Red Hat Satellite 6 is a nice tool for system life cycle management. It can get complex and even installation is sometimes tricky. This article is about how to install Satellite, it does not explain the principals and concepts behind it.
Requirements
A valid subscription for the Satellite (and optional for the capsule).
The system requirements are listed here.
There is one important thing the install guide is missing: Satellite 6.4 will not work in IPv6 only environments. There must be an IPv4 address configured, even if it is just an RFC1918 private address. You need to add this IP in /etc/hosts. The reason is that several daemons are listening on IPv4 addresses only. One of them is important: Apache QPID which is used for i.e. errata application via katello-agent. But there are two [update] undocumented installer parameters [/update].
Proxy is mandatory in IPv6 only environments
If your Satellite is only able to connect to the internet via IPv6, you need an IPv4 capable proxy to talk to subscription.rhsm.redhat.com which is not reachable by IPv6. That is the host the subscription manager is talking to.
Install EPEL and certbot
It makes sense to use officially valid certs since they are available for free usage from Letsencrypt. Certbot is available from EPEL and a handy way to request certificates using the ACME protocol.
[root@sat6 ~]# yum -y install http://ftp.tu-chemnitz.de/pub/linux/epel/7Server/x86_64/Packages/e/epel-release-7-14.noarch.rpm
It is important to disable EPEL by default to not get conflicts with RPMs from other repositories. Just enable EPEL when needed and double-check.
[root@sat6 ~]# yum-config-manager --disable epel
Install the certbot package
[root@sat6 ~]# yum -y install certbot --enablerepo=epel
Issue the cert
[root@sat6 ~]# certbot certonly -n --standalone --agree-tos --domains sat6.example.com -m user@example.com
Download the CA-Certs
Root-CA
[root@sat6 ~]# wget https://letsencrypt.org/certs/isrgrootx1.pem
Intermediate CA-Cert
[root@sat6 ~]# wget https://letsencrypt.org/certs/lets-encrypt-r3.pem
Create the CA bundle file
[root@sat6 ~]# cp isrgrootx1.pem bundle-ca-cert.pem [root@sat6 ~]# cat lets-encrypt-r3.pem >> bundle-ca-cert.pem
Check the certificate
You can check if you made all things as expected, run the check command.
[root@sat6 ~]# katello-certs-check -c "/etc/letsencrypt/live/sat6.example.com/fullchain.pem" -k "/etc/letsencrypt/live/sat6.example.com/privkey.pem" -b "/root/bundle-ca-cert.pem"
Running the installer
Note: The parameters –foreman-proxy-content-qpid-router-hub-addr :: –foreman-proxy-content-qpid-router-agent-addr :: are not documented and only needed if you want to be able that the capsule and/or clients will be able to communicate over IPv6.
[root@sat6 ~]# satellite-installer --scenario satellite --certs-server-cert "/etc/letsencrypt/live/sat6.example.com/fullchain.pem" --certs-server-key "/etc/letsencrypt/live/sat6.example.com/privkey.pem" --certs-server-ca-cert "/root/bundle-ca-cert.pem" --certs-update-server --certs-update-server-ca
Installing a Capsule Server
If you want to use a capsule server within an environment with Letsencrypt certificates, its a bit more complex, but however, it works.
Install the software
Needless to say that your capsule needs to have the correct repos enabled. For details, please see here.
[root@capsule ~]# yum install satellite-capsule
Request the Certificate
On the Satellite, request a certificate for the capsule. Note: This only works with the DNS challenge, so you need access to your DNS server.
[root@sat6 ~]# certbot -d capsule.example.com --manual --preferred-challenges dns certonly
Prepare the certificates and key
Create a directory and copy the certificates
[root@sat6 ~]# mkdir /root/capsule.example.com [root@sat6 ~]# cp /etc/letsencrypt/live/capsule.example.com/privkey.pem capsule.example.com [root@sat6 ~]# cp /etc/letsencrypt/live/capsule.example.com/fullchain.pem capsule.example.com [root@sat6 ~]# cp /root/bundle-ca-cert.pem capsule.example.com
Validate the certificate
[root@sat6 ~]# katello-certs-check -c /root/capsule.example.com/fullchain.pem -b /root/capsule.example.com/bundle-ca-cert.pem -k /root/capsule.example.com/privkey.pem
If all is fine, run the capsule generator:
[root@sat6 ~]# capsule-certs-generate --foreman-proxy-fqdn capsule.example.com --certs-tar /root/capsule.example.com-certs.tar --server-cert /root/capsule.example.com/fullchain.pem --server-key /root/capsule.example.com/privkey.pem --server-ca-cert /root/capsule.example.com/bundle-ca-cert.pem
Copy the resulting tarball to the capsule server:
[root@sat6 ~]# scp capsule.example.com-certs.tar capsule.example.com
Running the installer
[root@capsule ~]# satellite-installer --scenario capsule\ --foreman-proxy-content-parent-fqdn "sat6.example.com"\ --foreman-proxy-register-in-foreman "true"\ --foreman-proxy-foreman-base-url "https://sat6.example.com"\ --foreman-proxy-trusted-hosts "sat6.example.com"\ --foreman-proxy-trusted-hosts "capsule.example.com"\ --foreman-proxy-oauth-consumer-key "the key"\ --foreman-proxy-oauth-consumer-secret "the secret"\ --foreman-proxy-content-certs-tar "/root/capsule.example.com-certs.tar"\ --puppet-server-foreman-url "https://sat6.example.com" \ --foreman-proxy-content-qpid-router-hub-addr :: \ --foreman-proxy-content-qpid-router-agent-addr ::
That’s it 🙂
Do not ask me how certificate renewal works, I’ll let you know in three months 😉
Workaround for IPv6-only Networks
Unfortunately the satellite-installer configures Apache QPID not correctly, it will be set up to use IPv4 only by default. That means, IPv6-only hosts (i.e. including the capsule) are unable to communicate with the Satellite.
There is a workaround: Add two additional listeners on the Satellite and one on the Capsule. Be aware: The Satellite installer overwrites your changes every time when you run it, i.e. for upgrades or adding new features. create a backup of the config file.
There are two undocumented parameters for the satellite installer: –foreman-proxy-content-qpid-router-hub-addr :: and –foreman-proxy-content-qpid-router-agent-addr ::. You can add them during first time run as well as after an initial installation.
It is the same procedure in the Satellite as well as on the Capsule.
satellite-installer --foreman-proxy-content-qpid-router-hub-addr :: --foreman-proxy-content-qpid-router-agent-addr ::
This behavior is already fixes upstream as you can see it here: https://github.com/theforeman/puppet-foreman_proxy_content/commit/89b4ea988d18f100b806e7cddc2dca623b68f084″.