1. Introduction
Provisioning is a process that starts with a bare physical or virtual machine and ends with a fully configured, ready-to-use operating system. Using Foreman, you can define and automate fine-grained provisioning for a large number of hosts.
There are many provisioning methods. For example, you can use Foreman server’s integrated Smart Proxy or an external Smart Proxy server to provision bare metal hosts using both PXE based and non-PXE based methods. You can also provision cloud instances from specific providers through their APIs. These provisioning methods are part of the Foreman application life cycle to create, manage, and update hosts.
1.1. Provisioning Types Overview
Foreman has different methods for provisioning hosts:
- Bare Metal Provisioning
-
Foreman provisions bare metal hosts primarily through PXE boot and MAC address identification. You can create host entries and specify the MAC address of the physical host to provision. You can also boot blank hosts to use Foreman’s discovery service, which creates a pool of ready-to-provision hosts. You can also boot and provision hosts through PXE-less methods.
- Cloud Providers
-
Foreman connects to private and public cloud providers to provision instances of hosts from images that are stored with the Cloud environment. This also includes selecting which hardware profile or flavor to use.
- Virtualization Infrastructure
-
Foreman connects to virtualization infrastructure services such as oVirt and VMware to provision virtual machines from virtual image templates or using the same PXE-based boot methods as bare metal providers.
1.2. Provisioning Workflow Overview
The provisioning process follows a basic PXE workflow:
-
You create a host and select a domain and subnet. Foreman requests an available IP address from the DHCP Smart Proxy server that is associated with the subnet or from the PostgreSQL database in Satellite. Foreman loads this IP address into the IP address field in the Create Host window. When you complete all the options for the new host, submit the new host request.
-
Depending on the configuration specifications of the host and its domain and subnet, Foreman creates the following settings:
-
A DHCP record on the Smart Proxy server that is associated with the subnet.
-
A forward DNS record on the Smart Proxy server that is associated with the domain.
-
A reverse DNS record on the DNS Smart Proxy server that is associated with the subnet.
-
PXELinux, Grub, Grub2, and iPXE configuration files for the host in the TFTP Smart Proxy server that is associated with the subnet.
-
A Puppet certificate on the associated Puppet server.
-
A realm on the associated identity server.
-
-
The new host requests a DHCP reservation from the DHCP server.
-
The DHCP server responds to the reservation request and returns TFTP
next-server
andfilename
options. -
The host requests the boot loader and menu from the TFTP server according to the PXELoader setting.
-
A boot loader is returned over TFTP.
-
The boot loader fetches configuration for the host through its provisioning interface MAC address.
-
The boot loader fetches the operating system installer kernel, init RAM disk, and boot parameters.
-
The installer requests the provisioning template from Foreman.
-
Foreman renders the provision template and returns the result to the host.
-
The installer performs installation of the operating system.
-
When Katello plugin is installed, the installer registers the host to Foreman using Red Hat Subscription Manager.
-
When Katello plugin is installed, management tools such as
katello-agent
andpuppet
are installed. -
The installer notifies Foreman of a successful build in the
postinstall
script.
-
-
The PXE configuration files revert to a local boot template.
-
The host reboots.
-
The new host requests a DHCP reservation from the DHCP server.
-
The DHCP server responds to the reservation request and returns TFTP
next-server
andfilename
options. -
The host requests the bootloader and menu from the TFTP server according to the PXELoader setting.
-
A boot loader is returned over TFTP.
-
The boot loader fetches the configuration for the host through its provision interface MAC address.
-
The boot loader initiates boot from the local drive.
-
If you configured the host to use any Puppet classes, the host configures itself using the modules.
This workflow differs depending on custom options. For example:
- Discovery
-
If you use the discovery service, Foreman automatically detects the MAC address of the new host and restarts the host after you submit a request. Note that TCP port 8443 must be reachable by the Smart Proxy to which the host is attached for Foreman to restart the host.
- PXE-less Provisioning
-
After you submit a new host request, you must boot the specific host with the boot disk that you download from Foreman and transfer using a USB port of the host.
- Compute Resources
-
Foreman creates the virtual machine and retrieves the MAC address and stores the MAC address in Foreman. If you use image-based provisioning, the host does not follow the standard PXE boot and operating system installation. The compute resource creates a copy of the image for the host to use. Depending on image settings in Foreman, seed data can be passed in for initial configuration, for example using
cloud-init
. Foreman can connect using SSH to the host and execute a template to finish the customization.
2. Configuring Provisioning Contexts
Before you provision hosts using Foreman, you must understand the placement strategy for hosts in Foreman. This is known as the provisioning context.
2.1. Provisioning Context Overview
A provisioning context is the combination of an organization and location that you specify for Foreman components. The organization and location that a component belongs to sets the ownership and access for that component.
Organizations divide Foreman components into logical groups based on ownership, purpose, content, security level, and other divisions. You can create and manage multiple organizations through Foreman and assign components to each individual organization. This ensures the Foreman server provisions hosts within a certain organization and only uses components that are assigned to that organization. For more information about organizations, see Managing Organizations in the Content Management Guide.
Locations function similar to organizations. The difference is that locations are based on physical or geographical setting. Users can nest locations in a hierarchy.
For more information about locations, see Managing Locations in the Content Management Guide.
2.2. Setting the Provisioning Context
When you set a context, you define which organization and location to use for provisioning hosts.
The organization and location menus are located in the menu bar, on the upper left of the Foreman web UI. If you have not selected an organization and location to use, the menu displays: Any Organization and Any Location.
-
To set the provisioning context, click the Any Organization and Any Location buttons and select the organization and location to use.
Each user can set their default provisioning context in their account settings. Click the user name in the upper right of the Foreman web UI and select My account to edit your user account settings.
While using the CLI, include either --organization
or --organization-label
and --location
or --location-id
as an option. For example:
# hammer host list --organization "Default_Organization" --location "Default_Location"
This command outputs hosts allocated for the Default_Organization and Default_Location.
3. Configuring Provisioning Resources
Foreman contains provisioning resources that you must set up and configure to create a host. These include:
- Provisioning template
-
While you can create static provisioning templates, for example Kickstart templates, Foreman has many provisioning templates in ERB (Embedded Ruby) syntax that you can use to modularize parameters in each host or host group. For example, the timezone setting in a kickstart template can differ depending on the given host parameter. Depending on a provisioning workflow, you can set various combinations.
- Partition table
-
A Partition table is a type of template used only for rendering the disk volume definition part of kickstart. A Partition table uses the same ERB syntax as provisioning templates. You can use a Partition table to define multiple disk layouts and select them for each host or host group depending on the system purpose.
- Installation media
-
Installation media represents a parametrized URL to a remote repository with OS packages, for example
yum
orapt
. When you install the Katello plugin, you can download packages from a Pulp mirror. In this case, installation media is ignored. - Subscriptions and Repositories
-
To consume Red Hat content, you must upload subscriptions to Foreman. You must create a Product for the subscription. You must enable and synchronize one or more installation repositories in the initial lifecycle environment Library. Optionally, content can be filtered and promoted to other Lifecycle Environments or Content Views. Subscriptions and repositories are provided by the Katello plugin.
3.1. Creating Operating Systems
An operating system is a collection of resources that define how Foreman server installs a base operating system on a host. Operating system entries combine previously defined resources, such as installation media, partition tables, provisioning templates, and others.
Importing operating systems from Red Hat’s CDN creates new entries on the Hosts > Operating Systems page. Importing operating systems from Red Hat’s CDN is only possible when Katello is installed.
You can also add custom operating systems using the following procedure:
-
In the Foreman web UI, navigate to Hosts > Operating systems and click New Operating system.
-
In the Name field, enter a name to represent the operating system entry.
-
In the Major field, enter the number that corresponds to the major version of the operating system.
-
In the Minor field, enter the number that corresponds to the minor version of the operating system.
-
In the Description field, enter a description of the operating system.
-
From the Family list, select the operating system’s family.
-
From the Root Password Hash list, select the encoding method for the root password.
-
From the Architectures list, select the architectures that the operating system uses.
-
Click the Partition table tab and select the possible partition tables that apply to this operating system.
-
Click the Installation Media tab and enter the information for the installation media source. For more information, see or more information, see Using Third Party Installation Media.
-
Click the Templates tab and select a PXELinux template, a Provisioning template, and a Finish template for your operating system to use. You can select other templates, for example an iPXE template, if you plan to use iPXE for provisioning.
-
Click Submit to save your provisioning template.
Create the operating system using the hammer os create
command:
# hammer os create --name "MyOS" \ --description "My_custom_operating_system" \ --major 7 --minor 3 --family "Redhat" --architectures "x86_64" \ --partition-tables "My_Partition" --media "Red_Hat" \ --provisioning-templates "My_Provisioning_Template"
3.2. Creating Architectures
An architecture in Foreman represents a logical grouping of hosts and operating systems. Architectures are created by Foreman automatically when hosts check in with Puppet. Basic i386 and x86_64 architectures are already preset in Foreman.
Use this procedure to create an architecture in Foreman.
To create an architecture, complete the following steps:
-
In the Foreman web UI, navigate to Hosts > Architectures, and in the Architectures window, click Create Architecture.
-
In the Name field, enter a name for the architecture.
-
From the Operating Systems list, select an operating system. If none are available, you can create and assign them under Hosts > Operating Systems.
-
Click Submit.
Enter the hammer architecture create
command to create an architecture. Specify its name and operating systems that include this architecture:
# hammer architecture create --name "Architecture_Name" \ --operatingsystems "os"
3.3. Creating Hardware Models
Use this procedure to create a hardware model in Foreman so that you can specify what hardware model a host uses.
To create a hardware model, complete the following steps:
-
In the Foreman web UI, navigate to Hosts > Hardware Models, and in the Hardware Models window, click Create Model.
-
In the Name field, enter a name for the hardware model.
-
Optionally, in the Hardware Model and Vendor Class fields, you can enter corresponding information for your system.
-
In the Info field, enter a description of the hardware model.
-
Click Submit to save your hardware model.
Create a hardware model using the hammer model create
command. The only required parameter is --name
. Optionally, enter the hardware model with the --hardware-model
option, a vendor class with the --vendor-class
option, and a description with the --info
option:
# hammer model create --name "model_name" --info "description" \ --hardware-model "hardware_model" --vendor-class "vendor_class"
3.4. Using a Synced Kickstart Repository for a Host’s Operating System
The following feature is provided by Katello plugin.
Foreman contains a set of synchronized kickstart repositories that you use to install the provisioned host’s operating system. For more information about adding repositories, see Enabling Red Hat Repositories in the Content Management Guide.
To set up a kickstart repository, complete the following steps:
-
Add the synchronized kickstart repository that you want to use to the existing Content View or create a new Content View and add the kickstart repository.
For Red Hat Enterprise Linux 8, ensure that you add both Red Hat Enterprise Linux 8 for x86_64 - AppStream Kickstart x86_64 8 and Red Hat Enterprise Linux 8 for x86_64 - BaseOS Kickstart x86_64 8 repositories.
-
Publish a new version of the Content View where the kickstart repository is added and promote it to a required lifecycle environment. For more information, see Managing Content Views in the Content Management Guide.
-
When you create a host, in the Operating System tab, for Media Selection, select the Synced Content check box.
To view the kickstart tree enter the following command:
# hammer medium list --organization "your_organization"
3.5. Creating Partition Tables
A partition table is a set of directives that defines the way Foreman server configures the disks available on a new host. Foreman contains a set of default partition tables to use, including a Kickstart default
. You can also edit partition table entries to configure the preferred partitioning scheme, or create a partition table entry and add it to the Red Hat Enterprise Linux operating system entry.
To create partition tables, complete the following steps:
-
In the Foreman web UI, navigate to Hosts > Partition Tables and, in the Partition Tables window, click Create Partition Table.
-
In the Name field, enter a name to represent the partition table.
-
Select the Default check box if you want to set the template to automatically associate with new organizations or locations.
-
Select the Snippet check box if you want to identify the template as a reusable snippet for other partition tables.
-
From the Operating System Family list, select the distribution or family of the partitioning layout. For example, Red Hat Enterprise Linux, CentOS, and Fedora are in the Red Hat family.
-
In the Template editor field, enter the layout for the disk partition. For example:
zerombr clearpart --all --initlabel autopart
You can also use the Template file browser to upload a template file.
The format of the layout must match that for the intended operating system. For example, Red Hat Enterprise Linux 7.2 requires a layout that matches a kickstart file.
-
In the Audit Comment field, add a summary of changes to the partition layout.
-
Click the Organizations and Locations tabs to add any other provisioning contexts that you want to associate with the partition table. Foreman adds the partition table to the current provisioning context.
-
Click Submit to save your partition table.
Before you create a partition table with the CLI, create a plain text file that contains the partition layout. This example uses the ~/my-partition
file. Create the installation medium using the hammer partition-table create
command:
# hammer partition-table create --name "My Partition" --snippet false \ --os-family Redhat --file ~/my-partition --organizations "My_Organization" \ --locations "My_Location"
3.6. Creating Provisioning Templates
A provisioning template defines the way Foreman server installs an operating system on a host.
3.6.1. Types of Provisioning Templates
There are various types of provisioning templates, including:
Provision
The main template for the provisioning process. For example, a kickstart template. For more information about kickstart template syntax, see the Kickstart Syntax Reference in the Red Hat Enterprise Linux 7 Installation Guide.
PXELinux, PXEGrub, PXEGrub2
PXE-based templates that deploy to the template Smart Proxy associated with a subnet to ensure that the host uses the installer with the correct kernel options. For BIOS provisioning, select PXELinux template. For UEFI provisioning, select PXEGrub2.
Finish
Post-configuration scripts to use when the main provisioning process completes. This is completed as an SSH task. You can use Finishing templates only for imaged-based provisioning in virtual environments. Do not confuse an image with a foreman discovery ISO, which is sometimes called a Foreman discovery image. An image in this context is an install image in a virtualized environment for easy deployment.
When a finish script successfully exits with the return code 0
, Foreman treats the code as a success and the host exits the build mode. Note that there are a few finish scripts with a build mode that uses a call back HTTP call. These scripts are not used for image-based provisioning, but for post configuration of operating-system installations such as Debian, Ubuntu, and BSD.
Bootdisk
Templates for PXE-less boot methods.
Kernel Execution (kexec)
Kernel execution templates for PXE-less boot methods.
user_data
Post-configuration scripts for providers that accept user data, such as cloud-init
scripts. This template does not require Foreman to be able to reach the host. However, the host must be able to reach Foreman.
Script
An arbitrary script not used by default but useful for custom tasks.
ZTP
Zero Touch Provisioning templates.
POAP
PowerOn Auto Provisioning templates.
iPXE
Templates for iPXE
or gPXE
environments to use instead of PXELinux.
3.6.2. Template Syntax and Management
Foreman includes many template examples. In the Foreman web UI, navigate to Hosts > Provisioning templates to view them. You can create a template or clone a template and edit the clone. For help with templates, navigate to Hosts > Provisioning templates > Create Template > Help.
Templates accept the Embedded Ruby (ERB) syntax. For more information, see Template Writing Reference in Managing Hosts.
You can download provisioning templates. Before you can download the template, you must create a debug certificate. For more information, see Creating an Organization Debug Certificate in the Content Management Guide.
You can synchronize templates between Foreman server and a Git repository or a local directory. For more information, see Appendix F. Synchronizing Templates with Git in the Content Management guide.
To view the history of changes applied to a template, navigate to Hosts > Provisioning templates, select one of the templates, and click History. Click Revert to override the editor content with the previous version. It is possible to revert to an earlier change as well. Click Show Diff to see information about a specific change:
-
Template Diff tab displays changes in the body of a provisioning template.
-
Details tab displays changes in the template description.
-
History tab displays the user who made a change to the template and date of the change.
3.6.3. Procedure
To create a template, complete the following step:
-
In the Foreman web UI, navigate to Hosts > Provisioning Templates and, in the Provisioning Templates window, click Create Template.
The Help tab provides information about the template syntax. It details the available functions, variables, and methods that can be called on different types of objects within the template.
Alternatively, to clone a template and add your updates to the clone, complete the following steps:
-
In the Foreman web UI, navigate to Hosts > Provisioning Templates and search for the template that you want to use.
-
On the template that you want to use, click Clone to duplicate it.
-
In the Name field, enter a name for the provisioning template.
-
Select the Default check box to set the template to associate automatically with new organizations or locations.
-
In the Template editor field, enter the body of the provisioning template. You can also use the Template file browser to upload a template file.
-
In the Audit Comment field, enter a summary of changes to the provisioning template for auditing purposes.
-
Click the Type tab and if your template is a snippet, select the Snippet check box. A snippet is not a standalone provisioning template, but a part of a provisioning template that can be inserted into other provisioning templates.
-
From the Type list, select the type of the template. For example, Provisioning template.
-
Click the Association tab and from the Applicable Operating Systems list, select the names of the operating systems that you want to associate with the provisioning template.
-
Optionally, click Add combination and select a host group from the Host Group list or an environment from the Environment list to associate provisioning template with the host groups and environments.
-
Click the Organizations and Locations tabs to add any additional contexts to the template.
-
Click Submit to save your provisioning template.
Before you create a template with the CLI, create a plain text file that contains the template. This example uses the ~/my-template
file. Create the installation medium using the hammer template create
command and specify the type with the --type
option:
# hammer template create --name "My Provisioning Template" \ --file ~/my-template --type provision --organizations "My_Organization" \ --locations "My_Location"
3.7. Creating Compute Profiles
Compute profiles are used in conjunction with compute resources, such as virtualization infrastructure and cloud providers. Compute profiles allow users to predefine hardware such as CPUs, memory, and storage. A default installation of Foreman contains three predefined profiles:
-
1-Small
-
2-Medium
-
3-Large
-
In the Foreman web UI, navigate to Infrastructure > Compute Profiles, and in the Compute Profiles window, click Create Compute Profile.
-
In the Name field, enter a name for the profile and click Submit.
The compute profile CLI commands are not yet implemented in Foreman 6.4.
3.8. Setting a Default Encrypted Root Password for Hosts
If you do not want to set a plain text default root password for the hosts that you provision, you can use a default encrypted password.
To set a default encrypted password for your hosts, complete the following steps:
-
Generate an encrypted password. You can use the following command to generate a password:
# python -c 'import crypt,getpass;pw=getpass.getpass(); print(crypt.crypt(pw)) if (pw==getpass.getpass("Confirm: ")) else exit()'
-
Copy the password for later use.
-
In the Foreman web UI, navigate to Administer > Settings.
-
On the Settings page, select the Provisioning tab.
-
In the Name column, navigate to Root password, and click Click to edit.
-
Paste the encrypted password that you generate, and click Save.
3.9. Using Third Party Installation Media
Installation media are sources of files for third parties that Foreman server uses to install a third-party base operating system on a machine. Installation media must be in the format of an operating system installation tree, and must be accessible to the machine hosting the installer through an HTTP URL. You can view installation media by navigating to Hosts > Installation Media menu.
For other installation media, for example, a locally mounted ISO image, you can add your own custom media paths using the following procedure.
To create installation media, complete the following steps:
-
In the Foreman web UI, navigate to Hosts > Installation Media and click Create Medium.
-
In the Name field, enter a name to represent the installation media entry.
-
In the Path enter the URL or NFS share that contains the installation tree. You can use following variables in the path to represent multiple different system architectures and versions:
-
$arch
- The system architecture. -
$version
- The operating system version. -
$major
- The operating system major version. -
$minor
- The operating system minor version.Example HTTP path:
http://download.example.com/centos/$version/Server/$arch/os/
Example NFS path:
nfs://download.example.com:/centos/$version/Server/$arch/os/
Synchronized content on Smart Proxy servers always uses an HTTP path. Smart Proxy server managed content does not support NFS paths.
-
-
From the Operating system family list, select the distribution or family of the installation medium. For example, CentOS, and Fedora are in the
Red Hat
family. -
Click the Organizations and Locations tabs, to change the provisioning context. Foreman server adds the installation medium to the set provisioning context.
-
Click Submit to save your installation medium.
Create the installation medium using the hammer medium create
command:
# hammer medium create --name "CustomOS" --os-family "Redhat" \ --path 'http://download.example.com/centos/$version/Server/$arch/os/' \ --organizations "My_Organization" --locations "My_Location"
3.10. Using noVNC to Access Virtual Machines
You can use your browser to access the VNC console of VMs created by Foreman.
Foreman supports using noVNC on the following virtualization platforms:
-
VMware
-
Libvirt
-
oVirt
Use the following procedure to configure your virtualization platform and browser to enable the use of the noVNC console.
-
You must have a virtual machine created by Foreman.
-
For existing virtual machines, ensure that the Display type in the Compute Resource settings is VNC.
-
You must import the Katello root CA certificate into your Foreman server. Adding a security exception in the browser is not enough for using noVNC. For more information, see the Installing the Katello Root CA Certificate section in the Administering Foreman guide.
-
On the VM host system, configure the firewall to allow VNC service on ports 5900 to 5930:
-
On operating systems with iptables command:
# iptables -A INPUT -p tcp --dport 5900:5930 -j ACCEPT # service iptables save
-
On operating systems with firewalld service:
# firewall-cmd --add-port=5900-5930/tcp # firewall-cmd --add-port=5900-5930/tcp --permanent
-
-
In the Foreman web UI, navigate to Infrastructure > Compute Resources and select the name of a compute resource.
-
In the Virtual Machines tab, select the name of a VM host. Ensure the machine is powered on and then select Console.
4. Configuring Networking
Each provisioning type requires some network configuration. Use this chapter to configure network services in your integrated Smart Proxy on Foreman server.
New hosts must have access to your Smart Proxy server. Smart Proxy server can be either your integrated Smart Proxy on Foreman server or an external Smart Proxy server. You might want to provision hosts from an external Smart Proxy server when the hosts are on isolated networks and cannot connect to Foreman server directly, or when the content is synchronized with the Smart Proxy server. Provisioning using the external Smart Proxy server can save on network bandwidth.
Configuring Smart Proxy server has two basic requirements:
-
Configuring network services. This includes:
-
Content delivery services
-
Network services (DHCP, DNS, and TFTP)
-
Puppet configuration
-
-
Defining network resource data in Foreman server to help configure network interfaces on new hosts.
The following instructions have similar applications to configuring standalone Smart Proxies managing a specific network. To configure Foreman to use external DHCP, DNS, and TFTP services, see Configuring External Services in Installing Foreman server from a Connected Network.
4.1. Network Resources
Foreman contains networking resources that you must set up and configure to create a host. Foreman includes the following networking resources:
- Domain
-
You must assign every host that is managed by Foreman to a domain. Using the domain, Foreman can manage A, AAAA, and PTR records. Even if you do not want Foreman to manage your DNS servers, you still must create and associate at least one domain. Domains are included in the naming conventions Foreman hosts, for example, a host with the name
test123
in theexample.com
domain has the fully qualified domain nametest123.example.com
. - Subnet
-
You must assign every host managed by Foreman to a subnet. Using subnets, Foreman can then manage IPv4 reservations. If there are no reservation integrations, you still must create and associate at least one subnet. When you manage a subnet in Foreman, you cannot create DHCP records for that subnet outside of Foreman. In Foreman, you can use IP Address Management (IPAM) to manage IP addresses with one of the following options:
-
DHCP: the DHCP Smart Proxy manages the assignment of IP addresses by finding the next available IP address starting from the first. Before assigning an IP address, Smart Proxy sends an ICMP and TCP ping to verify whether the IP address is in use.
-
Internal DB: Foreman manages a list of available IP addresses in the PostgreSQL database. Foreman assigns the IP addresses automatically.
-
Random DB: Foreman manages a list of available IP addresses in the PostgreSQL database, but randomizes the results to avoid IPv4 race conditions.
-
None: IP address for each host must be entered manually.
For more information about adding a subnet, see Adding a Subnet to Foreman server.
-
- DHCP Ranges
-
You can define the same DHCP range in Foreman server for both discovered and provisioned systems, but use a separate range for each service within the same subnet.
4.2. Foreman and DHCP Options
Foreman manages DHCP reservations through a DHCP Smart Proxy. Foreman also sets the next-server
and filename
DHCP options.
The next-server
option provides the IP address of the TFTP server to boot from. This option is not set by default and must be set for each TFTP Smart Proxy. You can use the foreman-installer
command with the --foreman-proxy-tftp-servername
option to set the TFTP server in the /etc/foreman-proxy/settings.d/tftp.yml
file:
# foreman-installer --foreman-proxy-tftp-servername 1.2.3.4
Each TFTP Smart Proxy then reports this setting through the API and Foreman can retrieve the configuration information when it creates the DHCP record.
When the PXE loader is set to none
, Foreman does not populate the next-server
option into the DHCP record.
If the next-server
option remains undefined, Foreman uses reverse DNS search to find a TFTP server address to assign, but you might encounter the following problems:
-
DNS timeouts during provisioning
-
Querying of incorrect DNS server. For example, authoritative rather than caching
-
Errors about incorrect IP address for the TFTP server. For example,
PTR record was invalid
If you encounter these problems, check the DNS setup on both Foreman and Smart Proxy, specifically the PTR record resolution.
The filename
option contains the full path to the file that downloads and executes during provisioning. The PXE loader that you select for the host or host group defines which filename
option to use. When the PXE loader is set to none
, Foreman does not populate the filename
option into the DHCP record. Depending on the PXE loader option, the filename
changes as follows:
PXE loader option | filename entry | Notes |
---|---|---|
PXELinux BIOS |
|
|
PXELinux UEFI |
|
|
iPXE Chain BIOS |
|
|
PXEGrub2 UEFI |
|
x64 can differ depending on architecture |
iPXE UEFI HTTP |
|
Requires the |
Grub2 UEFI HTTP |
|
Requires the |
4.3. Troubleshooting DHCP Problems in Foreman
Foreman can manage an ISC DHCP server on internal or external DHCP Smart Proxy. Foreman can list, create, and delete DHCP reservations and leases. However, there are a number of problems that you might encounter on occasions.
When the PXE loader option is changed for an existing host, this causes a DHCP conflict. The only workaround is to overwrite the DHCP entry.
This is a known issue. Until Issue 27877 is fixed, the only workaround is to overwrite the DHCP entry.
An operating system update can update the dhcpd
package. This causes the permissions of important directories and files to reset so that the DHCP Smart Proxy cannot read the required information.
For more information, see ERF12-6899 - Unable to set DHCP entry.
Foreman manages DHCP records only for hosts that are assigned to subnets with a DHCP Smart Proxy set. If you create a host and then clear or change the DHCP Smart Proxy, when you attempt to delete the host, the action fails.
If you create a host without setting the DHCP Smart Proxy and then try to set the DHCP Smart Proxy, this causes DHCP conflicts.
Any changes to a DHCP lease are appended to the end of the dhcpd.leases
file. Because entries are appended to the file, it is possible that two or more entries of the same lease can exist in the dhcpd.leases
file at the same time. When there are two or more entries of the same lease, the last entry in the file takes precedence. Group, subgroup and host declarations in the lease file are processed in the same manner. If a lease is deleted, { deleted; }
is appended to the declaration.
4.4. Prerequisites for Image Based Provisioning
Images that use the finish
post-boot configuration scripts require a managed DHCP server, such as Foreman’s integrated Smart Proxy or an external Smart Proxy. The host must be created with a subnet associated with a DHCP Smart Proxy, and the IP address of the host must be a valid IP address from the DHCP range.
It is possible to use an external DHCP service, but IP addresses must be entered manually. The SSH credentials corresponding to the configuration in the image must be configured in Foreman to enable the post-boot configuration to be made.
Check following items when troubleshooting a virtual machine booted from an image that depends on post-configuration scripts:
-
The host has a subnet assigned in Foreman server.
-
The subnet has a DHCP Smart Proxy assigned in Foreman server.
-
The host has a valid IP address assigned in Foreman server.
-
The IP address acquired by the virtual machine using DHCP matches the address configured in Foreman server.
-
The virtual machine created from an image responds to SSH requests.
-
The virtual machine created from an image authorizes the user and password, over SSH, which is associated with the image being deployed.
-
Foreman server has access to the virtual machine via SSH keys. This is required for the virtual machine to receive post-configuration scripts from Foreman server.
Images that use the cloud-init
scripts require a DHCP server to avoid having to include the IP address in the image. A managed DHCP Smart Proxy is preferred. The image must have the cloud-init
service configured to start when the system boots and fetch a script or configuration data to use in completing the configuration.
Check the following items when troubleshooting a virtual machine booted from an image that depends on initialization scripts included in the image:
-
There is a DHCP server on the subnet.
-
The virtual machine has the
cloud-init
service installed and enabled.
4.5. Configuring Network Services
Some provisioning methods use Smart Proxy server services. For example, a network might require the Smart Proxy server to act as a DHCP server. A network can also use PXE boot services to install the operating system on new hosts. This requires configuring the Smart Proxy server to use the main PXE boot services: DHCP, DNS, and TFTP.
Use the foreman-installer
command with the options to configure these services on the Foreman server.
Note
|
While performing a Ketello deployment, to configure these services on an external Smart Proxy server, run foreman-installer --scenario foreman-proxy-content .
|
Foreman server uses eth0
for external communication, such as connecting to Red Hat’s CDN.
To configure network services on Foreman’s integrated Smart Proxy, complete the following steps:
-
Enter the
foreman-installer
command to configure the required network services:# foreman-installer --foreman-proxy-dhcp true \ --foreman-proxy-dhcp-managed true \ --foreman-proxy-dhcp-gateway "192.168.140.1" \ --foreman-proxy-dhcp-interface "eth1" \ --foreman-proxy-dhcp-nameservers "192.168.140.2" \ --foreman-proxy-dhcp-range "192.168.140.10 192.168.140.110" \ --foreman-proxy-dhcp-server "192.168.140.2" \ --foreman-proxy-dns true \ --foreman-proxy-dns-managed true \ --foreman-proxy-dns-forwarders "8.8.8.8; 8.8.4.4" \ --foreman-proxy-dns-interface "eth1" \ --foreman-proxy-dns-reverse "140.168.192.in-addr.arpa" \ --foreman-proxy-dns-server "127.0.0.1" \ --foreman-proxy-dns-zone "example.com" \ --foreman-proxy-tftp true \ --foreman-proxy-tftp-managed true
-
Find the Smart Proxy server that you configure:
# hammer proxy list
-
Refresh features of the Smart Proxy server to view the changes:
# hammer proxy refresh-features --name "foreman.example.com"
-
Verify the services configured on the Smart Proxy server:
# hammer proxy info --name "foreman.example.com"
4.5.1. DHCP, DNS, and TFTP Options for Network Configuration
- --foreman-proxy-dhcp
-
Enables the DHCP service. You can set this option to
true
orfalse
. - --foreman-proxy-dhcp-managed
-
Enables Foreman to manage the DHCP service. You can set this option to
true
orfalse
. - --foreman-proxy-dhcp-gateway
-
The DHCP pool gateway. Set this to the address of the external gateway for hosts on your private network.
- --foreman-proxy-dhcp-interface
-
Sets the interface for the DHCP service to listen for requests. Set this to
eth1
. - --foreman-proxy-dhcp-nameservers
-
Sets the addresses of the nameservers provided to clients through DHCP. Set this to the address for Foreman server on
eth1
. - --foreman-proxy-dhcp-range
-
A space-separated DHCP pool range for Discovered and Unmanaged services.
- --foreman-proxy-dhcp-server
-
Sets the address of the DHCP server to manage.
- --foreman-proxy-dns
-
Enables DNS service. You can set this option to
true
orfalse
. - --foreman-proxy-dns-managed
-
Enables Foreman to manage the DNS service. You can set this option to
true
orfalse
. - --foreman-proxy-dns-forwarders
-
Sets the DNS forwarders. Set this to your DNS servers.
- --foreman-proxy-dns-interface
-
Sets the interface to listen for DNS requests. Set this to
eth1
. - --foreman-proxy-dns-reverse
-
The DNS reverse zone name.
- --foreman-proxy-dns-server
-
Sets the address of the DNS server to manage.
- --foreman-proxy-dns-zone
-
Sets the DNS zone name.
- --foreman-proxy-tftp
-
Enables TFTP service. You can set this option to
true
orfalse
. - --foreman-proxy-tftp-managed
-
Enables Foreman to manage the TFTP service. You can set this option to
true
orfalse
. - --foreman-proxy-tftp-servername
-
Sets the TFTP server to use. Ensure that you use Smart Proxy’s IP address.
Run foreman-installer --help
to view more options related to DHCP, DNS, TFTP, and other Foreman Smart Proxy services
4.5.2. Using TFTP Services through NAT
You can use Foreman TFTP services through NAT. To do this, on all NAT routers or firewalls, you must enable a TFTP service on UDP port 69 and enable the TFTP state tracking feature. For more information, see the documentation for your NAT device.
firewalld
:Use the following command to allow TFTP service on UDP port 69, load the kernel TFTP state tracking module, and make the changes persistent:
# firewall-cmd --add-service=tftp && firewall-cmd --runtime-to-permanent
-
Configure the firewall to allow TFTP service UDP on port 69.
# iptables -A OUTPUT -i eth0 -p udp --sport 69 -m state \ --state ESTABLISHED -j ACCEPT # service iptables save
-
Load the
ip_conntrack_tftp
kernel TFTP state module. In the/etc/sysconfig/iptables-config
file, locateIPTABLES_MODULES
and addip_conntrack_tftp
as follows:IPTABLES_MODULES="ip_conntrack_tftp"
4.6. Adding a Domain to Foreman server
Foreman server defines domain names for each host on the network. Foreman server must have information about the domain and the Smart Proxy server responsible for domain name assignment.
Foreman server might already have the relevant domain created as part of Foreman server installation. Switch the context to Any Organization
and Any Location
then check the domain list to see if it exists.
During the DNS record creation, Foreman performs conflict DNS lookups to verify that the host name is not in active use. This check runs against one of the following DNS servers:
-
The system-wide resolver if Adminster > Settings > Query local nameservers is set to true.
-
The nameservers that are defined in the subnet associated with the host.
-
The authoritative NS-Records that are queried from the SOA from the domain name associated with the host.
If you experience timeouts during DNS conflict resolution, check the following settings:
-
The subnet nameservers must be reachable from Foreman server.
-
The domain name must have a Start of Authority (SOA) record available from Foreman server.
-
The system resolver in the `/etc/resolv.conf`file must have a valid and working configuration.
To add a domain to Foreman, complete the following steps:
-
In the Foreman web UI, navigate to Infrastructure > Domains and click Create Domain.
-
In the DNS Domain field, enter the full DNS domain name.
-
In the Fullname field, enter the plain text name of the domain.
-
Click the Parameters tab and configure any domain level parameters to apply to hosts attached to this domain. For example, user defined Boolean or string parameters to use in templates.
-
Click Add Parameter and fill in the Name and Value fields.
-
Click the Locations tab, and add the location where the domain resides.
-
Click the Organizations tab, and add the organization that the domain belongs to.
-
Click Submit to save the changes.
Use the hammer domain create
command to create a domain:
# hammer domain create --name "domain_name.com" \ --description "My example domain" --dns-id 1 \ --locations "My_Location" --organizations "My_Organization"
In this example, the --dns-id
option uses 1
, which is the ID of your integrated Smart Proxy on Foreman server.
4.7. Adding a Subnet to Foreman server
You must add information for each of your subnets to Foreman server because Foreman configures interfaces for new hosts. To configure interfaces, Foreman server must have all the information about the network that connects these interfaces.
To add a subnet to Foreman server, complete the following steps:
-
In the Foreman web UI, navigate to Infrastructure > Subnets, and in the Subnets window, click Create Subnet.
-
In the Name field, enter a name for the subnet.
-
In the Description field, enter a description for the subnet.
-
In the Network address field, enter the network address for the subnet.
-
In the Network prefix field, enter the network prefix for the subnet.
-
In the Network mask field, enter the network mask for the subnet.
-
In the Gateway address field, enter the external gateway for the subnet.
-
In the Primary DNS server field, enter a primary DNS for the subnet.
-
In the Secondary DNS server, enter a secondary DNS for the subnet.
-
From the IPAM list, select the method that you want to use for IP address management (IPAM). For more information about IPAM, see Network Resources.
-
Enter the information for the IPAM method that you select.
-
If you use the remote execution plugin, click the Remote Execution tab and select the Smart Proxy that controls the remote execution.
-
Click the Domains tab and select the domains that apply to this subnet.
-
Click the Smart Proxies tab and select the Smart Proxy that applies to each service in the subnet, including DHCP, TFTP, and reverse DNS services.
-
Click the Parameters tab and configure any subnet level parameters to apply to hosts attached to this subnet. For example, user defined Boolean or string parameters to use in templates.
-
Click the Locations tab and select the locations that use this Smart Proxy.
-
Click the Organizations tab and select the organizations that use this Smart Proxy.
-
Click Submit to save the subnet information.
Create the subnet with the following command:
# hammer subnet create --name "My_Network" \ --description "your_description" \ --network "192.168.140.0" --mask "255.255.255.0" \ --gateway "192.168.140.1" --dns-primary "192.168.140.2" \ --dns-secondary "8.8.8.8" --ipam "DHCP" \ --from "192.168.140.111" --to "192.168.140.250" --boot-mode "DHCP" \ --domains "example.com" --dhcp-id 1 --dns-id 1 --tftp-id 1 \ --locations "My_Location" --organizations "My_Organization"
Note
|
In this example, the --dhcp-id , --dns-id , and --tftp-id options use 1, which is the ID of the integrated Smart Proxy in Foreman server.
|
4.8. Configuring iPXE to Reduce Provisioning Times
You can configure PXELinux to chainboot iPXE and boot using the HTTP protocol, which is faster and more reliable on high latency networks than TFTP.
There are three methods of using iPXE with Foreman 6.4:
-
Chainbooting virtual machines using hypervisors that use iPXE as primary firmware
-
Using PXELinux through TFTP to chainload iPXE directly on bare metal hosts
-
Using PXELinux through UNDI, which uses HTTP to transfer the kernel and the initial RAM disk on bare metal hosts
Before you begin, ensure that the following conditions are met:
-
A host exists on Foreman to use
-
The MAC address of the provisioning interface matches the host configuration
-
The provisioning interface of the host has a valid DHCP reservation
-
The NIC is capable of PXE booting. For more information, see http://ipxe.org/appnote/hardware_drivers
-
The NIC is compatible with iPXE
4.8.1. Chainbooting virtual machines
Most virtualization hypervisors use iPXE as primary firmware for PXE booting. Because of this, you can chainboot without TFTP and PXELinux.
Using virtualization hypervisors removes the need for TFTP and PXELinux. It has the following workflow:
-
Virtual machine starts
-
iPXE retrieves the network credentials using DHCP
-
iPXE retrieves the HTTP address using DHCP
-
iPXE chainloads the iPXE template from the template Smart Proxy
-
iPXE loads the kernel and initial RAM disk of the installer
Ensure that the hypervisor that you want to use supports iPXE. The following virtualization hypervisors support iPXE:
-
libvirt
-
oVirt
-
RHEV
You can use the default template to configure iPXE booting for hosts. If you want to change the default values in the template, clone the template and edit the clone.
To configure Foreman to use iPXE, complete the following steps:
-
In the Foreman web UI, navigate to Hosts > Provisioning Templates, enter
Kickstart default iPXE
and click Search. -
Optional: If you want to change the template, click Clone, enter a unique name, and click Submit.
-
Click the name of the template you want to use.
-
If you clone the template, you can make changes you require on the Template tab.
-
Click the Association tab, and select the operating systems that your host uses.
-
Click the Locations tab, and add the location where the host resides.
-
Click the Organizations tab, and add the organization that the host belongs to.
-
Click Submit to save the changes.
-
Navigate to Hosts > Operating systems and select the operating system of your host.
-
Click the Templates tab.
-
From the iPXE Template list, select the template you want to use.
-
Click Submit to save the changes.
-
Navigate to Hosts > All Hosts.
-
In the Hosts page, select the host that you want to use.
-
Select the Templates tab.
-
From the iPXE template list, select Review and verify that the Kickstart default iPXE template is the correct template.
-
To prevent an endless loop of chainbooting iPXE firmware, edit the
/etc/dhcp/dhcpd.conf
file to match the following example. If you use an isolated network, use Smart Proxy server URL with TCP port 8000, instead of the URL of Foreman server.-
Locate the following lines in the Bootfile Handoff section of the
/etc/dhcp/dhcpd.conf
file:} else { filename "pxelinux.0"; }
-
Add the following extra
elsif
statement before the else statement:elsif exists user-class and option user-class = "iPXE" { filename "http://foreman.example.com/unattended/iPXE"; }
-
Verify that the 'if' section matches the following example:
if option architecture = 00:06 { filename "grub2/shim.efi"; } elsif option architecture = 00:07 { filename "grub2/shim.efi"; } elsif option architecture = 00:09 { filename "grub2/shim.efi"; } elsif exists user-class and option user-class = "iPXE" { filename "http://foreman.example.com/unattended/iPXE"; } else { filename "pxelinux.0"; }
NoteUse http://foreman.example.com/unattended/iPXE when Smart Proxy HTTP endpoint is disabled (installer option --foreman-proxy-http false). Template Smart Proxy plugin has default value 8000 when enabled and can be changed with --foreman-proxy-http-port installer option, in that case use http://smartproxy.example.com:8000. You must update the /etc/dhcp/dhcpd.conf
file after every upgrade. The content of the/etc/dhcp/dhcpd.conf
file is case sensitive.
-
4.8.2. Chainbooting iPXE directly
Use this procedure to set up iPXE to use a built-in driver for network communication or UNDI interface. There are separate procedures to configure Foreman server and Smart Proxy to use iPXE.
You can use this procedure only with bare metal hosts.
-
Host powers on
-
PXE driver retrieves the network credentials using DHCP
-
PXE driver retrieves the PXELinux firmware
pxelinux.0
using TFTP -
PXELinux searches for the configuration file on the TFTP server
-
PXELinux chainloads iPXE
ipxe.lkrn
orundionly-ipxe.0
-
iPXE retrieves the network credentials using DHCP again
-
iPXE retrieves HTTP address using DHCP
-
iPXE chainloads the iPXE template from the template Smart Proxy
-
iPXE loads the kernel and initial RAM disk of the installer
You can use the default template to configure iPXE booting for hosts. If you want to change the default values in the template, clone the template and edit the clone.
To configure Foreman to use iPXE with the UNDI workflow, complete the following steps:
-
In the Foreman web UI, navigate to Hosts > Provisioning Templates, enter
PXELinux chain iPXE
or, for UNDI, enterPXELinux chain iPXE UNDI
, and click Search. -
Optional: If you want to change the template, click Clone, enter a unique name, and click Submit.
-
Click the name of the template you want to use.
-
If you clone the template, you can make changes you require on the Template tab.
-
Click the Association tab, and select the operating systems that your host uses.
-
Click the Locations tab, and add the location where the host resides.
-
Click the Organizations tab, and add the organization that the host belongs to.
-
Click Submit to save the changes.
-
In the Provisioning Templates page, enter
Kickstart default iPXE
into the search field and click Search. -
Optional: If you want to change the template, click Clone, enter a unique name, and click Submit.
-
Click the name of the template you want to use.
-
If you clone the template, you can make changes you require on the Template tab.
-
Click the Association tab, and associate the template with the operating system that your host uses.
-
Click the Locations tab, and add the location where the host resides.
-
Click the Organizations tab, and add the organization that the host belongs to.
-
Click Submit to save the changes.
-
Navigate to Hosts > Operating systems and select the operating system of your host.
-
Click the Templates tab.
-
From the PXELinux template list, select the template you want to use.
-
From the iPXE template list, select the template you want to use.
-
Click Submit to save the changes.
-
Navigate to Hosts > All Hosts, and select the host you want to use.
-
Select the Templates tab, and from the PXELinux template list, select Review and verify the template is the correct template.
-
From the iPXE template list, select Review and verify the template is the correct template. If there is no PXELinux entry, or you cannot find the new template, navigate to Hosts > All Hosts, and on your host, click Edit. Click the Operating system tab and click the Provisioning Template Resolve button to refresh the list of templates.
-
To prevent an endless loop of chainbooting iPXE firmware, edit the
/etc/dhcp/dhcpd.conf
file to match the following example. If you use an isolated network, use Smart Proxy server URL with TCP port 8000, instead of the URL of Foreman server.-
Locate the following lines in the Bootfile Handoff section of the
/etc/dhcp/dhcpd.conf
file:} else { filename "pxelinux.0"; }
-
Add the following extra
elsif
statement before the else statement:elsif exists user-class and option user-class = "iPXE" { filename "http://foreman.example.com/unattended/iPXE"; }
-
Verify that the 'if' section matches the following example:
if option architecture = 00:06 { filename "grub2/shim.efi"; } elsif option architecture = 00:07 { filename "grub2/shim.efi"; } elsif option architecture = 00:09 { filename "grub2/shim.efi"; } elsif exists user-class and option user-class = "iPXE" { filename "http://foreman.example.com/unattended/iPXE"; } else { filename "pxelinux.0"; }
NoteFor http://foreman.example.com/unattended/iPXE
, you can also use a Foreman Smart Proxyhttp://smartproxy.example.com:8000/unattended/iPXE
. You must update the/etc/dhcp/dhcpd.conf
file after every upgrade. The content of the/etc/dhcp/dhcpd.conf
file is case sensitive.
-
You can use this procedure to configure Smart Proxies to use iPXE.
You must perform this procedure on all Smart Proxies.
To configure the Smart Proxy to chainboot iPXE, complete the following steps:
-
Install the
ipxe-bootimgs
RPM package:# yum install ipxe-bootimgs
-
On Debian/Ubuntu, install the
ipxe
.deb package:# apt-get install ipxe
-
Copy the iPXE firmware to the TFTP server’s root directory. Do not use symbolic links because TFTP runs in the
chroot
environment.-
For chainbooting directly, enter the following command:
# cp /usr/share/ipxe/ipxe.lkrn /var/lib/tftpboot/
-
For UNDI, enter the following command:
# cp /usr/share/ipxe/undionly.kpxe /var/lib/tftpboot/undionly-ipxe.0
NoteOn systems with SELinux, perform the following command.
-
-
Correct the file contexts:
# restorecon -RvF /var/lib/tftpboot/
5. Using Infoblox as DHCP and DNS Providers
You can use Smart Proxy server to connect to your Infoblox application to create and manage DHCP and DNS records, and to reserve IP addresses.
5.1. Limitations
All DHCP and DNS records can be managed only in a single Network or DNS view, After you install the Infoblox modules on Smart Proxy and set up the view using the foreman-installer
command, you cannot edit the view.
Smart Proxy server communicates with a single Infoblox node using the standard HTTPS web API. If you want to configure clustering and High Availability, make the configurations in Infoblox.
Hosting PXE-related files using Infoblox’s TFTP functionality is not supported. You must use Smart Proxy as a TFTP server for PXE provisioning. For more information, see Configuring Networking.
Foreman IPAM feature cannot be integrated with Infoblox.
5.2. Prerequisites
You must have Infoblox account credentials to manage DHCP and DNS entries in Foreman.
Ensure that you have Infoblox administration roles with the names: DHCP Admin
and DNS Admin
.
The administration roles must have permissions or belong to an admin group that permits the accounts to perform tasks through the Infoblox API.
5.3. Installing the Infoblox CA Certificate on Smart Proxy server
You must install Infoblox HTTPS CA certificate on the base system for all Smart Proxies that you want to integrate with Infoblox applications.
You can download the certificate from the Infoblox web UI, or you can use the following OpenSSL commands to download the certificate:
# update-ca-trust enable # openssl s_client -showcerts -connect infoblox.example.com:443 </dev/null | \ openssl x509 -text >/etc/pki/ca-trust/source/anchors/infoblox.crt # update-ca-trust extract
-
The
infoblox.example.com
entry must match the host name for the Infoblox application in the X509 certificate.
To test the CA certificate, use a CURL query:
# curl -u admin:infoblox https://infoblox.example.com/wapi/v2.0/network
Example positive response:
[ { "_ref": "network/ZG5zLm5ldHdvcmskMTkyLjE2OC4yMDIuMC8yNC8w:infoblox.example.com/24/default", "network": "192.168.202.0/24", "network_view": "default" } ]
5.4. Installing the DHCP Infoblox module
Use this procedure to install the DHCP Infoblox module on Smart Proxy. Note that you cannot manage records in separate views.
You can also install DHCP and DNS Infoblox modules simultaneously by combining this procedure and Installing the DNS Infoblox Module
Use only the --foreman-proxy-plugin-dhcp-infoblox-record-type fixedaddress
option to configure the DHCP and DNS modules.
Configuring both DHCP and DNS Infoblox modules with the host
record type setting causes DNS conflicts and is not supported. If you install the Infoblox module on Smart Proxy server with the --foreman-proxy-plugin-dhcp-infoblox-record-type
option set to host
, you must unset both DNS Smart Proxy and Reverse DNS Smart Proxy options because Infoblox does the DNS management itself. You cannot use the host
option without creating conflicts and, for example, being unable to rename hosts in Foreman.
To install the Infoblox module for DHCP, complete the following steps:
-
On Smart Proxy, enter the following command:
# foreman-installer --enable-foreman-proxy-plugin-dhcp-infoblox \ --foreman-proxy-dhcp true \ --foreman-proxy-dhcp-managed false \ --foreman-proxy-dhcp-provider infoblox \ --foreman-proxy-plugin-dhcp-infoblox-record-type fixedaddress \ --foreman-proxy-dhcp-server infoblox.example.com \ --foreman-proxy-plugin-dhcp-infoblox-username admin \ --foreman-proxy-plugin-dhcp-infoblox-password infoblox \ --foreman-proxy-plugin-dhcp-infoblox-network-view default \ --foreman-proxy-plugin-dhcp-infoblox-dns-view default
-
In the Foreman web UI, navigate to Infrastructure > Smart Proxies and select the Smart Proxy with the Infoblox DHCP module and click Refresh.
-
Ensure that the dhcp features are listed.
-
For all domains managed through Infoblox, ensure that the DNS Smart Proxy is set for that domain. To verify, in the Foreman web UI, navigate to Infrastructure > Domains, and inspect the settings of each domain.
-
For all subnets managed through Infoblox, ensure that DHCP Smart Proxy and Reverse DNS Smart Proxy is set. To verify, in the Foreman web UI, navigate to Infrastructure > Subnets, and inspect the settings of each subnet.
5.5. Installing the DNS Infoblox Module
Use this procedure to install the DNS Infoblox module on Smart Proxy. You can also install DHCP and DNS Infoblox modules simultaneously by combining this procedure and Installing the DHCP Infoblox module.
DNS records are managed only in the default DNS view, it’s not possible to specify which DNS view to use.
To install the DNS Infoblox module, complete the following steps:
-
On Smart Proxy, enter the following command:
# foreman-installer --enable-foreman-proxy-plugin-dns-infoblox \ --foreman-proxy-dns true \ --foreman-proxy-dns-managed false \ --foreman-proxy-dns-provider infoblox \ --foreman-proxy-plugin-dns-infoblox-dns-server infoblox.example.com \ --foreman-proxy-plugin-dns-infoblox-username admin \ --foreman-proxy-plugin-dns-infoblox-password infoblox
-
In the Foreman web UI, navigate to Infrastructure > Smart Proxies and select the Smart Proxy with the Infoblox DNS module and click Refresh.
-
Ensure that the dns features are listed.
6. Provisioning Bare Metal Hosts
There are four main ways to provision bare metal instances with Foreman 6.4:
- Unattended Provisioning
-
New hosts are identified by a MAC address and Foreman server provisions the host using a PXE boot process.
- Unattended Provisioning with Discovery
-
New hosts use PXE boot to load the Foreman Discovery service. This service identifies hardware information about the host and lists it as an available host to provision.
- PXE-less Provisioning
-
New hosts are provisioned with a boot disk or PXE-less discovery image that Foreman server generates.
- PXE-less Provisioning with Discovery
-
New hosts use an ISO boot disk that loads the Foreman Discovery service. This service identifies hardware information about the host and lists it as an available host to provision.
Note
|
Discovery workflows are only available when Discovery plugin is installed. |
With Foreman, you can perform both BIOS and UEFI based PXE provisioning.
Both BIOS and UEFI interfaces work as interpreters between the computer’s operating system and firmware, initializing the hardware components and starting the operating system at boot time.
In Foreman provisioning, the PXE loader option defines the DHCP filename
option to use during provisioning. For BIOS systems, use the PXELinux BIOS option to enable a provisioned node to download the pxelinux.0
file over TFTP. For UEFI systems, use the PXEGrub2 UEFI option to enable a TFTP client to download grub2/grubx64.efi
file.
For BIOS provisioning, you must associate a PXELinux template with the operating system.
For UEFI provisioning, you must associate a PXEGrub2 template with the operating system.
If you associate both PXELinux and PXEGrub2 templates, Foreman can deploy configuration files for both on a TFTP server, so that you can switch between PXE loaders easily.
6.1. Prerequisites for Bare Metal Provisioning
The requirements for bare metal provisioning include:
-
A Smart Proxy server managing the network for bare metal hosts. For unattended provisioning and discovery-based provisioning, Foreman server requires PXE server settings. For more information, see Configuring Networking.
-
A bare metal host or a blank VM.
-
The installation media that you require for the operating systems you want to use to provision. If the Katello plugin is installed, you can use synchronized content repositories for Red Hat Enterprise Linux. For more information, see Synchronizing Red Hat Repositories in the Content Management Guide.
-
If the Katello plugin is installed, an activation key for host registration. For more information, see Creating An Activation Key in the Content Management guide.
For information about the security token for unattended and PXE-less provisioning, see Configuring the Security Token Validity Duration.
6.2. Configuring the Security Token Validity Duration
When performing unattended and PXE-less provisioning, as a security measure, Foreman automatically generates a unique token and adds this token to the OS installer recipe URL in the PXE configuration file (PXELinux, Grub2).
By default, the token is valid for 360 minutes. When you provision a host, ensure that you reboot the host within this time frame. If the token expires, it is no longer valid and you receive a 404 error and the operating system installer download fails.
To adjust the token’s duration of validity, in the Foreman web UI, navigate to Administer > Settings, and click the Provisioning tab. Find the Token duration option, and click the edit icon and edit the duration, or enter 0
to disable token generation.
If token generation is disabled, an attacker can spoof client IP address and download OS installer recipe from Foreman server, including the encrypted root password.
6.3. Creating Hosts with Unattended Provisioning
Unattended provisioning is the simplest form of host provisioning. You enter the host details on Foreman server and boot your host. Foreman server automatically manages the PXE configuration, organizes networking services, and provides the operating system and configuration for the host.
This method of provisioning hosts uses minimal interaction during the process.
To create a host with unattended provisioning, complete the following steps:
-
In the Foreman web UI, navigate to Hosts > Create Host.
-
In the Name field, enter a name for the host.
-
Click the Organization and Location tabs and change the context to match your requirements.
-
From the Host Group list, select a host group that you want to use to populate the form.
-
Click the Interface tab, and on the host’s interface, click Edit.
-
Verify that the fields are populated with values. Note in particular:
-
The Name from the Host tab becomes the DNS name.
-
Foreman server automatically assigns an IP address for the new host.
-
-
In the MAC address field, enter a MAC address for the host. This ensures the identification of the host during the PXE boot process.
-
Ensure that Foreman server automatically selects the Managed, Primary, and Provision options for the first interface on the host. If not, select them.
-
In the MAC address field, enter a MAC address of the host’s provisioning interface. This ensures the identification of the host during the PXE boot process.
-
Click OK to save. To add another interface, click Add Interface. You can select only one interface for Provision and Primary.
-
Click the Operating System tab, and verify that all fields contain values. Confirm each aspect of the operating system.
-
Optional: Click Resolve in Provisioning template to check the new host can identify the right provisioning templates to use.
For more information about associating provisioning templates, see Creating Provisioning Templates.
-
If you use the Katello plugin, click the Parameters tab, and ensure that a parameter exists that provides an activation key. If not, add an activation key.
-
Click Submit to save the host details.
For more information about network interfaces, see Adding network interfaces.
This creates the host entry and the relevant provisioning settings. This also includes creating the necessary directories and files for PXE booting the bare metal host. If you start the physical host and set its boot mode to PXE, the host detects the DHCP service of Foreman server’s integrated Smart Proxy and starts installing the operating system from its Kickstart tree.
If you use the Katello plugin, when the installation completes, the host also registers to Foreman server using the activation key and installs the necessary configuration and management tools from the Foreman Tools repository.
Create the host with the hammer host create
command.
# hammer host create --name "My_Unattended_Host" --organization "My_Organization" \ --location "My_Location" --hostgroup "My_Host_Group" --mac "aa:aa:aa:aa:aa:aa" \ --build true --enabled true --managed true
Ensure the network interface options are set using the hammer host interface update
command.
# hammer host interface update --host "test1" --managed true \ --primary true --provision true
6.4. Configuring Foreman's Discovery Service
Foreman provides a method to automatically detect hosts on a network that are not in your Foreman inventory. These hosts boot the discovery image that performs hardware detection and relays this information back to Foreman server. This method creates a list of ready-to-provision hosts in Foreman server without needing to enter the MAC address of each host.
The Discovery service is enabled by default on Foreman server. However, the default setting of the global templates is to boot from the local hard drive. To use discovery you must change the default entry in the template to discovery.
![PXE mode](images/PXE-mode.png)
To use Foreman server to provide the Discovery image, install the following RPM packages:
-
tfm-rubygem-foreman_discovery
-
foreman-discovery-image
-
rubygem-smart_proxy_discovery
The tfm-rubygem-foreman_discovery
package contains the Foreman plugin to handle discovered nodes, connections, and necessary database structures, and API.
The foreman-discovery-image
package installs the Discovery ISO to the /usr/share/foreman-discovery-image/
directory and also creates a PXE boot image from this ISO using the livecd-iso-to-pxeboot
tool. The tool saves this PXE boot image in the /var/lib/tftpboot/boot
directory.
The rubygem-smart_proxy_discovery
package configures a Smart Proxy server, such as Foreman server’s integrated Smart Proxy, to act as a proxy for the Discovery service.
When the installation completes, you can view the new menu option by navigating to Hosts > Discovered Hosts.
6.4.1. Enabling Discovery service on a Smart Proxy server
Complete the following procedure to enable the Discovery service on a Smart Proxy server.
-
Enter the following commands on the Smart Proxy server:
# yum install foreman-discovery-image rubygem-smart_proxy_discovery
# foreman-maintain service restart
-
In the Foreman web UI, navigate to Infrastructure > Smart Proxy.
-
Click the Smart Proxy server and select Refresh from the Actions list. Locate Discovery in the list of features to confirm the Discovery service is now running.
All subnets with discoverable hosts require an appropriate Smart Proxy server selected to provide the Discovery service.
To check this, navigate to Infrastructure > Smart Proxies and verify if the Smart Proxy server that you want to use lists the Discovery feature. If not, click Refresh features.
In the Foreman web UI, navigate to Infrastructure > Subnets, select a subnet, click the Smart Proxies tab, and select the Discovery Proxy that you want to use. Perform this for each appropriate subnet.
6.4.2. Provisioning Template PXELinux Discovery Snippet
For BIOS provisioning, the PXELinux global default
template in the Hosts > Provisioning Templates window contains the snippet pxelinux_discovery
. The snippet has the following lines:
LABEL discovery MENU LABEL Foreman Discovery Image KERNEL boot/fdi-image/vmlinuz0 APPEND initrd=boot/fdi-image/initrd0.img rootflags=loop root=live:/fdi.iso rootfstype=auto ro rd.live.image acpi=force rd.luks=0 rd.md=0 rd.dm=0 rd.lvm=0 rd.bootif=0 rd.neednet=0 nomodeset proxy.url=<%= foreman_server_url %> proxy.type=foreman IPAPPEND 2
The KERNEL
and APPEND
options boot the Discovery image and ramdisk. The APPEND
option contains a proxy.url
parameter, with the foreman_server_url
macro as its argument. This macro resolves to the full URL of Foreman server.
For UEFI provisioning, the PXEgrub2 global default
template in the Hosts > Provisioning Templates window contains the snippet pxegrub2_discovery
:
menuentry 'Foreman Discovery Image' --id discovery { linuxefi boot/fdi-image/vmlinuz0 rootflags=loop root=live:/fdi.iso rootfstype=auto ro rd.live.image acpi=force rd.luks=0 rd.md=0 rd.dm=0 rd.lvm=0 rd.bootif=0 rd.neednet=0 nomodeset proxy.url=<%= foreman_server_url %> proxy.type=foreman BOOTIF=01-$mac initrdefi boot/fdi-image/initrd0.img }
To use a Smart Proxy to proxy the discovery steps, edit /var/lib/tftpboot/pxelinux.cfg/default
or /var/lib/tftpboot/grub2/grub.cfg
and change the URL to the FQDN of the Smart Proxy server you want to use.
The global template is available on Foreman server and all Smart Proxies that have the TFTP feature enabled.
6.4.3. Changing Templates and Snippets
To use a template, in the Foreman web UI, navigate to Administer > Settings and click the Provisioning tab and set the templates that you want to use.
Templates and snippets are locked to prevent changes. If you want to edit a template or snippet, clone it, save it with a unique name, and then edit the clone.
When you change the template or a snippet it includes, the changes must be propagated to Foreman server’s default PXE template. Navigate to Hosts > Provisioning Templates and click Build PXE Default. This refreshes the default PXE template on Foreman server.
During the Foreman installation process, if you use the default option --enable-foreman-plugin-discovery
, you can edit the proxy.url
argument in the template to set the URL of Smart Proxy server that provides the discovery service. You can change the proxy.url
argument to the IP address or FQDN of another provisioning Smart Proxy that you want to use, but ensure that you append the port number, for example, 9090
.
If you use an alternative port number with the --foreman-proxy-ssl-port
option during Foreman installation, you must add that port number. You can also edit the proxy.url
argument to use a Foreman IP address or FQDN so that the discovered hosts communicate directly with Foreman server.
If you use a Smart Proxy server FQDN for the proxy.url
argument, ensure that you set the proxy.type
argument to proxy
. If you use a Foreman FQDN, update the proxy.type
argument to foreman
.
proxy.url=https://smartproxy.example.com:8443 proxy.type=proxy
Note
|
For katello scenario deployment, use port 9090. |
Foreman deploys the same template to all TFTP Smart Proxies and there is no variable or macro available to render the Smart Proxy’s host name. The hard-coded proxy.url
does not not work with two or more TFTP Smart Proxies. As a workaround, every time you click Build PXE Defaults, edit the configuration file in the TFTP directory using SSH, or use a common DNS alias for appropriate subnets.
For both BIOS and UEFI, to set the Discovery service as the default service that boots for hosts that are not present in your current Foreman inventory, complete the following steps:
-
In the Foreman web UI, navigate to Administer > Settings and click the Provisioning tab.
-
For the Default PXE global template entry, in the Value column, enter
discovery
.
If you want to use tagged VLAN provisioning, and you want the discovery service to send a discovery request, add the following information to the KERNEL
option in the discovery template:
fdi.vlan.primary=example_VLAN_ID
Test the Discovery service and boot a blank bare metal host on the 192.168.140.0/24 network. A boot menu has two options:
-
local
, which boots from the hard disk -
discovery
, which boots to the Discovery service
Select discovery
to boot the Discovery image. After a few minutes, the Discovery image completes booting and a status screen is displayed.
In the Foreman web UI, navigate to Hosts > Discovered hosts and view the newly discovered host. The discovered hosts automatically define their host name based on their MAC address. For example, Foreman sets a discovered host with a MAC address of ab:cd:ef:12:34:56 to have macabcdef123456
as the host name. You can change this host name when provisioning the host.
6.4.4. Automatic Contexts for Discovered Hosts
Foreman server assigns organization and location to discovered hosts according to the following sequence of rules:
-
If a discovered host uses a subnet defined in Foreman, the host uses the first organization and location associated with the subnet.
-
If the
discovery_organization
ordiscovery_location
fact values are set, the discovered host uses these fact values as an organization and location. To set these fact values, navigate to Administer > Settings > Discovered, and add these facts to the Default organization and Default location fields. Ensure that the discovered host’s subnet also belongs to the organization and location set by the fact, otherwise Foreman refuses to set it for security reasons. -
If none of the previous conditions exists, Foreman assigns the first Organization and Location ordered by name.
You can change the organization or location using the bulk actions menu of the Discovered hosts page. Select the discovered hosts to modify and select Assign Organization or Assign Location from the Select Action menu.
Note that the foreman_organization
and foreman_location
facts are no longer valid values for assigning context for discovered hosts. You still can use these facts to configure the host for Puppet runs. To do this, navigate to Administer > Settings > Puppet section and add the foreman_organization
and foreman_location
facts to the Default organization and Default location fields.
6.5. Creating Hosts from Discovered Hosts
Provisioning discovered hosts follows a provisioning process that is similar to PXE provisioning. The main difference is that instead of manually entering the host’s MAC address, you can select the host to provision from the list of discovered hosts.
To create a host from a discovered host, complete the following steps:
-
In the Foreman web UI, navigate to Hosts > Discovered host. Select the host you want to use and click Provision to the right of the list.
-
Select from one of the two following options:
-
To provision a host from a host group, select a host group, organization, and location, and then click Create Host.
-
To provision a host with further customization, click Customize Host and enter the additional details you want to specify for the new host.
-
-
Verify that the fields are populated with values. Note in particular:
-
The Name from the Host tab becomes the DNS name.
-
Foreman server automatically assigns an IP address for the new host.
-
Foreman server automatically populates the MAC address from the Discovery results.
-
-
Ensure that Foreman server automatically selects the Managed, Primary, and Provision options for the first interface on the host. If not, select them.
-
Click the Operating System tab, and verify that all fields contain values. Confirm each aspect of the operating system.
-
Click Resolve in Provisioning template to check the new host can identify the right provisioning templates to use.
For more information about associating provisioning templates, see Creating Provisioning Templates.
-
Click Submit to save the host details.
When the host provisioning is complete, the discovered host becomes a content host. To view the host, navigate to Hosts > Content Hosts.
-
Identify the discovered host to use for provisioning:
# hammer discovery list
-
Select a host and provision it using a host group. Set a new host name with the
--new-name
option:# hammer discovery provision --name "host_name" \ --new-name "new_host_name" --organization "My_Organization" \ --location "My_Location" --hostgroup "My_Host_Group" --build true \ --enabled true --managed true
This removes the host from the discovered host listing and creates a host entry with the provisioning settings. The Discovery image automatically resets the host so that it can boot to PXE. The host detects the DHCP service on Foreman server’s integrated Smart Proxy and starts installing the operating system. The rest of the process is identical to normal PXE workflow described in Creating Hosts with Unattended Provisioning.
6.6. Creating Discovery Rules
As a method of automating the provisioning process for discovered hosts, Foreman provides a feature to create discovery rules. These rules define how discovered hosts automatically provision themselves, based on the assigned host group. For example, you can automatically provision hosts with a high CPU count as hypervisors. Likewise, you can provision hosts with large hard disks as storage servers.
Auto provisioning does not currently allow configuring NICs; all systems are being provisioned with the NIC configuration that was detected during discovery. However, you can set the NIC in OS installer recipe (scriplet), via script, or using configuration management later on.
To create a rule, complete the following steps:
-
In the Foreman web UI, navigate to Configure > Discovery rules. Select Create Rule and enter the following details:
-
In the Name field, enter a name for the rule.
-
In the Search field, enter the rules to determine whether to provision a host. This field provides suggestions for values you enter and allows operators for multiple rules. For example:
cpu_count > 8
. -
From the Host Group list, select the host group to use as a template for this host.
-
In the Hostname field, enter the pattern to determine host names for multiple hosts. This uses the same ERB syntax that provisioning templates use. The host name can use the
@host
attribute for host-specific values and therand
function for a random number.-
myhost-<%= rand(99999) %>
-
abc-<%= @host.facts['bios_vendor'] %>-<%= rand(99999) %>
-
xyz-<%= @host.hostgroup.name %>
-
srv-<%= @host.discovery_rule.name %>
-
server-<%= @host.ip.gsub('.','-') + '-' + @host.hostgroup.subnet.name %>
When creating host name patterns, ensure the resulting host names are unique, do not start with numbers, and do not contain underscores or dots. A good approach is to use unique information provided by Facter, such as the MAC address, BIOS, or serial ID.
-
-
In the Hosts limit field, enter the maximum hosts you can provision with the rule. Enter
0
for unlimited. -
In the Priority field, enter a number to set the precedence the rule has over other rules. Rules with lower values have a higher priority.
-
From the Enabled list, select whether you want to enable the rule.
-
To set a different provisioning context for the rule, click the Organizations and Locations tabs and select the contexts you want to use.
-
Click Submit to save your rule.
-
Navigate to Hosts > Discovered Host and select one of the following two options:
-
From the Discovered hosts list on the right, select Auto-Provision to automatically provisions a single host.
-
On the upper right of the window, click Auto-Provision All to automatically provisions all hosts.
-
Create the rule with the hammer discovery-rule create
command:
# hammer discovery-rule create --name "Hypervisor" \ --search "cpu_count > 8" --hostgroup "My_Host_Group" \ --hostname "hypervisor-<%= rand(99999) %>" \ --hosts-limit 5 --priority 5 --enabled true
Automatically provision a host with the hammer discovery auto-provision
command:
# hammer discovery auto-provision --name "macabcdef123456"
6.7. Creating Hosts with PXE-less Provisioning
Some hardware does not provide a PXE boot interface. Foreman provides a PXE-less discovery service that operates without PXE-based services, such as DHCP and TFTP. In Foreman, you can provision a host without PXE boot. This is also known as PXE-less provisioning and involves generating a boot ISO that hosts can use. Using this ISO, the host can connect to Foreman server, boot the installation media, and install the operating system.
There are four types of boot ISOs:
Host image - A boot ISO for the specific host. This image contains only the boot files that are necessary to access the installation media on Foreman server. The user defines the subnet data in Foreman and the image is created with static networking.
Full host image - A boot ISO that contains the kernel and initial RAM disk image for the specific host. This image is useful if the host fails to chainload correctly. The provisioning template still downloads from Foreman server.
Generic image - A boot ISO that is not associated with a specific host. The ISO sends the host’s MAC address to Foreman server, which matches it against the host entry. The image does not store IP address details, and requires access to a DHCP server on the network to bootstrap. This image is also available from the /bootdisk/disks/generic
URL on your Foreman server, for example, https://foreman.example.com/bootdisk/disks/generic
.
Subnet image - A boot ISO that is similar to the generic image but is configured with the address of a Smart Proxy server. This image is generic to all hosts with a provisioning NIC on the same subnet.
Host image and Full host image contain provisioning token, therefore the generated image has limited lifespan. For more information about configuring security tokens, read Configuring the Security Token Validity Duration.
Note
|
The Full host image is based on SYSLINUX and works with most hardware. When using a Host image, Generic image, or Subnet image, see http://ipxe.org/appnote/hardware_drivers for a list of hardware drivers expected to work with an iPXE-based boot disk. |
To create a host with PXE-less provisioning, complete the following steps:
-
In the Foreman web UI, navigate to Hosts > Create Host.
-
In the Name field, enter a name that you want to become the provisioned system’s host name.
-
Click the Organization and Location tabs and change the context to match your requirements.
-
From the Host Group list, select a host group that you want to use to populate the form.
-
Click the Interface tab, and on the host’s interface, click Edit.
-
Verify that the fields are populated with values. Note in particular:
-
The Name from the Host tab becomes the DNS name.
-
Foreman server automatically assigns an IP address for the new host.
-
-
In the MAC address field, enter a MAC address for the host.
-
Ensure that Foreman server automatically selects the Managed, Primary, and Provision options for the first interface on the host. If not, select them.
-
Click the Operating System tab, and verify that all fields contain values. Confirm each aspect of the operating system.
-
Click Resolve in Provisioning template to check the new host can identify the right provisioning templates to use.
For more information about associating provisioning templates, see Creating Provisioning Templates.
-
If you use the Katello plugin, click the Parameters tab, and ensure that a parameter exists that provides an activation key. If not, add an activation key.
-
Click Submit to save the host details.
This creates a host entry and the host details page appears.
The options on the upper-right of the window are the Boot disk menu. From this menu, one of the following images is available for download: Host image, Full host image, Generic image, and Subnet image.
Create the host with the hammer host create
command.
# hammer host create --name "My_Bare_Metal" --organization "My_Organization" \ --location "My_Location" --hostgroup "My_Host_Group" --mac "aa:aa:aa:aa:aa:aa" \ --build true --enabled true --managed true
Ensure that your network interface options are set using the hammer host interface update
command.
# hammer host interface update --host "test3" --managed true \ --primary true --provision true
Download the boot disk from Foreman server with the hammer bootdisk host
command:
-
For Host image:
# hammer bootdisk host --host test3.example.com
-
For Full host image:
# hammer bootdisk host --host test3.example.com --full true
-
For Generic image:
# hammer bootdisk generic
-
For Subnet image:
# hammer bootdisk subnet --subnet subnetName
This creates a boot ISO for your host to use.
Write the ISO to a USB storage device using the dd utility or livecd-tools if required.
When you start the physical host and boot from the ISO or the USB storage device, the host connects to Foreman server and starts installing operating system from its kickstart tree.
6.8. Implementing PXE-less Discovery
Foreman provides a PXE-less Discovery service that operates without the need for PXE-based services (DHCP and TFTP). You accomplish this using Foreman server’s Discovery image. Once a discovered node is scheduled for installation, it uses kexec
command to reload Linux kernel with OS installer without rebooting the node.
![PXEless mode](images/PXEless-mode.png)
If you have not yet installed the Discovery service or image, follow the "Installation" section in Configuring Foreman's Discovery Service.
The ISO for the Discovery service resides at /usr/share/foreman-discovery-image/
and is installed using the foreman-discovery-image
package.
This ISO acts as bootable media. Copy this media to either a CD, DVD, or a USB stick. For example, to copy to a USB stick at /dev/sdb
:
# dd bs=4M \ if=/usr/share/foreman-discovery-image/foreman-discovery-image-3.4.4-5.iso \ of=/dev/sdb
Insert the Discovery boot media into a bare metal host, start the host, and boot from the media. The Discovery Image displays an option for either Manual network setup or Discovery with DHCP:
-
If selecting Manual network setup, the Discovery image requests a set of network options. This includes the primary network interface that connects to Foreman server. This Discovery image also asks for network interface configuration options, such as an IPv4 Address, IPv4 Gateway, and an IPv4 DNS server.
After entering these details, select Next.
-
If selecting Discovery with DHCP, the Discovery image requests only the primary network interface that connects to Foreman server. It attempts to automatically configure the network interface using a DHCP server, such as one that a Smart Proxy server provides.
After the primary interface configuration, the Discovery image requests the Server URL, which is the URL of Foreman server or Smart Proxy server offering the Discovery service. For example, to use the integrated Smart Proxy on Foreman server, use the following URL:
Set the Connection type to Proxy
, then select Next.
The Discovery image also provides a set of fields to input Custom facts for the Facter tool to relay back to Foreman server. These are entered in a name-value format. Provide any custom facts you require and select Confirm to continue.
The Foreman reports a successful communication with Foreman server’s Discovery service. Navigate to Hosts > Discovered Hosts and view the newly discovered host.
For more information about provisioning discovered hosts, see Creating Hosts from Discovered Hosts.
It is possible to create a customized Discovery ISO, which automates the process of configuring the image after booting. The Discovery image uses a Linux kernel for the operating system, which means you pass kernel parameters to the configure the image’s operating system. These kernel parameters include:
- proxy.url
-
The URL of the Smart Proxy server providing the Discovery service.
- proxy.type
-
The proxy type. This is usually set to
proxy
to connect to Smart Proxy server. This parameter also supports a legacyforeman
option, where communication goes directly to Foreman server instead of a Smart Proxy server. - fdi.pxmac
-
The MAC address of the primary interface in the format of
AA:BB:CC:DD:EE:FF
. This is the interface you aim to use for communicating with Smart Proxy server. In automated mode, the first NIC (using network identifiers in alphabetical order) with a link is used. In semi-automated mode, a screen appears and requests you to select the correct interface. - fdi.pxip, fdi.pxgw, fdi.pxdns
-
Manually configures IP address (
fdi.pxip
), the gateway (fdi.pxgw
), and the DNS (fdi.pxdns
) for the primary network interface. If your omit these parameters, the image uses DHCP to configure the network interface. - fdi.pxfactname1, fdi.pxfactname2 … fdi.pxfactnameN
-
Allows you to specify custom fact names.
- fdi.pxfactvalue1, fdi.pxfactvalue2 … fdi.pxfactvalueN
-
The values for each custom fact. Each value corresponds to a fact name. For example,
fdi.pxfactvalue1
sets the value for the fact named withfdi.pxfactname1
. - fdi.pxauto
-
To set automatic or semi-automatic mode. If set to 0, the image uses semi-automatic mode, which allows you to confirm your choices through a set of dialog options. If set to 1, the image uses automatic mode and proceeds without any confirmation.
Foreman server also provides a tool (discovery-remaster
) in the foreman-discovery-image
package. This tool remasters the image to include these kernel parameters. To remaster the image, run the discovery-remaster
tool. For example:
# discovery-remaster ~/iso/foreman-discovery-image-3.4.4-5.iso \ "fdi.pxip=192.168.140.20/24 fdi.pxgw=192.168.140.1 \ fdi.pxdns=192.168.140.2 proxy.url=https://foreman.example.com:8443 \ proxy.type=proxy fdi.pxfactname1=customhostname \ fdi.pxfactvalue1=myhost fdi.pxmac=52:54:00:be:8e:8c fdi.pxauto=1"
The tool creates a new ISO file in the same directory as the original discovery image. In this scenario, it saves in the /usr/share/foreman-discovery-image/
directory.
Copy this media to either a CD, DVD, or a USB stick. For example, to copy to a USB stick at /dev/sdb
:
# dd bs=4M \ if=/usr/share/foreman-discovery-image/foreman-discovery-image-3.4.4-5.iso \ of=/dev/sdb
Insert the Discovery boot media into a bare metal host, start the host, and boot from the media.
For more information about provisioning discovered hosts, see Creating Hosts from Discovered Hosts.
The host needs to resolve to the following provisioning templates:
-
kexec Template:
Discovery Red Hat kexec
-
provision Template:
Foreman Kickstart Default
For more information about associating provisioning templates, see Creating Provisioning Templates.
6.9. Deploying SSH Keys during Provisioning
Use this procedure to deploy SSH keys added to a user during provisioning. For information on adding SSH keys to a user, see Adding SSH Keys to a User in Administering Foreman.
To deploy SSH keys during provisioning, complete the following steps:
-
In the Foreman web UI, navigate to Hosts > Provisioning Templates.
-
Create a provisioning template, or clone and edit an existing template. For more information, see Creating Provisioning Templates.
-
In the template, click the Template tab.
-
In the Template editor field, add the
create_users
snippet to the%post
section:<%= snippet('create_users') %>
-
Select the Default check box.
-
Click the Association tab.
-
From the Application Operating Systems list, select an operating system.
-
Click Submit to save the provisioning template.
-
Create a host that is associated with the provisioning template or rebuild a host using the OS associated with the modified template. For more information, see Creating a Host in the Managing Hosts guide.
The SSH keys of the Owned by user are added automatically when the
create_users
snippet is executed during the provisioning process. You can set Owned by to an individual user or a user group. If you set Owned by to a user group, the SSH keys of all users in the user group are added automatically.
6.10. Building a Foreman Discovery Image
Use this procedure to build a Foreman discovery image or rebuild an image if you change configuration files.
Do not use this procedure on your production Foreman or Smart Proxy.
Install the livecd-tools
package:
# yum install livecd-tools
Because Anaconda installer cannot publish through HTTPS, you must enable publishing through HTTP for Kickstart repositories:
-
In the Foreman web UI, navigate to Content > Products and in the Products window, click the Repositories tab.
-
Select a Kickstart repository and for the Publish via HTTP, option, click the Edit icon, select the check box, and click Save.
-
Repeat the previous steps for the Foreman repository.
Note that publishing via HTTP does not apply to any Red Hat repositories.
To build the Foreman discovery image, complete the following steps:
-
Open the
/usr/share/foreman-discovery-image/foreman-discovery-image.ks
file for editing:# vim /usr/share/foreman-discovery-image/foreman-discovery-image.ks
-
Replace
repo --name=rhel --baseurl=http://download/00000
with with your own repos for RHEL and Foreman with your repository URLs. To find the URLs, navigate to Content > Products and click the Repositories tab and copy the URL for both repositories into the file:repo --name=rhel --baseurl=http://download/released/RHEL-7/7.4/Server/x86_64/os/ repo --name=sat --baseurl=http://download2/nightly/Satellite/6.4/candidate/latest-Satellite-6.4-RHEL-7/compose/Satellite/x86_64/os/
-
Run the
livecd-creator
tool:# livecd-creator --title="Discovery-Image" \ --compression-type=xz \ --cache=var/cache/build-fdi \ --config /usr/share/foreman-discovery-image/foreman-discovery-image.ks \ --fslabel fdi \ --tmpdir /var/tmp
If you change
fdi
in the--fslabel
option, you must also change the root label on the kernel command line when loading the image.fdi
or the alternative name is appended to the.iso
file that is created as part of this procedure. The PXE Discovery tool uses this name when converting from.iso
to PXE.Use
/var/tmp
because this process requires close to 3GB of space and/tmp
might have problems if the system is low on swap space. -
Verify that your
fdi.iso
file is created:# ls *.iso -h
When you create the .iso
file, you can boot the .iso
file over a network or locally. Complete one of the following procedures.
-
To extract the initial ramdisk and kernel files from the
.iso
file over a network, enter the following command:# discovery-iso-to-pxe fdi.iso
-
Create a directory to store your boot files:
# mkdir /var/lib/tftpboot/boot/myimage
-
Copy the
initrd0.img
andvmlinuz0
files to your new directory. -
Edit the
KERNEL
andAPPEND
entries in the/var/lib/tftpboot/pxelinux.cfg
file to add the information about your own initial ramdisk and kernel files.
If you want to create a hybrid .iso
file for booting locally, complete the following steps:
-
To convert the
.iso
file to an.iso
hybrid file for PXE provisioning, enter the following command:# isohybrid --partok fdi.iso
If you have
grub2
packages installed, you can also use the following command to install agrub2
bootloader:# isohybrid --partok --uefi fdi.iso
-
To add
md5
checksum to the.iso
file so it can pass installation media validation tests in Foreman, enter the following command:# implantisomd5 fdi.iso
7. Provisioning Virtual Machines on a KVM Server (libvirt)
Kernel-based Virtual Machines (KVMs) use an open source virtualization daemon and API called libvirt
running on Red Hat Enterprise Linux. Foreman can connect to the libvirt
API on a KVM server, provision hosts on the hypervisor, and control certain virtualization functions.
7.1. Prerequisites for KVM Provisioning
The requirements for KVM provisioning include:
-
A Smart Proxy server managing a network on the KVM server. Ensure no other DHCP services run on this network to avoid conflicts with the Smart Proxy server. For more information about network service configuration for Smart Proxy servers, see Configuring Networking.
-
A Red Hat Enterprise Linux server running KVM virtualization tools (libvirt daemon). For more information, see the Red Hat Enterprise Linux 7 Virtualization Getting Started Guide.
-
A server running KVM virtualization tools (libvirt daemon).
-
Virtual network running on the libvirt server. Only NAT and isolated virtual networks can be managed through Foreman.
-
An existing virtual machine image if you want to use image-based provisioning. Ensure that this image exists in a storage pool on the KVM host. The
default
storage pool is usually located in/var/lib/libvirt/images
. Only directory pool storage types can be managed through Foreman. -
The installation media that you require for the operating systems you want to use to provision. If the Katello plugin is installed, you can use synchronized content repositories for Red Hat Enterprise Linux. For more information, see Synchronizing Red Hat Repositories in the Content Management Guide.
-
If the Katello plugin is installed, an activation key for host registration. For more information, see Creating An Activation Key in the Content Management guide.
To provision a Libvirt host in Foreman, you must have a user account with the following roles:
-
Edit hosts
-
View hosts
For more information, see Assigning Roles to a User in the Administering Foreman guide.
You must also create a custom role with the following permissions:
-
view_compute_resources
-
destroy_compute_resources_vms
-
power_compute_resources_vms
-
create_compute_resources_vms
-
view_compute_resources_vms
-
view_locations
-
view_subnets
For more information about creating roles, see Creating a Role. For more information about adding permissions to a role, see Adding Permissions to a Role in the Administering Foreman guide.
7.2. Configuring Foreman server for KVM Connections
Before adding the KVM connection, Foreman server requires some configuration to ensure a secure connection. This means creating an SSH key pair for the user that performs the connection, which is the foreman
user.
These examples use the root user for KVM. However, if you want to use a non-root user on the KVM server, add the user to the libvirt
group on the KVM server:
useradd -a -G libvirt non_root_user
To configure Foreman server for KVM connections, complete the following steps:
-
On Foreman server, switch to the
foreman
user:# su foreman -s /bin/bash
-
Generate the key pair:
$ ssh-keygen
-
Copy the public key to the KVM server:
$ ssh-copy-id root@kvm.example.com
-
Exit the bash shell for the
foreman
user:$ exit
-
Install the
libvirt-client
package:# yum install libvirt-client
-
Use the following command to test the connection to the KVM server:
# su foreman -s /bin/bash -c 'virsh -c qemu+ssh://root@kvm.example.com/system list'
When you add the KVM connection in Foreman server, use the
qemu+ssh
protocol and the address to the server. For example:qemu+ssh://root@kvm.example.com/system
7.3. Adding a KVM Connection to Foreman server
Use this procedure to add a KVM connection to Foreman server’s compute resources.
To add a KVM connection to Foreman, complete the following steps:
-
In the Foreman web UI, navigate to Infrastructure > Compute Resources, and in the Compute Resources window, click Create Compute Resource.
-
In the Name field, enter a name for the new compute resource.
-
From the Provider list, select Libvirt
-
In the Description field, enter a description for the compute resource.
-
In the URL field, enter the connection URL to the KVM server. For example:
qemu+ssh://root@kvm.example.com/system
-
From the Display type list, select either VNC or Spice.
-
Optional: To secure console access for new hosts with a randomly generated password, select the Set a randomly generated password on the display connection check box. You can retrieve the password for the VNC console to access the guest virtual machine console from the output of the following command executed on the KVM server:
# virsh edit your_VM_name <graphics type='vnc' port='-1' autoport='yes' listen='0.0.0.0' passwd='your_randomly_generated_password'>
The password is randomly generated every time the console for the virtual machine is opened, for example, with virt-manager.
-
Click Test Connection to ensure that Foreman server connects to the KVM server without fault.
-
Verify that the Locations and Organizations tabs are automatically set to your current context. If you want, add additional contexts to these tabs.
-
Click Submit to save the KVM connection.
To create a compute resource, enter the following command:
# hammer compute-resource create --name "My_KVM_Server" \ --provider "Libvirt" --description "KVM server at kvm.example.com" \ --url "qemu+ssh://root@kvm.example.com/system" --locations "New York" \ --organizations "My_Organization"
7.4. Adding KVM Images to Foreman server
If you want to use image-based provisioning to create hosts, you must add information about the image to your Foreman server. This includes access details and the image location.
Note that you can manage only directory pool storage types through Foreman.
To add KVM images on Foreman server, complete the following steps:
-
In the Foreman web UI, navigate to Infrastructure > Compute Resources, and in the Compute Resources window, click the name of your KVM connection.
-
Click the Image tab, and then click Create Image.
-
In the Name field, enter a name for the image.
-
From the Operatingsystem list, select the image’s base operating system.
-
From the Architecture list, select the operating system architecture.
-
In the Username field, enter the SSH user name for image access. This is normally the
root
user. -
In the Password field, enter the SSH password for image access.
-
In the Image path field, enter the full path that points to the image on the KVM server. For example:
/var/lib/libvirt/images/TestImage.qcow2
-
Click Submit to save the image details.
Create the image with the hammer compute-resource image create
command. Use the --uuid
field to store the full path of the image location on the KVM server.
# hammer compute-resource image create --name "Test KVM Image" \ --operatingsystem "RedHat version" --architecture "x86_64" --username root \ --user-data false --uuid "/var/lib/libvirt/images/TestImage.qcow2" \ --compute-resource "My_KVM_Server"
7.5. Adding KVM Details to a Compute Profile
We can predefine certain hardware settings for KVM-based virtual machines by adding these hardware settings to a compute profile.
To add KVM details to a compute profile, complete the following steps:
-
In the Foreman web UI, navigate to Infrastructure > Compute Profiles.
-
In the Compute Profiles window, click the name of an existing compute resource or click Create Compute Profile and select a compute resource to use to create a compute profile.
-
In the CPUs field, enter the number of CPUs to allocate to the new host.
-
In the Memory field, enter the amount of memory to allocate to the new host.
-
From the Image list, select the image to use if performing image-based provisioning.
-
From the Network Interfaces list, select the network parameters for the host’s network interface. You can create multiple network interfaces. However, at least one interface must point to a Smart Proxy-managed network.
-
In the Storage area, enter the storage parameters for the host. You can create multiple volumes for the host.
-
Click Submit to save the settings to the compute profile.
-
To create a compute profile, enter the following command:
# hammer compute-profile create --name "Libvirt CP"
-
To add the values for the compute profile, enter the following command:
# hammer compute-profile values create --compute-profile "Libvirt CP" \ --compute-resource "My_KVM_Server" \ --interface "compute_type=network,compute_model=virtio,compute_network=examplenetwork" \ --volume "pool_name=default,capacity=20G,format_type=qcow2" \ --compute-attributes "cpus=1,memory=1073741824"
7.6. Creating Hosts on a KVM Server
In Foreman, you can use KVM provisioning to create hosts over a network connection and from an existing image.
If you want to create a host over a network connection, the new host must have access either to Foreman server’s integrated Smart Proxy or an external Smart Proxy server on a KVM virtual network, so that the host has access to PXE provisioning services. This new host entry triggers the KVM server to create and start a virtual machine. If the virtual machine detects the defined Smart Proxy server through the virtual network, the virtual machine boots to PXE and begins to install the chosen operating system.
If you create a host with an existing image, the new host entry triggers the KVM server to create the virtual machine, using the pre-existing image as a basis for the new volume.
For network-based provisioning, if you use a virtual network on the KVM server for provisioning, select a network that does not provide DHCP assignments. This causes DHCP conflicts with Foreman server when booting new hosts.
To create a KVM host, complete the following steps:
-
In the Foreman web UI, navigate to Hosts > Create Host.
-
In the Name field, enter the name that you want to become the provisioned system’s host name.
-
Click the Organization and Location tabs to ensure that the provisioning context is automatically set to the current context.
-
From the Host Group list, select the host group that you want to use to populate the form.
-
From the Deploy on list, select the KVM connection.
-
From the Compute Profile list, select a profile to use to automatically populate virtual machine-based settings.
-
Click the Interface tab and click Edit on the host’s interface.
-
Verify that the fields are automatically populated with values. Note in particular:
-
The Name from the Host tab becomes the DNS name.
-
Foreman server automatically assigns an IP address for the new host.
-
-
Ensure that the MAC address field is blank. The KVM server assigns one to the host.
-
Verify that the Managed, Primary, and Provision options are automatically selected for the first interface on the host. If not, select them.
-
In the interface window, review the KVM-specific fields that are populated with settings from your compute profile. Modify these settings to suit your needs.
-
Click the Operating System tab, and confirm that all fields automatically contain values.
-
For network-based provisioning, ensure that the Provisioning Method is set to
Network Based
. For image-based provisioning, ensure that the Provisioning Method is set toImage Based
-
Click Resolve in Provisioning templates to check the new host can identify the right provisioning templates to use.
-
Click the Virtual Machine tab and confirm that these settings are populated with details from the host group and compute profile. Modify these settings to suit your needs.
-
If you use the Katello plugin, click the Parameters tab, and ensure that a parameter exists that provides an activation key. If not, add an activation key.
-
Click Submit to save the host entry.
Create the host with the hammer host create
command and include --provision-method build
to use network-based provisioning.
# hammer host create --name "kvm-test1" --organization "My_Organization" \ --location "New York" --hostgroup "Base" \ --compute-resource "My_KVM_Server" --provision-method build \ --build true --enabled true --managed true \ --interface "managed=true,primary=true,provision=true,compute_type=network,compute_network=examplenetwork" \ --compute-attributes="cpus=1,memory=1073741824" \ --volume="pool_name=default,capacity=20G,format_type=qcow2" \ --root-password "password"
Create the host with the hammer host create
command and include --provision-method image
to use image-based provisioning.
# hammer host create --name "kvm-test2" --organization "My_Organization" \ --location "New York" --hostgroup "Base" \ --compute-resource "My_KVM_Server" --provision-method image \ --image "Test KVM Image" --enabled true --managed true \ --interface "managed=true,primary=true,provision=true,compute_type=network,compute_network=examplenetwork" \ --compute-attributes="cpus=1,memory=1073741824" \ --volume="pool_name=default,capacity=20G,format_type=qcow2"
For more information about additional host creation parameters for this compute resource, see Additional Host Parameters for Hammer CLI.
8. Provisioning Virtual Machines in oVirt
oVirt is an enterprise-grade server and desktop virtualization platform built on Red Hat compatible system.
With Foreman, you can manage virtualization functions through oVirt’s REST API version 3. REST API version 4 is not yet supported by Foreman. This includes creating virtual machines and controlling their power states.
Use the following procedures to add a connection to a oVirt environment and provision a virtual machine.
8.1. Prerequisites for oVirt Provisioning
The requirements for oVirt provisioning include:
-
A Smart Proxy server managing a logical network on the oVirt environment. Ensure no other DHCP services run on this network to avoid conflicts with the Smart Proxy server. For more information, see Configuring Networking.
-
An existing template, other than the
blank
template, if you want to use image-based provisioning. For more information about creating templates for virtual machines, see Templates in the Virtual Machine Management Guide. -
The installation media that you require for the operating systems you want to use to provision. If the Katello plugin is installed, you can use synchronized content repositories for Red Hat Enterprise Linux. For more information, see Synchronizing Red Hat Repositories in the Content Management Guide.
-
If the Katello plugin is installed, an activation key for host registration. For more information, see Creating An Activation Key in the Content Management guide.
8.2. Creating a oVirt User
The oVirt server requires an administration-like user for Foreman server communication. For security reasons, Foreman developers advises against using the admin@internal
user for such communication. Instead, create a new oVirt user with the following permissions:
-
System
-
Configure System
-
Login Permissions
-
-
-
Network
-
Configure vNIC Profile
-
Create
-
Edit Properties
-
Delete
-
Assign vNIC Profile to VM
-
Assign vNIC Profile to Template
-
-
-
Template
-
Provisioning Operations
-
Import/Export
-
-
-
VM
-
Provisioning Operations
-
Create
-
Delete
-
Import/Export
-
Edit Storage
-
-
-
Disk
-
Provisioning Operations
-
Create
-
-
Disk Profile
-
Attach Disk Profile
-
-
For more information about how to create a user and add permissions in oVirt, see Users and Roles in the oVirt documentation.
8.3. Adding a oVirt Connection to Foreman server
Use this procedure to add a oVirt connection to Foreman server’s compute resources.
To add a oVirt connection to Foreman, complete the following steps:
-
In the Foreman web UI, navigate to Infrastructure > Compute Resources, and in the Compute Resources window, click Create Compute Resource.
-
In the Name field, enter a name for the new compute resource.
-
From the Provider list, select oVirt.
-
In the Description field, enter a description for the compute resource.
-
In the URL field, enter the connection URL for the oVirt Manager’s API.
For example, in oVirt 3.6 and earlier, the URL is of the following form:
https://ovirt.example.com/ovirt-engine/api
. In oVirt 4.0 and later, the URL is of the following form:https://ovirt.example.com/ovirt-engine/api/v3
. -
Optionally, select the Use APIv4 (experimental) check box to evaluate the new engine API.
-
In the User field, enter the name of a user with permissions to access oVirt Manager’s resources.
-
In the Password field, enter the password of the user.
-
Click Load Datacenters to populate the Datacenter list with data centers from your oVirt environment.
-
From the Datacenter list, select a data center.
-
From the Quota ID list, select a quota to limit resources available to Foreman.
-
In the X509 Certification Authorities field, enter the certificate authority for SSL/TLS access. Alternatively, if you leave the field blank, a self-signed certificate is generated on the first API request by the server.
-
Click the Locations tab and select the location you want to use.
-
Click the Organizations tab and select the organization you want to use.
-
Click Submit to save the compute resource.
To create a oVirt connection, enter the hammer compute-resource create
command with Ovirt
for --provider
and the name of the data center you want to use for --datacenter
.
# hammer compute-resource create \ --name "MyoVirt_" --provider "Ovirt" \ --description "oVirt server at ovirt.example.com" \ --url "https://ovirt.example.com/ovirt-engine/api" \ --use-v4 "false" --user "Satellite_User" \ --password "My_Password" \ --locations "New York" --organizations "My_Organization" \ --datacenter "My_Datacenter"
Optionally, to evaluate the new engine API, change false
to true
for the --use-v4
option.
8.4. Adding oVirt Images to Foreman server
oVirt uses templates as images for creating virtual machines. If you use image-based provisioning to create hosts, you must add oVirt template details to your Foreman server. This includes access details and the template name.
To add oVirt images on Foreman server, complete the following steps:
-
In the Foreman web UI, navigate to Infrastructure > Compute Resources, and in the Compute Resources window, click the name of your oVirt connection.
-
Click the Image tab, and then click New Image.
-
In the Name field, enter a name for the image.
-
From the Operatingsystem list, select the image’s base operating system.
-
From the Architecture list, select the operating system architecture.
-
In the Username field, enter the SSH user name for image access. This is normally the
root
user. -
In the Password field, enter the SSH password for image access.
-
From the Image list, select the name of the image on oVirt.
-
Click Submit to save the image details.
Create the image with the hammer compute-resource image create
command. Use the --uuid
option to store the template UUID on the oVirt server.
# hammer compute-resource image create --name "TestoVirt_Image_" \ --operatingsystem "RedHat 7.2" --architecture "x86_64" --username root \ --uuid "9788910c-4030-4ae0-bad7-603375dd72b1" \ --compute-resource "MyoVirt_"
8.5. Adding oVirt Details to a Compute Profile
You can predefine certain hardware settings for virtual machines on oVirt. You achieve this through adding these hardware settings to a compute profile.
To add oVirt details to a compute profile, complete the following steps:
-
In the Foreman web UI, navigate to Infrastructure > Compute Profiles and in the Compute Profiles window, click the name of the oVirt connection.
-
From the Cluster list, select the target host cluster in the oVirt environment.
-
From the Template list, select the oVirt template to use for the Cores and Memory settings.
-
In the Cores field, enter the number of CPU cores to allocate to the new host.
-
In the Memory field, enter the amount of memory to allocate to the new host.
-
From the Image list, select image to use for image-based provisioning.
-
In the Network Interfaces area, enter the network parameters for the host’s network interface. You can create multiple network interfaces. However, at least one interface must point to a Smart Proxy-managed network. For each network interface, enter the following details:
-
In the Name field, enter the name of the network interface.
-
From the Network list, select The logical network that you want to use.
-
-
In the Storage area, enter the storage parameters for the host. You can create multiple volumes for the host. For each volume, enter the following details:
-
In the Size (GB) enter the size, in GB, for the new volume.
-
From the Storage domain list, select the storage domain for the volume.
-
From the Preallocate disk, select either thin provisioning or preallocation of the full disk.
-
From the Bootable list, select whether you want a bootable or non bootable volume.
-
-
Click Submit to save the compute profile.
-
To create a compute profile, enter the following command:
# hammer compute-profile create --name "oVirt CP"
-
To set the values for the compute profile, enter the following command:
# hammer compute-profile values create --compute-profile "oVirt CP" \ --compute-resource "MyoVirt_" \ --interface "compute_interface=Interface_Type,compute_name=eth0,compute_network=satnetwork" \ --volume "size_gb=20G,storage_domain=Data,bootable=true" \ --compute-attributes "cluster=Default,cores=1,memory=1073741824,start=true""
8.6. Creating Network-Based Hosts on a oVirt Server
In Foreman, you can create oVirt hosts over a network connection or from an existing image.
To create a host over a network, the new host must have access to either Foreman server’s integrated Smart Proxy or an external Smart Proxy server on a oVirt virtual network, so that the host has access to PXE provisioning services. The new host entry triggers the oVirt server to create the virtual machine. If the virtual machine detects the defined Smart Proxy server through the virtual network, the virtual machine boots to PXE and begins to install the chosen operating system.
If you use a virtual network on the oVirt server for provisioning, ensure to select one that does not provide DHCP assignments. This causes DHCP conflicts with Foreman server when booting new hosts.
When you create a host with an existing image, the new host entry triggers the oVirt server to create the virtual machine, using the pre-existing image as a basis for the new volume.
To create a host for oVirt Server, complete the following steps:
-
In the Foreman web UI, navigate to Hosts > New Host.
-
In the Name field, enter the name that you want to become the provisioned system’s host name.
-
Click the Organization and Location tabs to ensure that the provisioning context is automatically set to the current context.
-
From the Host Group list, select the host group that you want to use to populate the form.
-
From the Deploy on list, select the oVirt connection.
-
From the Compute Profile list, select a profile to use to automatically populate virtual machine-based settings.
-
Click the Interface tab and click Edit on the host’s interface.
-
Verify that the fields are automatically populated with values. Note in particular:
-
The Name from the Host tab becomes the DNS name.
-
Foreman server automatically assigns an IP address for the new host.
-
-
Ensure that the MAC address field is blank. The oVirt server assigns one to the host.
-
Verify that the Managed, Primary, and Provision options are automatically selected for the first interface on the host. If not, select them.
-
In the interface window, ensure that the oVirt-specific fields are populated with settings from the compute profile. Modify these settings to suit your needs.
-
Click the Operating System tab, and confirm that all fields automatically contain values.
-
For network-based provisioning, ensure that the Provisioning Method is set to
Network Based
. For image-based provisioning, ensure that the Provisioning Method is set toImage Based
. -
Click Resolve in Provisioning templates to check the new host can identify the right provisioning templates to use.
-
Click the Virtual Machine tab and confirm that these settings are populated with details from the host group and compute profile. Modify these settings to suit your needs.
-
If you use the Katello plugin, click the Parameters tab, and ensure that a parameter exists that provides an activation key. If not, add an activation key.
-
Click Submit to save the host entry.
To create a host with network-based provisioning, use the hammer host create
command and include --provision-method build
.
# hammer host create --name "oVirt-test1" --organization "My_Organization" \ --location "New York" --hostgroup "Base" \ --compute-resource "MyoVirt_" --provision-method build \ --build true --enabled true --managed true \ --interface "managed=true,primary=true,provision=true,compute_name=eth0,compute_network=satnetwork" \ --compute-attributes="cluster=Default,cores=1,memory=1073741824,start=true" \ --volume="size_gb=20G,storage_domain=Data,bootable=true"
To create a host with image-based provisioning, use the hammer host create
command and include --provision-method image
.
# hammer host create --name "oVirt-test2" --organization "My_Organization" \ --location "New York" --hostgroup "Base" \ --compute-resource "MyoVirt_" --provision-method image \ --image "Test_RHV_Image" --enabled true --managed true \ --interface "managed=true,primary=true,provision=true,compute_name=eth0,compute_network=satnetwork" \ --compute-attributes="cluster=Default,cores=1,memory=1073741824,start=true" \ --volume="size_gb=20G,storage_domain=Data,bootable=true"
For more information about additional host creation parameters for this compute resource, see Additional Host Parameters for Hammer CLI.
9. Provisioning Virtual Machines in VMware vSphere
VMware vSphere is an enterprise-level virtualization platform from VMware. Foreman can interact with the vSphere platform, including creating new virtual machines and controlling their power management states.
9.1. Prerequisites for VMware vSphere Provisioning
The requirements for VMware vSphere provisioning include:
-
A Smart Proxy server managing a network on the vSphere environment. Ensure no other DHCP services run on this network to avoid conflicts with the Smart Proxy server. For more information, see Configuring Networking.
-
An existing VMware template if you want to use image-based provisioning.
-
The installation media that you require for the operating systems you want to use to provision. If the Katello plugin is installed, you can use synchronized content repositories for Red Hat Enterprise Linux. For more information, see Synchronizing Red Hat Repositories in the Content Management Guide.
-
If the Katello plugin is installed, an activation key for host registration. For more information, see Creating An Activation Key in the Content Management guide.
9.2. Creating a VMware vSphere User
The VMware vSphere server requires an administration-like user for Foreman server communication. For security reasons, do not use the administrator
user for such communication. Instead, create a user with the following permissions:
For VMware vCenter Server version 6.7, set the following permissions:
-
All Privileges → Datastore → Allocate Space, Browse datastore, Update Virtual Machine files, Low level file operations
-
All Privileges → Network → Assign Network
-
All Privileges → Resource → Assign virtual machine to resource pool
-
All Privileges → Virtual Machine → Change Config (All)
-
All Privileges → Virtual Machine → Interaction (All)
-
All Privileges → Virtual Machine → Edit Inventory (All)
-
All Privileges → Virtual Machine → Provisioning (All)
For VMware vCenter Server version 6.5, set the following permissions:
-
All Privileges → Datastore → Allocate Space, Browse datastore, Update Virtual Machine files, Low level file operations
-
All Privileges → Network → Assign Network
-
All Privileges → Resource → Assign virtual machine to resource pool
-
All Privileges → Virtual Machine → Configuration (All)
-
All Privileges → Virtual Machine → Interaction (All)
-
All Privileges → Virtual Machine → Inventory (All)
-
All Privileges → Virtual Machine → Provisioning (All)
9.3. Adding a VMware vSphere Connection to Foreman server
Use this procedure to add a VMware vSphere connection in Foreman server’s compute resources.
Ensure that the host and network-based firewalls are configured to allow Foreman to vCenter communication on TCP port 443. Verify that Foreman is able to resolve the host name of vCenter and vCenter is able to resolve Foreman server’s host name.
To add a connection, complete the following steps:
-
In the Foreman web UI, navigate to Infrastructure > Compute Resources, and in the Compute Resources window, click Create Compute Resource.
-
In the Name field, enter a name for the resource.
-
From the Provider list, select VMware.
-
In the Description field, enter a description for the resource.
-
In the VCenter/Server field, enter the IP address or host name of the vCenter server.
-
In the User field, enter the user name with permission to access the vCenter’s resources.
-
In the Password field, enter the password for the user.
-
Click Load Datacenters to populate the list of data centers from your VMware vSphere environment.
-
From the Datacenter list, select a specific data center to manage from this list.
-
In the Fingerprint field, ensure that this field is populated with the fingerprint from the data center.
-
From the Display Type list, select a console type, for example, VNC or VMRC. Note that VNC consoles are unsupported on VMware ESXi 6.5 and later.
-
Optional: In the VNC Console Passwords field, select the Set a randomly generated password on the display connection check box to secure console access for new hosts with a randomly generated password. You can retrieve the password for the VNC console to access guest virtual machine console from the
libvirtd
host from the output of the following command:# virsh edit your_VM_name <graphics type='vnc' port='-1' autoport='yes' listen='0.0.0.0' passwd='your_randomly_generated_password'>
The password randomly generates every time the console for the virtual machine opens, for example, with virt-manager.
-
From the Enable Caching list, you can select whether to enable caching of compute resources. For more information, see Caching of Compute Resources.
-
Click the Locations and Organizations tabs and verify that the values are automatically set to your current context. You can also add additional contexts.
-
Click Submit to save the connection.
Create the connection with the hammer compute-resource create
command. Select Vmware
as the --provider
and set the instance UUID of the data center as the --uuid
:
# hammer compute-resource create --name "My_vSphere" \ --provider "Vmware" \ --description "vSphere server at vsphere.example.com" \ --server "vsphere.example.com" --user "My_User" \ --password "My_Password" --locations "My_Location" --organizations "My_Organization" \ --datacenter "My_Datacenter"
9.4. Adding VMware vSphere Images to Foreman server
VMware vSphere uses templates as images for creating new virtual machines. If using image-based provisioning to create new hosts, you need to add VMware template details to your Foreman server. This includes access details and the template name.
To add an image, complete the following steps:
-
In the Foreman web UI, navigate to Infrastructure > Compute Resources and in the Compute Resources window, click the VMware vSphere connection.
-
In the Name field, enter a name for the image.
-
From the Operatingsystem list, select the image’s base operating system.
-
From the Architecture list, select the operating system architecture.
-
In the User field, enter the SSH user name for image access. This is normally the
root
user. -
In the Password field, enter the SSH password for image access.
-
From the User data list, select whether you want the images to support user data input, such as
cloud-init
data. -
In the Image field, enter the relative path and name of the template on the vSphere environment. Do not include the data center in the relative path.
-
Click Submit to save the image details.
Create the image with the hammer compute-resource image create
command. Use the --uuid
field to store the relative template path on the vSphere environment.
# hammer compute-resource image create --name "Test_vSphere_Image" \ --operatingsystem "RedHat 7.2" --architecture "x86_64" \ --username root --uuid "Templates/RHEL72" \ --compute-resource "My_vSphere"
9.5. Adding VMware vSphere Details to a Compute Profile
You can predefine certain hardware settings for virtual machines on VMware vSphere. You achieve this through adding these hardware settings to a compute profile.
To add VMware vSphere details to a compute profile, complete the following steps:
-
In the Foreman web UI, navigate to Infrastructure > Compute Profiles and, in the Compute Profiles window, click the name of the compute profile, and then click the vSphere connection.
-
In the CPUs field, enter the number of CPUs to allocate to the new host.
-
In the Cores per socket field, enter the number of cores to allocate to each CPU.
-
In the Memory field, enter the amount of memory to allocate to the new host.
-
In the Cluster field, enter the name of the target host cluster on the VMware environment.
-
From the Resource pool list, select an available resource allocations for the host.
-
In the Folder field, enter the folder to organize the host.
-
From the Guest OS list, select the operating system you want to use in VMware vSphere.
-
From the SCSI controller list, select the disk access method for the host.
-
From the Virtual H/W version list, select the underlying VMware hardware abstraction to use for virtual machines.
-
You can select the Memory hot add or CPU hot add check boxes if you want to add more resources while the virtual machine is powered.
-
From the Image list, select the image to use if performing image-based provisioning.
-
From the Network Interfaces list, select the network parameters for the host’s network interface. You can create multiple network interfaces. However, at least one interface must point to a Smart Proxy-managed network.
-
Select the Eager zero check box if you want to use eager zero thick provisioning. If unchecked, the disk uses lazy zero thick provisioning.
-
Click Submit to save the compute profile.
-
To create the compute profile, enter the following command:
# hammer compute-profile create --name "VMWare CP"
-
To add the values for the compute profile, enter the following command:
# hammer compute-profile values create --compute-profile "VMWare CP" \ --compute-resource "My_vSphere" \ --interface "compute_type=VirtualE1000,compute_network=mynetwork \ --volume "size_gb=20G,datastore=Data,name=myharddisk,thin=true" \ --compute-attributes "cpus=1,corespersocket=2,memory_mb=1024,cluster=MyCluster,path=MyVMs,start=true"
9.6. Creating Hosts on a VMware vSphere Server
The VMware vSphere provisioning process provides the option to create hosts over a network connection or using an existing image.
For network-based provisioning, you must create a host to access either Foreman server’s integrated Smart Proxy or an external Smart Proxy server on a VMware vSphere virtual network, so that the host has access to PXE provisioning services. The new host entry triggers the VMware vSphere server to create the virtual machine. If the virtual machine detects the defined Smart Proxy server through the virtual network, the virtual machine boots to PXE and begins to install the chosen operating system.
If you use a virtual network on the VMware vSphere server for provisioning, ensure that you select a virtual network that does not provide DHCP assignments. This causes DHCP conflicts with Foreman server when booting new hosts.
For image-based provisioning, use the pre-existing image as a basis for the new volume.
To create a host for a VMware vSphere server, complete the following steps:
-
In the Foreman web UI, navigate to Hosts > Create Host.
-
In the Name field, enter the name that you want to become the provisioned system’s host name.
-
Click the Organization and Location tabs to ensure that the provisioning context is automatically set to the current context.
-
From the Host Group list, select the host group that you want to use to populate the form.
-
From the Deploy on list, select the VMware vSphere connection.
-
From the Compute Profile list, select a profile to use to automatically populate virtual machine-based settings.
-
Click the Interface tab and click Edit on the host’s interface.
-
Verify that the fields are automatically populated with values. Note in particular:
-
The Name from the Host tab becomes the DNS name.
-
The Foreman server automatically assigns an IP address for the new host.
-
-
Ensure that the MAC address field is blank. The VMware vSphere server assigns one to the host.
-
Verify that the Managed, Primary, and Provision options are automatically selected for the first interface on the host. If not, select them.
-
In the interface window, review the VMware vSphere-specific fields that are populated with settings from our compute profile. Modify these settings to suit your needs.
-
Click the Operating System tab, and confirm that all fields automatically contain values.
-
Select the Provisioning Method that you want:
-
For network-based provisioning, click Network Based.
-
For image-based provisioning, click Image Based.
-
If the
foreman_bootdisk
plug-in is installed, and you want to use boot-disk provisioning, click Boot disk based.
-
-
Click Resolve in Provisioning templates to check the new host can identify the right provisioning templates to use.
-
Click the Virtual Machine tab and confirm that these settings are populated with details from the host group and compute profile. Modify these settings to suit your requirements.
-
If you use the Katello plugin, click the Parameters tab and ensure that a parameter exists that provides an activation key. If not, add an activation key.
-
Click Submit to save the host entry.
Create the host from a network with the hammer host create
command and include --provision-method build
to use network-based provisioning.
# hammer host create --name "vmware-test1" --organization "My_Organization" \ --location "New York" --hostgroup "Base" \ --compute-resource "My_vSphere" --provision-method build \ --build true --enabled true --managed true \ --interface "managed=true,primary=true,provision=true,compute_type=VirtualE1000,compute_network=mynetwork" \ --compute-attributes="cpus=1,corespersocket=2,memory_mb=1024,cluster=MyCluster,path=MyVMs,start=true" \ --volume="size_gb=20G,datastore=Data,name=myharddisk,thin=true"
Note
|
See Additional Host Parameters for Hammer CLI for more information on additional host creation parameters for this compute resource. |
Create the host from an image with the hammer host create
command and include --provision-method image
to use image-based provisioning.
# hammer host create --name "vmware-test2" --organization "My_Organization" \ --location "New York" --hostgroup "Base" \ --compute-resource "My_VMware" --provision-method image \ --image "Test VMware Image" --enabled true --managed true \ --interface "managed=true,primary=true,provision=true,compute_type=VirtualE1000,compute_network=mynetwork" \ --compute-attributes="cpus=1,corespersocket=2,memory_mb=1024,cluster=MyCluster,path=MyVMs,start=true" \ --volume="size_gb=20G,datastore=Data,name=myharddisk,thin=true"
For more information about additional host creation parameters for this compute resource, see Additional Host Parameters for Hammer CLI.
9.7. Using the VMware vSphere Cloud-init and Userdata Templates for Provisioning
You can use VMware with the Cloud-init
and Userdata
templates to insert user data into the new virtual machine, to make further VMware customization, and to enable the VMware-hosted virtual machine to call back to Foreman.
You can use the same procedures to set up a VMware compute resource within Foreman, with a few modifications to the work flow.
When you set up the compute resource and images for VMware provisioning in Foreman, the following sequence of provisioning events occur:
-
The user provisions one or more virtual machines using the Foreman web UI, API, or hammer
-
Foreman calls the VMware vCenter to clone the virtual machine template
-
Foreman
userdata
provisioning template adds customized identity information -
When provisioning completes, the
Cloud-init
provisioning template instructs the virtual machine to call back to Smart Proxy whencloud-init
runs -
VMware vCenter clones the template to the virtual machine
-
VMware vCenter applies customization for the virtual machine’s identity, including the host name, IP, and DNS
-
The virtual machine builds,
cloud-init
is invoked and calls back Foreman on port80
, which then redirects to443
Because of the cloud-init
service, the virtual machine always calls back to Foreman even if you register the virtual machine to Smart Proxy. Ensure that you configure port and firewall settings to open any necessary connections.
For more information about port and firewall requirements, see Port and Firewall Requirements in the Installation Guide.
userdata
and Cloud-init
Templates with the Operating System-
In the Foreman web UI, navigate to Hosts > Operating Systems, and select the operating system that you want to use for provisioning.
-
Click the Template tab.
-
From the Cloud-init template list, select Cloudinit default.
-
From the User data template list, select UserData open-vm-tools.
-
Click Submit to save the changes.
To prepare an image, you must first configure the settings that you require on a virtual machine that you can then save as an image to use in Foreman.
To use the cloud-init
template for provisioning, you must configure a virtual machine so that cloud-init
is installed, enabled, and configured to call back to Foreman server.
For security purposes, you must install a CA certificate to use HTTPs for all communication. This procedure includes steps to clean the virtual machine so that no unwanted information transfers to the image you use for provisioning.
If you have an image with cloud-init
, you must still follow this procedure to enable cloud-init
to communicate with Foreman because cloud-init
is disabled by default.
These instructions are for Red Hat Enterprise Linux or Fedora OS, follow similar steps for other Linux distributions.
-
On the virtual machine that you use to create the image, install
cloud-init
,open-vm-tools
, andperl
:# yum -y install cloud-init open-vm-tools perl
-
Create a configuration file for
cloud-init
:# vi /etc/cloud/cloud.cfg.d/example_cloud-init_config.cfg
-
Add the following information to the
example_cloud_init_config.cfg
file:datasource_list: [NoCloud] datasource: NoCloud: seedfrom: https://foreman.example.com/userdata/ EOF
-
Enable the CA certificates for the image:
# update-ca-trust enable
-
Download the
katello-server-ca.crt
file from Foreman server: You must have the Katello plugin installed to complete this step. For Foreman server deployments, copy the CA certificate from the Apache configuration.# wget -O /etc/pki/ca-trust/source/anchors/cloud-init-ca.crt http://foreman.example.com/pub/katello-server-ca.crt
-
To update the record of certificates, enter the following command:
# update-ca-trust extract
-
Use the following commands to clean the image:
# systemctl stop rsyslog # systemctl stop auditd # package-cleanup -oldkernels -count=1 # yum clean all
-
Use the following commands to reduce logspace, remove old logs, and truncate logs:
# logrotate -f /etc/logrotate.conf # rm -f /var/log/*-???????? /var/log/*.gz # rm -f /var/log/dmesg.old # rm -rf /var/log/anaconda # cat /dev/null > /var/log/audit/audit.log # cat /dev/null > /var/log/wtmp # cat /dev/null > /var/log/lastlog # cat /dev/null > /var/log/grubby
-
Remove
udev
hardware rules:# rm -f /etc/udev/rules.d/70*
-
Remove the
uuid
fromifcfg
scripts:# cat > /etc/sysconfig/network-scripts/ifcfg-ens192 <<EOM DEVICE=ens192 ONBOOT=yes EOM
-
Remove the SSH host keys:
# rm -f /etc/ssh/SSH_keys
-
Remove root user’s shell history:
# rm -f ~root/.bash_history # unset HISTFILE
-
Remove root user’s SSH history:
# rm -rf ~root/.ssh/known_hosts
You can now create an image from this virtual machine.
You can use the Adding VMware vSphere Images to Foreman server section to add the image to Foreman.
9.8. Caching of Compute Resources
Caching of compute resources speeds up rendering of VMware information.
9.8.1. Enabling Caching of Compute Resources
To enable or disable caching of compute resources:
-
In the Foreman web UI, navigate to Infrastructure > Compute Resources.
-
Click the Edit button to the right of the VMware server you want to update.
-
Select the Enable caching check box.
9.8.2. Refreshing the Compute Resources Cache
To refresh the cache of compute resources to update compute resources information:
-
In the Foreman web UI, navigate to Infrastructure > Compute Resources.
-
Select a VMware server you want to refresh the compute resources cache for and click the Refresh Cache button.
Use this API call to refresh the compute resources cache:
# curl -H "Accept:application/json,version=2" \ -H "Content-Type:application/json" -X PUT \ -u username:password -k \ https://foreman.example.com/api/compute_resources/compute_resource_id/refresh_cache
Use the hammer compute-resource list
command to determine the ID of the VMware server you want to refresh the compute resources cache for.
10. Provisioning Cloud Instances in OpenStack
OpenStack provides the foundation to build a private or public Infrastructure-as-a-Service (IaaS) cloud. It offers a massively scalable, fault-tolerant platform for the development of cloud-enabled workloads. In Foreman, you can interact with OpenStack REST API to create cloud instances and control their power management states.
10.1. Prerequisites for OpenStack Provisioning:
Requirements for OpenStack Provisioning include:
-
A Smart Proxy server managing a network in your OpenStack environment. For more information, see Configuring Networking.
-
An image added to OpenStack Image Storage (glance) service for image-based provisioning. For more information, see the OpenStack Instances and Images Guide.
-
The installation media that you require for the operating systems you want to use to provision. If the Katello plugin is installed, you can use synchronized content repositories for Red Hat Enterprise Linux. For more information, see Synchronizing Red Hat Repositories in the Content Management Guide.
-
If the Katello plugin is installed, an activation key for host registration. For more information, see Creating An Activation Key in the Content Management guide.
10.2. Adding a OpenStack Connection to the Foreman server
Use this procedure to add the OpenStack connection in the Foreman server’s compute resources.
To add a compute resource, use the following procedure:
-
In the Foreman web UI, navigate to Infrastructure > Compute Resources and in the Compute Resources window, click Create Compute Resource.
-
In the Name field, enter a name to identify the compute resource for future use.
-
From the Provider list, select RHEL OpenStack Platform.
-
In the Description field, enter a description for the resource.
-
In the URL field, enter a URL to point to the OpenStack Authentication keystone service’s API at the
tokens
resource. Use the following format:http://openstack.example.com:5000/v2.0/tokens
. -
In the User and Password fields, enter the authentication user and password for Foreman to access the environment.
-
In the Domain field, enter the domain for V3 authentication.
-
From the Tenant list, select the tenant or project for Foreman server to manage.
-
To use external networks as primary networks for hosts, select the Allow external network as main network check box.
-
Click the Locations and Organizations tabs and verify that the location and organization that you want to use are set to your current context. Add any additional contexts that you want to these tabs.
-
Click Submit to save the OpenStack connection.
Create the connection with the hammer compute-resource create
command:
# hammer compute-resource create --name "My_OpenStack" \ --provider "OpenStack" \ --description "My OpenStack environment at openstack.example.com" \ --url "http://openstack.example.com:5000/v2.0/tokens" --user "My_Username" \ --password "My_Password" --tenant "openstack" --locations "New York" \ --organizations "My_Organization"
10.3. Adding OpenStack Images to the Foreman server
OpenStack uses image-based provisioning to create hosts. You must add image details to your Foreman server. This includes access details and image location.
To add OpenStack images, complete the following steps:
-
In the Foreman web UI, navigate to Infrastructure > Compute Resources and in the Computer Resources window, click the name of a OpenStack connection.
-
In the Name field, enter a name that describes the image.
-
From the Operatingsystem list, select the image’s base operating system.
-
From the Architecture list, select the operating system architecture.
-
In the User field, enter the SSH user name for image access. This is normally the
root
user. -
In the Password field, enter the SSH password for image access.
-
From the Image list, select the image in OpenStack Image Storage.
-
From the User data list, select whether you want to set if images support user data input, such as
cloud-init
data. -
Click Submit to save the image details.
Create the image with the hammer compute-resource image create
command. Use the --uuid
field to store the full path of the image location on the OpenStack server.
# hammer compute-resource image create --name "Test OpenStack Image" \ --operatingsystem "RedHat 7.2" --architecture "x86_64" \ --user root --user-data true \ --compute-resource "My_OpenStack_Platform"
10.4. Adding OpenStack Details to a Compute Profile
In Foreman, you can define certain hardware settings for instances on OpenStack. You can add these hardware settings to a compute profile.
To add OpenStack details to a compute profile, complete the following steps:
-
In the Foreman web UI, navigate to Infrastructure > Compute Profiles and in the Compute Profiles window, click the name of the profile you want to use.
-
From the Flavor list, select the hardware profile on OpenStack Platform to use for the host.
-
From the Availability zone list, selec the target cluster to use within the OpenStack Platform environment.
-
From the Image list, select the image to use for image-based provisioning.
-
From the Tenant list, select the tenant or project for the OpenStack Platform instance.
-
From the Security Group list, select the cloud-based access rules for ports and IP addresses.
-
From the Internal network, select the private networks for the host to join.
-
From the Floating IP network, select the external networks for the host to join and assign a floating IP address.
-
From the Boot from volume, select whether a volume is created from the image. If not selected, the instance boots the image directly.
-
In the New boot volume size (GB) field, enter the size, in GB, of the new boot volume.
-
Click Submit to save the compute profile.
The compute profile CLI commands are not yet implemented in Foreman 6.4. As an alternative, you can include the same settings directly during the host creation process.
10.5. Creating Image-Based Hosts on OpenStack
In Foreman, you can provision OpenStack hosts from existing images on the OpenStack server.
To provision a host, complete the following steps:
-
In the Foreman web UI, navigate to Hosts > New Host.
-
In the Name field, enter the name that you want to assign to the provisioned system’s host.
-
From the Host Group list, you can select a host group to populate the host fields.
-
From the Deploy on lits, select the OpenStack Platform connection.
-
From the Compute profile list, select a profile to use to automatically populate cloud instance-based settings.
-
Click the Interface tab, and click Edit on the host’s interface. Verify that the Name from the Host tab becomes the DNS name, and that the Foreman server automatically assigns an IP address for the new host.
-
Ensure that the MAC address field is blank. The OpenStack server assigns a MAC address to the host.
-
Verify that Foreman server automatically selects the Managed, Primary, and Provision options for the first interface on the host. If not, select them.
-
Click the Operating System tab, and confirm that each aspect of the operating system is populated.
-
If you want to change the image that populates automatically from your compute profile, from the Images list, select a different image to base the new host’s root volume.
-
Click Resolve in Provisioning Templates to verify that the new host can identify the right provisioning templates to use.
-
Click the Virtual Machine tab, and verify that the settings are populated with details from the host groups and compute profile. Modify these settings to suit your needs.
-
If you use the Katello plugin, click the Parameters tab and ensure that a parameter exists that provides an activation key. If not, add an activation key.
-
Click Submit to save the changes.
This new host entry triggers the OpenStack server to create the instance, using the pre-existing image as a basis for the new volume.
Create the host with the hammer host create
command and include the --provision-method image
option to use image-based provisioning.
# hammer host create --name "openstack-test1" --organization "My_Organization" \ --location "New York" --hostgroup "Example_Hostgroup" \ --compute-resource "My_OpenStack_Platform" --provision-method image \ --image "Test OpenStack Image" --enabled true --managed true \ --interface "managed=true,primary=true,provision=true" \ --compute-attributes="flavor_ref=m1.small,tenant_id=openstack,security_groups=default,network=mynetwork"
For more information about additional host creation parameters for this compute resource, see Additional Host Parameters for Hammer CLI.
11. Provisioning Cloud Instances in Amazon EC2
Amazon Elastic Compute Cloud (Amazon EC2) is a web service that provides public cloud compute resources. Using Foreman, you can interact with Amazon EC2’s public API to create cloud instances and control their power management states. Use the procedures in this chapter to add a connection to an Amazon EC2 account and provision a cloud instance.
11.1. Prerequisites for Amazon EC2 Provisioning
The requirements for Amazon EC2 provisioning include:
-
A Smart Proxy server managing a network in your EC2 environment. Use a Virtual Private Cloud (VPC) to ensure a secure network between the hosts and the Smart Proxy server.
-
An Amazon Machine Image (AMI) for image-based provisioning.
-
The installation media that you require for the operating systems you want to use to provision. If the Katello plugin is installed, you can use synchronized content repositories for Red Hat Enterprise Linux. For more information, see Synchronizing Red Hat Repositories in the Content Management Guide.
-
If the Katello plugin is installed, an activation key for host registration. For more information, see Creating An Activation Key in the Content Management guide.
11.2. Adding an Amazon EC2 Connection to the Foreman server
Use this procedure to add the Amazon EC2 connection in the Foreman server’s compute resources.
Amazon Web Services uses time settings as part of the authentication process. Ensure that Foreman server’s time is correctly synchronized. Ensure that an NTP service, such as ntpd
or chronyd
, is running properly on the Foreman server. Failure to provide the correct time to Amazon Web Services can lead to authentication failures.
For more information about synchronizing time in Foreman, see Synchronizing Time in Installing Foreman server from a Connected Network.
To add an Amazon EC2 connection, complete the following steps:
-
In the Foreman web UI, navigate to Infrastructure > Compute Resources and in the Compute Resources window, click Create Compute Resource.
-
In the Name field, enter a name to identify the Amazon EC2 compute resource.
-
From the Provider list, select EC2.
-
In the Description field, enter information that helps distinguish the resource for future use.
-
From the HTTP proxy list, select a HTTP proxy to connect to external API services. You must add HTTP proxies to Foreman before you can select a proxy from this list. For more information, see Configuring Foreman server with HTTP Proxy in Installing Foreman server from a Connected Network.
-
In the Access Key and Secret Key fields, enter the access keys for your Amazon EC2 account. For more information, see Managing Access Keys for your AWS Account on the Amazon documentation website.
-
Click the Load Regions button to populate the Regions list.
-
From the Region list, select the Amazon EC2 region or data center to use.
-
Click the Locations tab and ensure that the location you want to use is selected, or add a different location.
-
Click the Organizations tab and ensure that the organization you want to use is selected, or add a different organization.
-
Click Submit to save the Amazon EC2 connection.
Create the connection with the hammer compute-resource create
command. Use --user
and --password
options to add the access key and secret key respectively.
# hammer compute-resource create --name "My_EC2" --provider "EC2" \ --description "Amazon EC2 Public Cloud` --user "user_name" \ --password "secret_key" --region "us-east-1" --locations "New York" \ --organizations "My_Organization"
11.3. Using an HTTP Smart Proxy with Compute Resources
In some cases, the EC2 compute resource that you use might require a specific HTTP proxy to communicate with Foreman. In Foreman, you can create an HTTP proxy entry and then assign the proxy to your EC2 compute resource.
However, if you configure a proxy for Foreman in Administer > Settings, and then add a proxy for your compute resource, the proxy that you define in Administer > Settings takes precedence.
To add an HTTP proxy that you can assign to a compute resource, complete the following steps:
-
In the Foreman web UI, navigate to Infrastructure > HTTP Smart Proxies, and select New HTTP Proxy.
-
In the Name field, enter a name for the proxy.
-
In the URL field, enter the URL for the proxy, including the port number.
-
Optional: Enter a username and password to authenticate to the proxy, if your proxy requires authentication.
-
Click Test Connection to ensure that you can connect to the proxy from Foreman.
-
Click the Locations tab and add a location.
-
Click the Organization tab and add an organization.
-
Click Submit.
11.4. Adding Amazon EC2 Images to Foreman server
Amazon EC2 uses image-based provisioning to create hosts. You must add image details to your Foreman server. This includes access details and image location.
-
In the Foreman web UI, navigate to Infrastructure > Compute Resources and select an Amazon EC2 connection.
-
Click the Images tab, and then click New Image.
-
In the Name field, enter a name to identify the image for future use.
-
From the Operatingsystem list, select the operating system that corresponds with the image you want to add.
-
From the Architecture list, select the operating system’s architecture.
-
In the Username field, enter the SSH user name for image access. This is normally the
root
user. -
In the Password field, enter the SSH password for image access.
-
In the Image ID field, enter the Amazon Machine Image (AMI) ID for the image. This is usually in the following format:
ami-xxxxxxxx
. -
From the User data list, select whether the images support user data input, such as
cloud-init
data. If you enable user data, the Finish scripts are automatically disabled. This also applies in reverse: if you enable the Finish scripts, this disables user data. -
From the IAM role list, select the Amazon security role used for creating the image.
-
Click Submit to save the image details.
Create the image with the hammer compute-resource image create
command. Use the --uuid
field to store the full path of the image location on the Amazon EC2 server.
# hammer compute-resource image create --name "Test Amazon EC2 Image" \ --operatingsystem "RedHat 7.2" --architecture "x86_64" --username root \ --user-data true --uuid "ami-my_ami_id" --compute-resource "My_EC2"
11.5. Adding Amazon EC2 Details to a Compute Profile
You can add hardware settings for instances on Amazon EC2 to a compute profile.
To add hardware settings, complete the following steps:
-
In the Foreman web UI, navigate to Infrastructure > Compute Profiles and click the name of your profile, then click an EC2 connection.
-
From the Flavor list, select the hardware profile on EC2 to use for the host.
-
From the Image list, select the image to use for image-based provisioning.
-
From the Availability zone list, select the target cluster to use within the chosen EC2 region.
-
From the Subnet list, add the subnet for the EC2 instance. If you have a VPC for provisioning new hosts, use its subnet.
-
From the Security Groups list, select the cloud-based access rules for ports and IP addresses to apply to the host.
-
From the Managed IP list, select either a
Public
IP or aPrivate
IP. -
Click Submit to save the compute profile.
The compute profile CLI commands are not yet implemented in Foreman. As an alternative, you can include the same settings directly during the host creation process.
11.6. Creating Image-Based Hosts on Amazon EC2
The Amazon EC2 provisioning process creates hosts from existing images on the Amazon EC2 server.
-
In the Foreman web UI, navigate to Hosts > New Host.
-
In the Name field, enter a name for the host.
-
From the Host Group list, you can select a host group to populate most of the new host’s fields.
-
From the Deploy on list, select the EC2 connection.
-
From the Compute Profile list, select a profile to use to automatically populate virtual machine-based settings.
-
Click the Interface tab, and then click Edit on the host’s interface, and verify that the fields are populated with values. Leave the Mac Address field blank. The Foreman server automatically selects and IP address and the Managed, Primary, and Provision options for the first interface on the host.
-
Click the Operating System tab and confirm that all fields are populated with values.
-
Click the Virtual Machine tab and confirm that all fields are populated with values.
-
If you use the Katello plugin, click the Parameters tab, and ensure that a parameter exists that provides an activation key. If not, add an activation key.
-
Click Submit to save your changes.
This new host entry triggers the Amazon EC2 server to create the instance, using the pre-existing image as a basis for the new volume.
Create the host with the hammer host create
command and include --provision-method image
to use image-based provisioning.
# hammer host create --name "ec2-test1" --organization "My_Organization" \ --location "New York" --hostgroup "Base" \ --compute-resource "My_EC2" --provision-method image \ --image "Test Amazon EC2 Image" --enabled true --managed true \ --interface "managed=true,primary=true,provision=true,subnet_id=EC2" \ --compute-attributes="flavor_id=m1.small,image_id=TestImage,availability_zones=us-east-1a,security_group_ids=Default,managed_ip=Public"
For more information about host creation parameters for this compute resource, see Additional Host Parameters for Hammer CLI.
11.7. Connecting to an Amazon EC2 instance using SSH
You can connect remotely to an Amazon EC2 instance from Foreman server using SSH. However, to connect to any Amazon Web Services EC2 instance that you provision through Foreman, you must first access the private key that is associated with the compute resource in the Foreman database, and use this key for authentication.
To locate the private key and connect to an Amazon EC2 server using SSH, complete the following steps:
-
To locate the compute resource list, on your Foreman server base system, enter the following command, and note the ID of the compute resource that you want to use:
# hammer compute-resource list
-
Switch user to the
postgres
user:# su - postgres
-
Initiate the
postgres
shell:$ psql
-
Connect to the Foreman database as the user
postgres
:# postgres=# \c foreman
-
Select the secret from
key_pairs
wherecompute_resource_id = 3
:# select secret from key_pairs where compute_resource_id = 3; secret
-
Copy the key from after
-----BEGIN RSA PRIVATE KEY-----
until-----END RSA PRIVATE KEY-----
. -
Create a
.pem
file and paste your key into the file:# vim Keyname.pem
-
Ensure that you restrict access to the
.pem
file:# chmod 600 Keyname.pem
-
To connect to the Amazon EC2 instance, enter the following command:
ssh -i Keyname.pem ec2-user@example.aws.com
11.8. Configuring a Finish Template for an Amazon Web Service EC2 Environment
You can use Foreman finish templates during the provisioning of Linux instances in an Amazon EC2 environment.
To configure a finish template for Amazon EC2, complete the following steps:
-
In the Foreman web UI, navigate to Hosts > Provisioning Templates.
-
In the Provisioning Templates page, enter
Kickstart default finish
into the search field and click Search. -
On the Kickstart default finish template, select Clone.
-
In the Name field, enter a unique name for the template.
-
In the template, prefix each command that requires root privileges with
sudo
, except foryum
or equivalent commands, or add the following line to run the entire template as thesudo
user:sudo -s << EOS _Template_ _Body_ EOS
-
Click the Association tab, and associate the template with a Red Hat Enterprise Linux operating system that you want to use.
-
Click the Locations tab, and add the the location where the host resides.
-
Click the Organizations tab, and add the organization that the host belongs to.
-
Make any additional customizations or changes that you require, then click Submit to save your template.
-
Navigate to Hosts > Operating systems and select the operating system that you want for your host.
-
Click the Templates tab, and from the Finish Template list, select your finish template.
-
Navigate to Hosts > Create Host and enter the information about the host that you want to create.
-
Click the Parameters tab and navigate to Host parameters.
-
If you have the Remote Execution plugin installed, in Host parameters, click the Add Parameter button two times to add two new parameter fields. If you use the Katello plugin, add a third parameter field. Add the following parameters:
-
In the Name field, enter
remote_execution_ssh_keys
. In the corresponding Value field, enter the output ofcat /usr/share/foreman-proxy/.ssh/id_rsa_foreman_proxy.pub
. -
In the Name field, enter
remote_execution_ssh_user
. In the corresponding Value field, enterec2-user
. -
If you use the Katello plugin, in the Name field, enter
activation_keys
. In the corresponding Value field, enter your activation key.
-
-
Click Submit to save the changes.
11.9. More Information about Amazon Web Services and Foreman
For information about how to locate Red Hat Gold Images on Amazon Web Services EC2, see How to Locate Red Hat Cloud Access Gold Images on AWS EC2.
For information about how to install and use the Amazon Web Service Client on Linux, see Install the AWS Command Line Interface on Linux in the Amazon Web Services documentation.
For information about importing and exporting virtual machines in Amazon Web Services, see VM Import/Export in the Amazon Web Services documentation.
12. Provisioning Cloud Instances in Google Compute Engine
Foreman can interact with Google Compute Engine (GCE), including creating new virtual machines and controlling their power management states. Only image-based provisioning is supported for creating GCE hosts.
12.1. Prerequisites for GCE Provisioning
Before you begin, ensure that the following conditions are met:
-
In your GCE project, configure a service account with the necessary IAM Compute role. For more information, see Compute Engine IAM roles in the GCE documentation.
-
In your GCE project-wise metadata, set the
enable-oslogin
toFALSE
. For more information, see Enabling or disabling OS Login in the GCE documentation. -
Optional: If you want to use Puppet with GCE hosts, navigate to Administer > Settings > Puppet and enable the
Use UUID for certificates
setting to configure Puppet to use consistent Puppet certificate IDs. -
Based on your needs, associate a
finish
oruser_data
provisioning template with the operating system you want to use. For more information about provisioning templates, see Types of Provisioning Templates. -
The installation media that you require for the operating systems you want to use to provision. If the Katello plugin is installed, you can use synchronized content repositories for Red Hat Enterprise Linux. For more information, see Synchronizing Red Hat Repositories in the Content Management Guide.
-
If the Katello plugin is installed, an activation key for host registration. For more information, see Creating An Activation Key in the Content Management guide.
12.2. Adding a GCE Connection to Foreman server
Use this procedure to add a GCE connection to Foreman to be able to add images and provision hosts on GCE.
To add a connection, complete the following steps:
-
In GCE, generate a service account key in JSON format and upload this file to the
/usr/share/foreman/
directory on Foreman server. -
On Foreman server, configure permissions for the service account key to ensure that the file is readable by the
foreman
user:# chown foreman /usr/share/foreman/gce_key.json # chmod 0600 /usr/share/foreman/gce_key.json # restorecon -vv /usr/share/foreman/gce_key.json
-
In the Foreman web UI, navigate to Infrastructure > Compute Resources and click Create Compute Resource.
-
In the Name field, enter a name for the resource.
-
From the Provider list, select Google.
-
Optional: In the Description field, enter a description for the resource.
-
In the Google Project ID field, enter the project ID.
-
In the Client Email field, enter the client email.
-
In the Certificate Path field, enter the path to the service account key. For example,
/usr/share/foreman/gce_key.json
. -
Click Load Zones to populate the list of zones from your GCE environment.
-
From the Zone list, select the GCE zone to use.
-
Click Submit.
12.3. Adding GCE Images to Foreman server
GCE uses image-based provisioning to create hosts. You must add image details to your Foreman server.
To add an image, complete the following steps:
-
In the Foreman web UI, navigate to Infrastructure > Compute Resources and click the GCE connection.
-
Click the Images tab.
-
Click Create Image.
-
In the Name field, enter a name for the image.
-
From the Operating system list, select the base operating system for the image.
-
From the Architecture list, select the operating system architecture.
-
In the User field, enter the SSH user name for image access. Specify a user other than
root
, because theroot
user cannot connect to a GCE instance using SSH keys. The username must begin with a letter and consist of lowercase letters and numbers. -
From the Image list, select the GCE image.
-
Optional: If the selected image supports
cloud-init
, select the User data check box to enable user data input. -
Click Submit to save the image details.
12.4. Adding GCE Details to a Compute Profile
You can add GCE details to a compute profile to automatically populate virtual machine-based settings on host creation.
To add details to a compute profile, complete the following steps:
-
In the Foreman web UI, navigate to Infrastructure > Compute Profiles and click the name of your profile.
-
Select a GCE connection.
-
From the Machine Type list, select the machine type to use for provisioning.
-
From the Image list, select the image to use for provisioning.
-
From the Network list, select the GCE network to use for provisioning.
-
Optional: Select the Associate Ephemeral External IP check box to assign a dynamic ephemeral IP address that Foreman uses to communicate with the host. This public IP address changes when you reboot the host. If you need a permanent IP address, reserve a static public IP address on GCE and attach it to the host.
-
In the Size (GB) field, enter the size of the storage to create on the host.
-
Click Submit to save the compute profile.
12.5. Creating Image-Based Hosts on GCE
The GCE provisioning process creates hosts from existing images on GCE.
To create a host on GCE, complete the following steps:
-
In the Foreman web UI, navigate to Hosts > Create host.
-
In the Name field, enter a name for the host.
-
Click the Organization and Location tabs to ensure that the provisioning context is automatically set to the current context.
-
Optional: From the Host Group list, you can select a host group to populate most of the new host’s fields.
-
From the Deploy on list, select the GCE connection.
-
From the Compute Profile list, select a profile to use to automatically populate virtual machine-based settings.
-
Click the Interface tab and click Edit on the host’s interface.
-
Verify that the fields are automatically populated with values, particularly the following items:
-
The Name from the Host tab becomes the DNS name.
-
The MAC address field is blank.
-
The Domain field is populated with the required domain.
-
The Managed, Primary, and Provision options are automatically selected for the first interface on the host. If not, select them.
-
-
Click the Operating System tab, and select the operating system to install.
-
Click Resolve in Provisioning templates to verify that the new host can identify the correct provisioning templates to use. You must select either a
finish
oruser_data
provisioning template. -
If you use the Katello plugin, click the Parameters tab and ensure that a parameter exists that provides an activation key. If not, add an activation key.
-
Click Submit to save the host entry.
Appendix A: Initialization Script for Provisioning Examples
Note
|
The following chapter describes Red Hat content management provided by Katello plugin. Deployments without the plugin use Installation Media to fetch content from remote or local mirrors. |
If you have not followed the examples in the Foreman Content Management Guide, you can use the following initialization script to create an environment for provisioning examples.
Create a script file (content-init.sh
) and include the following:
#!/bin/bash MANIFEST=$1 # Import the content from Red Hat CDN hammer organization create --name "ACME" --label "ACME" \ --description "Our example organization for managing content." hammer subscription upload --file ~/$MANIFEST --organization "ACME" hammer repository-set enable \ --name "Red Hat Enterprise Linux 7 Server (RPMs)" \ --releasever "7Server" --basearch "x86_64" \ --product "Red Hat Enterprise Linux Server" --organization "ACME" hammer repository-set enable \ --name "Red Hat Enterprise Linux 7 Server (Kickstart)" \ --releasever "7Server" --basearch "x86_64" \ --product "Red Hat Enterprise Linux Server" --organization "ACME" hammer repository-set enable \ --name "Red Hat Satellite Tools 6.4 (for RHEL 7 Server) (RPMs)" \ --basearch "x86_64" --product "Red Hat Enterprise Linux Server" \ --organization "ACME" hammer product synchronize --name "Red Hat Enterprise Linux Server" \ --organization "ACME" # Create our application life cycle hammer lifecycle-environment create --name "Development" \ --description "Environment for ACME's Development Team" \ --prior "Library" --organization "ACME" hammer lifecycle-environment create --name "Testing" \ --description "Environment for ACME's Quality Engineering Team" \ --prior "Development" --organization "ACME" hammer lifecycle-environment create --name "Production" \ --description "Environment for ACME's Product Releases" \ --prior "Testing" --organization "ACME" # Create and publish our Content View hammer content-view create --name "Base" \ --description "Base operating system" \ --repositories "Red Hat Enterprise Linux 7 Server RPMs x86_64 7Server,Red Hat Satellite Tools 6.4 for RHEL 7 Server RPMs x86_64" \ --organization "ACME" hammer content-view publish --name "Base" \ --description "Initial content view for our operating system" \ --organization "ACME" hammer content-view version promote --content-view "Base" --version 1 \ --to-lifecycle-environment "Development" --organization "ACME" hammer content-view version promote --content-view "Base" --version 1 \ --to-lifecycle-environment "Testing" --organization "ACME" hammer content-view version promote --content-view "Base" --version 1 \ --to-lifecycle-environment "Production" --organization "ACME"
Set executable permissions on the script:
# chmod +x content-init.sh
Download a copy of your Subscription Manifest from the Red Hat Customer Portal and run the script on the manifest:
# ./content-init.sh manifest_98f4290e-6c0b-4f37-ba79-3a3ec6e405ba.zip
This imports the necessary Red Hat content for the provisioning examples in this guide.
Appendix B: Additional Host Parameters for Hammer CLI
This appendix provides some information on additional parameters for the hammer host create
command.
B.1. Common Interface Parameters
These parameters are used with the --interface
option for all provisioning types:
Parameter | Description | |
---|---|---|
mac |
MAC address for the interface |
|
ip |
IP address for the interface |
|
type |
The type of interface. For example: |
|
name |
The host name associated with this interface` |
|
subnet_id |
The subnet ID on the Foreman server |
|
domain_id |
The domain ID on the Foreman server |
|
identifier |
The device identifier. For example: |
|
managed |
Boolean for managed interfaces. Set to |
|
primary |
Boolean for primary interfaces. Managed hosts needs to have one primary interface. Set to |
|
provision |
Boolean for whether to provision on this interface. Set to |
|
virtual |
Boolean for whether the interface is a VLAN interface. Set to |
Use the following parameters if virtual
is true
:
Parameter | Description | |
---|---|---|
tag |
VLAN tag, this attribute has precedence over the subnet VLAN ID. Only for virtual interfaces. |
|
attached_to |
Identifier of the interface to which this interface belongs. For example: |
Use the following parameters if type
is bond
:
Parameter | Description | |
---|---|---|
mode |
The bonding mode. One of |
|
attached_devices |
Identifiers of slave interfaces. For example: |
|
bond_options |
Additional bonding options |
Use the following parameters if type
is bmc
:
Parameter | Description | |
---|---|---|
provider |
The BMC provider. Only |
|
username |
The username for the BMC device |
|
password |
The password for the BMC device |
B.2. EC2 Parameters
Available parameters for --compute-attributes
:
Parameter | Description | |
---|---|---|
flavor_id |
The EC2 flavor to use |
|
image_id |
The AMI ID of the image to use |
|
availability_zone |
The availability zone within the region of the EC2 provider |
|
security_group_ids |
The IDs for security groups to use |
|
managed_ip |
To utilize a public or private IP |
B.3. Libvirt Parameters
Available keys for --compute-attributes
:
Parameter | Description | |
---|---|---|
cpus |
Number of CPUs |
|
memory |
Amount of memory in bytes |
|
start |
Boolean to start the machine |
Available keys for --interface
:
Parameter | Description | |
---|---|---|
compute_type |
Either |
|
compute_network / compute_bridge |
Name of the network or physical interface |
|
compute_model |
The interface model. One of |
Available keys for --volume
:
Parameter | Description | |
---|---|---|
pool_name |
The storage pool to store the volume |
|
capacity |
The capacity of the volume. For example: |
|
format_type |
The disk type. Either |
B.4. OpenStack Parameters
Available keys for --compute-attributes
:
Parameter | Description | |
---|---|---|
flavor_ref |
The flavor to use |
|
image_ref |
The image to use |
|
tenant_id |
The tenant to use |
|
security_groups |
A list of security groups to use |
|
network |
The network to connect the instance |
B.5. oVirt Parameters
Available keys for --compute-attributes
:
Parameter | Description | |
---|---|---|
cluster |
The cluster ID to contain the host |
|
template |
The hardware profile to use |
|
cores |
The number of CPU cores to use |
|
memory |
The amount of memory in bytes |
|
start |
Boolean to start the machine |
Available keys for --interface
:
Parameter | Description | |
---|---|---|
compute_name |
The interface name. For example: |
|
compute_network |
The network in the cluster to use |
Available keys for --volume
:
Parameter | Description | |
---|---|---|
size_gb |
Volume size in GB |
|
storage_domain |
The storage domain to use |
|
bootable |
Boolean to set the volume as bootable. Only one volume can be bootable |
B.6. VMware Interface Parameters
Available keys for --compute-attributes
:
Parameter | Description | |
---|---|---|
cpus |
Number of CPUs for the host |
|
corespersocket |
Number of cores per CPU socket. Applicable to hosts using hardware versions less than v10. |
|
memory_mb |
Amount of memory in MB |
|
cluster |
Cluster ID for the host |
|
path |
Path to folder to organize the host |
|
guest_id |
Guest OS ID |
|
scsi_controller_type |
ID of the VMware controller |
|
hardware_version |
VMware hardware version ID |
|
start |
Boolean to start the machine |
Available keys for --interface
:
Parameter | Description | |
---|---|---|
compute_type |
Type of the network adapter. One of |
|
compute_network |
VMware network ID |
Available keys for --volume
:
Parameter | Description | |
---|---|---|
datastore |
The datastore ID |
|
name |
The name of the volume |
|
size_gb |
The size in GB |
|
thin |
Boolean value to enable thin provisioning |
|
eager_zero |
Boolean value to enable Eager Zero thick provisioning |
Appendix C: Provisioning FIPS Compliant Hosts
Foreman supports provisioning hosts that comply with the National Institute of Standards and Technology’s Security Requirements for Cryptographic Modules standard, reference number FIPS 140-2, referred to here as FIPS.
Foreman is not supported on a FIPS enabled host.
To enable the provisioning of hosts that are FIPS compliant, complete the following changes:
-
Identify the relevant operating systems, locations, and organizations
-
Create and enable the FIPS provisioning templates
-
Change the provisioning password hashing algorithm
-
Change the Puppet message digest algorithm
-
Set the FIPS enabled parameter
When these changes are complete, the new provisioning templates will be associated with those operating systems, locations, and organizations you specify. When you provision a host to those operating systems, locations, and organizations, the host will have the FIPS-compliant settings applied. To confirm that these settings have been successful, complete the steps in Verifying FIPS Mode is Enabled.
-
Complete the configuration steps from the Authentication section in the Hammer CLI Guide. This allows you to run Hammer commands without providing your Foreman username and password each time.
C.1. Identifying the Relevant Operating Systems, Locations, and Organizations
Before creating the FIPS-compliant templates in Foreman, you must identify those locations, organizations and operating systems to which you want to deploy FIPS-compliant hosts. For example, if you will only deploy Red Hat Enterprise Linux 7 hosts as FIPS compliant, associate the template with only Red Hat Enterprise Linux 7.
-
List all locations.
Example$ hammer location list ---|----------------- ID | NAME ---|----------------- 2 | Default Location ---|-----------------
Note the value in the
NAME
column of those locations to which you want to deploy FIPS-compliant hosts. -
List all organizations.
Example$ hammer organization list ---|----------------------|----------------------|------------ ID | NAME | LABEL | DESCRIPTION ---|----------------------|----------------------|------------ 1 | Default Organization | Default_Organization | 2 | Sales | Sales_Department | ---|----------------------|----------------------|------------
Note the value in the
NAME
column of those organizations to which you want to deploy FIPS-compliant hosts. -
List all operating systems.
Example$ hammer os list
Note the value in the
TITLE
column of those operating systems to which you want to deploy FIPS-compliant hosts.
C.2. Creating and Enabling the FIPS Provisioning Templates
The FIPS provisioning templates are provided in a git repository. In this procedure you import them into the Foreman environment, then associate them with the desired operating systems, locations, and organizations.
-
On the Foreman server, clone the git repository containing the FIPS enabled templates, then change into the repository’s directory.
$ git clone https://github.com/RedHatSatellite/satellite6-fips-client $ cd satellite6-fips-client
This repository contains the following Embedded RuBy (ERB) templates. These are plain text files, which you can view to see in detail the configuration settings they contain.
-
Kickstart_Default_PXELinux_FIPS.erb
-
Updated PXELinux template
-
-
fips_packages.erb
-
Packages required by FIPS mode (for example,
dracut-fips
)
-
-
Kickstart_Default_FIPS.erb
-
Kickstart template with modifications to call the
fips_packages
snippet
-
-
puppet.conf.erb
-
Updated
puppet.conf
configuration file with updated (SHA256) message digest algorithm
-
-
-
Add the PXELinux FIPS template.
$ hammer template create --name "Kickstart Default PXELinux FIPS" \ --file Kickstart_Default_PXELinux_FIPS.erb \ --locations LOCATIONS \ --organizations ORGANIZATION \ --operatingsystems OS \ --type PXELinux
Replace the placeholder values
LOCATIONS
,ORGANIZATION
, andOS
with the values you noted in Identifying the Relevant Operating Systems, Locations, and Organizations. If any value contains non-alphabetical characters, enclose the value in quotation marks (").The message
Config template created
indicates success.Example$ hammer template create --name "Kickstart Default PXELinux FIPS" \ --file Kickstart_Default_PXELinux_FIPS.erb \ --locations "Default Location" \ --organizations "Default Organization","Sales" \ --operatingsystems "RedHat 6.6","RedHat 7.1","RedHat 7.2","RedHat 6.7" \ --type PXELinux
-
Add the Kickstart Default FIPS_ template.
$ hammer template create --name "Kickstart Default FIPS" \ --file Kickstart_Default_FIPS.erb \ --locations LOCATIONS \ --organizations ORGANIZATION \ --operatingsystems OS \ --type provision
Replace the placeholder values
LOCATIONS
,ORGANIZATION
, andOS
with the values you noted in Identifying the Relevant Operating Systems, Locations, and Organizations. If any value contains non-alphabetical characters, enclose the value in quotation marks (").The message
Config template created
indicates success.Example$ hammer template create --name "Kickstart Default FIPS" \ --file Kickstart_Default_FIPS.erb \ --locations "Default Location" \ --organizations "Default Organization","Sales" \ --operatingsystems "OS Name _OS Version_7" \ --type provision
-
Add the FIPS Packages snippet.
$ hammer template create --name "fips_packages" \ --file fips_packages.erb \ --locations LOCATIONS \ --organizations ORGANIZATION \ --type snippet
Replace the placeholder values LOCATIONS and ORGANIZATION with the values you noted in Identifying the Relevant Operating Systems, Locations, and Organizations. If any value contains non-alphabetical characters, enclose the value in quotation marks (").
The message
Config template created
indicates success.Example$ hammer template create --name "fips_packages" \ --file fips_packages.erb \ --locations "Default Location" \ --organizations "Default Organization","Sales" \ --type snippet
-
Update the default Puppet configuration snippet.
$ hammer template update --name puppet.conf \ --file puppet.conf.erb \ --type snippet
The message
Config template created
indicates success. -
Update the Operating System Object to use the new templates.
Now that the new FIPS templates have been added to Foreman, they must be set as default templates for the desired operating system.
-
Identify the IDs of the Kickstart Default FIPS and Kickstart Default PXELinux FIPS templates.
Example$ hammer template list ----|--------------------------------------|---------- ID | NAME | TYPE ----|--------------------------------------|---------- 38 | Alterator default | provision 26 | Alterator default finish | finish 10 | Alterator default PXELinux | PXELinux 52 | alterator_pkglist | snippet 53 | ansible_provisioning_callback | snippet 54 | ansible_tower_callback_script | snippet 55 | ansible_tower_callback_service | snippet 39 | Atomic Kickstart default | provision 40 | AutoYaST default | provision 33 | AutoYaST default iPXE | iPXE 11 | AutoYaST default PXELinux | PXELinux 86 | AutoYaST default user data | user_data 41 | AutoYaST SLES default | provision 56 | blacklist_kernel_modules | snippet 57 | bmc_nic_setup | snippet 110 | Boot disk iPXE - generic host | Bootdisk 109 | Boot disk iPXE - host | Bootdisk 58 | chef_client | snippet 59 | coreos_cloudconfig | snippet 42 | CoreOS provision | provision 12 | CoreOS PXELinux | PXELinux 60 | create_users | snippet 61 | csr_attributes.yaml | snippet 112 | Discovery Debian kexec | kexec 111 | Discovery Red Hat kexec | kexec 62 | epel | snippet 63 | fix_hosts | snippet 27 | FreeBSD (mfsBSD) finish | finish 43 | FreeBSD (mfsBSD) provision | provision 13 | FreeBSD (mfsBSD) PXELinux | PXELinux 64 | freeipa_register | snippet 51 | Grubby default | script 65 | http_proxy | snippet 34 | iPXE default local boot | iPXE 35 | iPXE global default | iPXE 44 | Jumpstart default | provision 28 | Jumpstart default finish | finish 2 | Jumpstart default PXEGrub | PXEGrub 29 | Junos default finish | finish 45 | Junos default SLAX | provision 25 | Junos default ZTP config | ZTP 46 | Kickstart default | provision 30 | Kickstart default finish | finish 36 | Kickstart default iPXE | iPXE 3 | Kickstart default PXEGrub | PXEGrub 6 | Kickstart default PXEGrub2 | PXEGrub2 14 | Kickstart default PXELinux | PXELinux 87 | Kickstart default user data | user_data 67 | kickstart_ifcfg_bonded_interface | snippet 66 | kickstart_ifcfg_bond_interface | snippet 68 | kickstart_ifcfg_generic_interface | snippet 69 | kickstart_ifcfg_get_identifier_names | snippet 70 | kickstart_networking_setup | snippet 47 | Kickstart oVirt-RHVH | provision 15 | Kickstart oVirt-RHVH PXELinux | PXELinux 1 | NX-OS default POAP setup | POAP 48 | Preseed default | provision 31 | Preseed default finish | finish 37 | Preseed default iPXE | iPXE 7 | Preseed default PXEGrub2 | PXEGrub2 16 | Preseed default PXELinux | PXELinux 88 | Preseed default user data | user_data 71 | preseed_networking_setup | snippet 72 | puppet.conf | snippet 74 | puppetlabs_repo | snippet 73 | puppet_setup | snippet 75 | pxegrub2_chainload | snippet 8 | PXEGrub2 default local boot | PXEGrub2 76 | pxegrub2_discovery | snippet 9 | PXEGrub2 global default | PXEGrub2 77 | pxegrub_chainload | snippet 4 | PXEGrub default local boot | PXEGrub 78 | pxegrub_discovery | snippet 5 | PXEGrub global default | PXEGrub 17 | PXELinux chain iPXE | PXELinux 18 | PXELinux chain iPXE UNDI | PXELinux 79 | pxelinux_chainload | snippet 19 | PXELinux default local boot | PXELinux 20 | PXELinux default memdisk | PXELinux 80 | pxelinux_discovery | snippet 21 | PXELinux global default | PXELinux 81 | rancheros_cloudconfig | snippet 49 | RancherOS provision | provision 22 | RancherOS PXELinux | PXELinux 82 | redhat_register | snippet 83 | remote_execution_ssh_keys | snippet 84 | saltstack_minion | snippet 85 | saltstack_setup | snippet 89 | UserData default | user_data 23 | WAIK default PXELinux | PXELinux 50 | XenServer default answerfile | provision 32 | XenServer default finish | finish 24 | XenServer default PXELinux | PXELinux ----|--------------------------------------|----------
In this example, the IDs are 54 and 53 respectively. These IDs are installation specific.
-
Specify the FIPS templates as default.
$ hammer os set-default-template --config-template-id TEMPLATE \ --id OS
Replace the placeholders TEMPLATE and OS with the IDs of the FIPS templates, and the desired operating system, noted earlier. Repeat this command for every combination of FIPS template and operating system. It does not accept a comma-separated list of values.
In this example, the FIPS templates are set as default for Red Hat Enterprise Linux 7.2, identified in an earlier example as ID 1.
Example$ hammer os set-default-template --config-template-id 54 --id 1 $ hammer os set-default-template --config-template-id 53 --id 1
-
C.3. Change the Provisioning Password Hashing Algorithm
This sets the password hashing algorithm used in provisioning to SHA256. This configuration setting must be applied for each operating system you want to deploy as FIPS compliant.
Note
|
This is required ONLY if Foreman was upgraded from Foreman 1.22. Foreman 6.4 uses SHA256 by default. |
-
Identify the Operating System IDs.
Example$ hammer os list
-
Update each operating system’s password hash value.
$ hammer os update --title OS \ --password-hash SHA256
Repeat this command for each of the desired operating systems, using the matching value in the
TITLE
column. It does not accept a comma-separated list of values.Example$ hammer os update --title "RedHat 7.2" \ --password-hash SHA256
C.4. Switching to a FIPS Compliant Message Algorithm for Puppet
On the Foreman server, all external Smart Proxy servers, and all existing hosts, configure Puppet to use the SHA256 message digest algorithm.
Edit the /etc/puppetlabs/puppet/puppet.conf
file, adding the line digest_algorithm = sha256
in the [main]
stanza.
Note
|
This change will be overwritten on every upgrade of Foreman, so needs to be reapplied afterward. |
Because the Puppet message digest algorithm is changed on the Foreman server and all Smart Proxy servers, it must also be changed on all hosts, including those that are not FIPS compliant.
In the event of a message digest algorithm mismatch, the client will download its facts again. This will result in a noticeable increased load on the Foreman server or external Smart Proxy servers.
C.5. Setting the FIPS Enabled Parameter
To provision a FIPS compliant host, the FIPS templates require a parameter named fips_enabled to be set to true
. If this is not set to true
, or is absent, the FIPS specific changes will not be applied. This parameter can be specified when provisioning an individual host, or set for a hostgroup. Retrospectively enabling FIPS compliance on a host is outside the scope of this guide and likely to cause problems.
To set this parameter when provisioning a host, append --parameters fips_enabled=true
to the Hammer command.
To set this parameter on an existing host group, use the Hammer sub-command set-parameter
. For more information, see the output of the command hammer hostgroup set-parameter --help
. Any host provisioned to this hostgroup will inherit the fips_enabled parameter from the hostgroup.
$ hammer hostgroup set-parameter --name fips_enabled \ --value 'true' \ --hostgroup prod_servers
C.6. Verifying FIPS Mode is Enabled
To verify these FIPS compliance changes have been successful, you must provision a host and check its configuration.
-
Deploy a host using the FIPS templates, ensuring that parameter named fips_enabled is set to
true
. -
Log in to the new host as a root-equivalent account.
-
Enter the command
cat /proc/sys/crypto/fips_enabled
. A value of1
confirms that FIPS mode is enabled.