ForemanQuickNotes - henk52/knowledgesharing GitHub Wiki

Insights

Table of Contents

Satellite

Tools in Satellite

foreman

Katello

Opensource path

foreman log files

  • /var/log/foreman/production.log

installing open foreman

Prep an LXC

  1. sudo lxc-create -t centos -n base_centos7 — --release 7

  2. sudo lxc-copy --name base_centos7 --newname foreman

  3. sudo lxc-start -n foreman

  4. sudo lxc-attach -n foreman

Prepare a VM

  1. create VM

  2. Install from CentOS minimal

  3. login

  4. cd /etc/yum.repos.d

  5. mkdir Disabled

  6. mv *.repo Disabled

  7. scp root@dm:/var/ks/mirrors/centOS.repo .

  8. scp root@dm:/var/ks/mirrors/epel.repo .

  9. scp root@dm:/var/ks/mirrors/foreman.repo .

  10. scp dm:/var/ks/extrarepos/foreman_puppet5/foreman_puppet.repo .

  11. yum -y install foreman-installer

  12. hostnamectl --static set-hostname foreman.mylab

  13. vi /etc/hosts (add foreman.mylab)

Install foreman

  1. Ensure the repos are propperly set: centOS.repo epel.repo foreman_puppet.repo foreman.repo

  2. Edit /etc/bashrc

    • PATH=${PATH}:/opt/puppetlabs/puppet/bin

  3. bash

  4. Install foreman: https://theforeman.org/manuals/1.16/index.html#2.Quickstart

    • foreman-installer --enable-foreman --enable-foreman-cli --enable-foreman-cli-openscap --enable-foreman-compute-vmware --enable-foreman-plugin-bootdisk --enable-foreman-plugin-cockpit --enable-foreman-plugin-default-hostgroup --enable-foreman-plugin-dhcp-browser --enable-foreman-plugin-discovery --enable-foreman-plugin-docker --enable-foreman-plugin-hooks --enable-foreman-plugin-openscap --enable-foreman-plugin-remote-execution --enable-foreman-plugin-tasks --enable-puppet --foreman-configure-epel-repo=false

    • foreman-installer --foreman-configure-epel-repo=false --foreman-proxy-tftp=true --foreman-proxy-tftp-managed=true --foreman-proxy-tftp-servername=10.1.2.3

    • foreman-installer --foreman-proxy-dhcp=true --foreman-proxy-dhcp-interface=eth1

    • foreman-installer --foreman-proxy-dns=true --foreman-proxy-dns-interface=ens160 --foreman-proxy-dns-zone=home --foreman-proxy-dns-reverse=1.168.192.in-addr.arpa --foreman-proxy-dns-forwarders=8.8.8.8 --foreman-proxy-dns-managed=true

    • --foreman-proxy-dns-forwarders : I think this is add nameservers (you can add this option multiple times)

    • --foreman-proxy-dns-managed=true : I think, when this is true, then something is managed through puppet?

    • foreman-installer --enable-foreman-plugin-remote-execution --enable-foreman-proxy-plugin-remote-execution-ssh --foreman-configure-epel-repo=false

    • https://www.theforeman.org/plugins/foreman_remote_execution/1.3/index.html

  5. open firewall: https://www.itzgeek.com/how-tos/linux/ubuntu-how-tos/install-foreman-on-centos-7-rhel-7-ubuntu-14-04-3.html 

    firewall-cmd --permanent --add-port=53/tcp
firewall-cmd --permanent --add-port=53/udp
firewall-cmd --permanent --add-port=67-69/udp
firewall-cmd --permanent --add-port=80/tcp
firewall-cmd --permanent --add-port=443/tcp
firewall-cmd --permanent --add-port=3000/tcp
firewall-cmd --permanent --add-port=3306/tcp
firewall-cmd --permanent --add-port=5910-5930/tcp
firewall-cmd --permanent --add-port=5432/tcp
firewall-cmd --permanent --add-port=8140/tcp
firewall-cmd --permanent --add-port=8443/tcp
firewall-cmd --reload

    • Port 53: DNS

Plugins

Retrying: * sudo lxc-stop -n foreman * sudo lxc-destroy -n foreman

OpenSCAP

  • https://theforeman.org/plugins/foreman_openscap/0.8/index.html *

    1. foreman-installer --enable-foreman-plugin-openscap --enable-foreman-proxy-plugin-openscap

    2. puppet module install theforeman-foreman_scap_client

    3. foreman-rake foreman_openscap:bulk_upload:default

    4. foreman-installer --enable-foreman-plugin-remote-execution

Issues:

DEBUG: running: oscap xccdf eval --results-arf /tmp/d20180111-12393-1nmncgw/results.xml /var/lib/openscap/content/3e1654fd14a5352d65294db555710bfda5cad1a942209e2d787ea7940035616e.xml
   2: WARNING: This content points out to the remote resources. Use `--fetch-remote-resources' option to download them.
   3: WARNING: Skipping https://www.redhat.com/security/data/oval/com.redhat.rhsa-RHEL7.xml.bz2 file which is referenced from XCCDF content
   4: DEBUG: running: /usr/bin/bzip2 /tmp/d20180111-12393-1nmncgw/results.xml
   5: Uploading results to https://foreman.ea.mot-solutions.com:8443/compliance/arf/2
   6: Exit status: 0

cookbook todo for foreman

  • pxe boot

  • register existing machine

  • openscap usage

  • doing openscap on isolated network

Foreman cookbook set-up

Make an OS ready for deployment

  1. Register the install media

  2. Hosts→Installation Media

  3. Click Create Medium

  4. click Submit

  5. Create operating System

  6. Click 'Create Operating System'

  7. Fill out 'Operating System' tab

  8. Fill out 'Partition Table' tab

    • 'Kickstart default'

  9. Fill out 'Installation Media' tab

  10. Fill out 'Templates' tab

    • PXE: 'Kickstart default PXELinux'

    • Finish: 'Kickstart default finish'

    • Provisioning: 'Kickstart default'

  11. Assign templates

  12. Hosts → provisioning templates

  13. click on each template you need.

  14. Click the 'Association' tab

  15. Click the applicable Operating System.

  16. Click submit

  17. Create operating System

    • assign the templates

Create an operating system

  1. Provisioning templates

    • Kickstart default

    • Association tab

    • Centos

    • Submit

  2. Povisioning Templastes

    • PXELinux default local boot

  3. Operating system

    • Template

    • Kickstart default

    • PXELinux template

    • Submit

Create the subnets

  1. Infreastructure→subnets

  2. click 'Create Subnet'

    • subnet tab

    • Network Address: The IP addr of the machine on the NIC.

    • Remote Execution

    • move the 'foreman' proxy to selected.

    • Domains

    • Move the domain to selected.

    • Proxies tab

    • TFTP Proxy: the foreman.

Add machine for pxe-boot

  • Require the Operation system to be configured

  • Click on the Operating system you want to configure

  • Partition table: Kickstart default

  • Installation Media: CentOS mirror

  • Submit

  • Requires a HostGroup exists

  • Configure → Host Groups

    1. Hosts → Create host

  • Host

  • Name:

  • Host Group

  • 'Operating system'

  • Root Pass:

  • Click 'Resolve' to ensure all three templates are there.

Troubleshooting registering existing hosts

Warning: Unable to fetch my node definition, but the agent run will continue:

Warning: Unable to fetch my node definition, but the agent run will continue:
Warning: Error 500 on SERVER: {"message":"Server Error: Failed to find ghostrider via exec: Execution of '/etc/puppetlabs/puppet/node.rb ghostrider' returned 1: ","issue_kind":"RUNTIME_ERROR"}

Installing a client machine under foreman

Installing Fedora via local media

  1. cp Fedora-Workstation-Live-x86_64-27-1.6.iso to / of foreman

  2. mkdir -p /var/ks/images

  3. vi 25-localmedia.conf

  4. systemctl restart httpd

  5. mount -o loop /Fedora-Workstation-Live-x86_64-27-1.6.iso /mnt

  6. mkdir /var/ks/images/fedora27

  7. time cp -apv /mnt/* /var/ks/images/fedora27

  8. umount /mnt

  9. On foreman

  10. hosts → Installation Media

  11. Create media

  12. hosts → Provisioning Templates

  13. Find 'Kickstart default PXELinux' and edit it

    • Associate: Kickstart default PXELinux

  14. hosts → Operating Systems

  15. Create Operating system

    • /var/lib/tftpboot/boot

Issues:

  • No PXELinux templates were found for this host, make sure you define at least one in your Fedora 27.0 settings or change PXE loader

  • Seems like the Kickstart default PXELinux has to be associated with the OS and the OS config then has to select it.

  • Files in /var/lib/tftpboot/boot are empty

  • cp /var/ks/images/fedora27/images/pxeboot/vmlinuz /var/lib/tftpboot/boot/Fedora-27-x86_64-vmlinuz

  • cp /var/ks/images/fedora27/images/pxeboot/initrd.img /var/lib/tftpboot/boot/Fedora-27-x86_64-initrd.img

  • Failed to start Switch Root

  • Specified switch root path '/sysroot' does not seem to be an OS tree. os-release file is missing.

SpaceWalk

It seems like it can’t even install on Fedora22.

Anyway dnsmasq: host-addr=MACADDR,NAME,IP ensures that the propper name is assigned to the machine, along with the IP address.

  1. rpm -Uvh http://yum.spacewalkproject.org/2.4/Fedora/22/x86_64/spacewalk-repo-2.4-3.fc22.noarch.rpm

  2. vi /etc/yum.repos.d/spacewalk.repo .* Change the '$releaseversion' to '22' for F23.

  3. yum clean all

  4. yum install spacewalk-postgresql .* Maybe the above include this: # yum install spacewalk-setup-postgresql

  5. spacewalk-setup --disconnected --answer-file=<FILENAME> .* spacewalk-setup --disconnected .** Should the spacewalk-setup fail, check the error it gives you and also investigate the logs in /var/log/rhn, as well as the logs from your database server, Apache server and tomcat.

  6. /usr/sbin/spacewalk-service [stop|start|restart].

admin-email = root@localhost
ssl-set-org = Spacewalk Org
ssl-set-org-unit = spacewalk
ssl-set-city = My City
ssl-set-state = My State
ssl-set-country = US
ssl-password = spacewalk
ssl-set-email = root@localhost
ssl-config-sslvhost = Y
db-backend=postgresql
db-name=spaceschema
db-user=spaceuser
db-password=spacepw
db-host=localhost
db-port=5432
enable-tftp=Y

Puppet related

Import Puppet class

  1. cd /etc/puppetlabs/code/modules/jenkinsnode

Foreman parameters to puppet classes

  1. Configure → Classes

  2. Select the Puppet class you want to configure the parameters for

  3. Click the 'Smart Class Parameter' tab

  4. Click the Parameter you want to affect

  5. Make sure to check-mark the 'Override' box. Otherwise Foreman will not pass anything to Puppet via the ENC. # Troubleshooting

Foreman

PXE boot

No PXELinux templates were found for this host, make sure you define at least one in your

No PXELinux templates were found for this host, make sure you define at least one in your Fedora 27 settings or change PXE loader

In the Edit Operating System, under the 'Templates' tab you need to select a pxelinug template.

Create DHCP Settings for XXX task failed with the following error: ERF12-6899 [ProxyAPI::ProxyException]: Unable to set DHCP entry ([RestClient::Conflict]: 409 Conflict) for proxy https://foreman.mynet:8443/dhcp

Remove the offending entry from /var/lib/dhcpd/dhcpd.leases

DO NOT delete the file, you will be sorry…​.

Create DHCP Settings for XXX task failed with the following error: ERF12-6899 [ProxyAPI::ProxyException]: Unable to set DHCP entry ([RestClient::Conflict]: 409 Conflict) for proxy https://foreman.mynet:8443/dhcp

Troubleshooting registration of existing machines

Exiting; no certificate found and waitforcert is disabled

Info: Creating a new SSL key for `hostname`
Info: Caching certificate for ca
Info: csr_attributes file loading from /etc/puppet/csr_attributes.yaml
Info: Creating a new SSL certificate request for `hostname`
Info: Certificate Request fingerprint (SHA256):  LONG_KEY
Info: Caching certificate for ca
Exiting; no certificate found and waitforcert is disabled

Error: Could not request certificate: SSL_connect returned=1 errno=0 state=error: certificate verify failed: [CRL is not yet valid for /CN=Puppet CA: FOREMAN]

  1. on the master/ca server you need to run: puppet cert clean MY_NODE

  2. on the client: rm -rf /etc/puppetlabs/puppet/ssl/*

  3. then on the client: puppet agent --server servername --waitforcert 60

  4. if you dont have autosign enabled then on the server run puppet cert sign certname..

/opt/puppetlabs/puppet/bin/puppet agent --test
Info: Caching certificate for MY_NODE
Info: Caching certificate_revocation_list for ca
Error: Could not request certificate: SSL_connect returned=1 errno=0 state=error: certificate verify failed: [CRL is not yet valid for /CN=Puppet CA: FOREMAN]
Exiting; failed to retrieve certificate and waitforcert is disabled

CRL is not yet valid for /CN=Puppet

Get the timestamp in sync

 /opt/puppetlabs/puppet/bin/puppet agent  --test
Warning: Unable to fetch my node definition, but the agent run will continue:
Warning: SSL_connect returned=1 errno=0 state=error: certificate verify failed: [CRL is not yet valid for /CN=Puppet CA: foreman]
Info: Retrieving pluginfacts
Error: /File[/opt/puppetlabs/puppet/cache/facts.d]: Failed to generate additional resources using 'eval_generate': SSL_connect returned=1 errno=0 state=error: certificate verify failed: [CRL is not yet valid for /CN=Puppet CA: foreman]
Error: /File[/opt/puppetlabs/puppet/cache/facts.d]: Could not evaluate: Could not retrieve file metadata for puppet:///pluginfacts: SSL_connect returned=1 errno=0 state=error: certificate verify failed: [CRL is not yet valid for /CN=Puppet CA: foreman]
Info: Retrieving plugin
Error: /File[/opt/puppetlabs/puppet/cache/lib]: Failed to generate additional resources using 'eval_generate': SSL_connect returned=1 errno=0 state=error: certificate verify failed: [CRL is not yet valid for /CN=Puppet CA: foreman]
Error: /File[/opt/puppetlabs/puppet/cache/lib]: Could not evaluate: Could not retrieve file metadata for puppet:///plugins: SSL_connect returned=1 errno=0 state=error: certificate verify failed: [CRL is not yet valid for /CN=Puppet CA: foreman]
Error: Could not retrieve catalog from remote server: SSL_connect returned=1 errno=0 state=error: certificate verify failed: [CRL is not yet valid for /CN=Puppet CA: foreman]
Warning: Not using cache on failed catalog
Error: Could not retrieve catalog; skipping run
Error: Could not send report: SSL_connect returned=1 errno=0 state=error: certificate verify failed: [CRL is not yet valid for /CN=Puppet CA: foreman]

No PXELinux templates were found for this host, make sure you define at least one in your RedHat 7.5 settings or change PXE loader

You need to assing both a 'Provisioning template' and a 'PXELinux template'

Add a custom footer
⚠️ **GitHub.com Fallback** ⚠️