststore. By default, the smart-proxys uses a PuppetCA certificate. To print the PuppetCA certificate, issue
cat $(puppet config print localcacert) on any puppet enabled node.
Using Config File
To add a custom CA certificate to CoreOS's truststore:
vim /etc/ssl/certs/customCA_root.pem sudo /usr/sbin/update-ca-certificates
To configure CoreOS to connect to the Omaha smart-proxy for updates, edit
to configure Flatcar to connect to the Omaha smart-proxy for updates, edit
Restart update engine:
sudo systemctl restart update-engine
Configure CoreOS to connect to the Omaha smart-proxy for updates:
#cloud-config coreos: update: group: "stable" server: "https://omahaproxy.example.com:8443/omaha/v1/update"
Add a custom CA certificate to CoreOS's truststore:
#cloud-config write-files: - path: /etc/ssl/certs/customCA_root.pem permissions: 0644 content: | -----BEGIN CERTIFICATE----- YOUR-BASE64-ENCODED-CERTIFICATE -----END CERTIFICATE----- units: - name: update-ca-certificates.service command: start content: | [Unit] Description=Force Update CA bundle at /etc/ssl/certs/ca-certificates.crt # Since other services depend on the certificate store run this early DefaultDependencies=no Wants=systemd-tmpfiles-setup.service clean-ca-certificates.service After=systemd-tmpfiles-setup.service clean-ca-certificates.service Before=sysinit.target ConditionPathIsReadWrite=/etc/ssl/certs [Service] Type=oneshot ExecStart=/usr/sbin/update-ca-certificates
All three default release channels (alpha, beta, stable) are supported. You cannot define custom channels right now.
To test if a client can successfully check for updates, these commands may help:
$ update_engine_client -check_for_update $ journalctl -u update-engine.service
In the settings file you can specify a http proxy that is used to download Omaha content. You need to allow https access to these servers:
Make it High Available
In order to make the Omaha Smart Proxy high available or add additional capacity, just scale out and put a loadbalancer in front of the proxies.
Copyright (c) 2016 The Foreman developers
This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License along with this program. If not, see http://www.gnu.org/licenses/.