Fixes #10052 - Code to setup rhsm.conf for atomic hosts #67

parthaa · 2015-09-11T23:42:44Z

Atomic hosts don't deal with Rpms. This script provides an alternative way to setup the rhsm.conf by including the cert + rpm post script as a separate entity. It also generates a katello-rhsm-atomic-consumer.tar.gz , which has this. So the user is expected download the tar gz , extract, cd into atomic and then run "katello-rhsm-atomic-consumer" script for it to setup rhsm.conf .

ehelms · 2015-09-12T00:14:13Z

What is different about the atomic reconfigure from the existing reconfigure script?

Thoughts on deploying a script that machines download and run that fetches the cert and reconfigure script and then runs them? I imagine this process will be scripted anyway so we could just handle that directly.

parthaa · 2015-09-14T16:03:10Z

What is different about the atomic reconfigure from the existing reconfigure script?

Some differences.

We know that the newer version of subscription manager is available on atomic so we dont need to do a "rpm -q .." and figure out version of subs manager. Moreover rpm command is not available on atomic so the script will fail right away if we try to do "rpm -q".
The source directory for the katello ca cert is different in the case of rpm. In the case of the atomic the ca cert is going to be available is in a different place.

But I understand your concern that it will add 2 places to maintain this logic.. Any suggestions on combining? Concat would be hard, would be better if I could do includes or variable magic.

Thoughts on deploying a script that machines download and run that fetches the cert and reconfigure script and then runs them? I imagine this process will be scripted anyway so we could just handle that directly.

So I noticed that I would have to add a "--insecure" every time I did a wget. I felt it would be better user experience to say, download this tar gz and have the script use the files in that extracted directory. In other word the tar gz would be the equivalent of the rpm and the script inside it would be the equivalent of the post script.

ehelms · 2015-09-14T17:39:48Z

On Mon, Sep 14, 2015 at 12:03 PM, Partha Aji [email protected]
wrote:

What is different about the atomic reconfigure from the existing
reconfigure script?

Some differences.

We know that the newer version of subscription manager is available on
atomic so we dont need to do a "rpm -q .." and figure out version of subs
manager. Moreover rpm command is not available on atomic so the script will
fail right away if we try to do "rpm -q".

The source directory for the katello ca cert is different in the case
of rpm. In the case of the atomic the ca cert is going to be available is
in a different place.

But I understand your concern that it will add 2 places to maintain this
logic.. Any suggestions on combining? Concat would be hard, would be better
if I could do includes or variable magic.

I think checks within the script would be better than maintaining two whole
versions of it. Could you detect the presence of 'rpm' with which?

Thoughts on deploying a script that machines download and run that fetches
the cert and reconfigure script and then runs them? I imagine this process
will be scripted anyway so we could just handle that directly.

So I noticed that I would have to add a "--insecure" every time I did a
wget. I felt it would be better user experience to say, download this tar
gz and have the script use the files in that extracted directory. In other
word the tar gz would be the equivalent of the rpm and the script inside it
would be the equivalent of the post script.

Do you not have to add '--insecure' when retrieving the tar.gz? Difference
with the RPM is that the script gets run automatically -- install RPM with
one command and you are done. This requires a few steps that I imagine
would get scripted anyway so I question whether we ought to just automate
it down to one script to begin with?

—
Reply to this email directly or view it on GitHub
#67 (comment).

Eric D. Helms
Red Hat Engineering
Ph.D. Student - North Carolina State University

parthaa · 2015-09-14T18:03:14Z

Do you not have to add '--insecure' when retrieving the tar.gz? Difference
with the RPM is that the script gets run automatically -- install RPM with
one command and you are done. This requires a few steps that I imagine
would get scripted anyway so I question whether we ought to just automate
it down to one script to begin with?

I am not sure I get this. Here is the proposed workflow

$ wget --no-check-certificate http://<sat fqdn>/pub/katello-rhsm-atomic-consumer.tar.gz  
$ tar zxf katello-rhsm-atomic-consumer.tar.gz 
$ cd atomic
$ ./katello-rhsm-atomic-consumer

That tar gz has all the certs and other potential future rpm artifacts that may be needed so that I don't need the script do -> wget --no-check-certificate http:///pub/katello-ca.crt (I am more concerned with adding a --no-check for every wget.)

ehelms · 2015-09-14T18:07:05Z

On Mon, Sep 14, 2015 at 2:03 PM, Partha Aji [email protected]
wrote:

Do you not have to add '--insecure' when retrieving the tar.gz? Difference
with the RPM is that the script gets run automatically -- install RPM with
one command and you are done. This requires a few steps that I imagine
would get scripted anyway so I question whether we ought to just automate
it down to one script to begin with?

I am not sure I get this. Here is the proposed workflow

$ wget --no-check-certificate http:///pub/katello-rhsm-atomic-consumer.tar.gz
$ tar zxf katello-rhsm-atomic-consumer.tar.gz
$ cd atomic
$ ./katello-rhsm-atomic-consumer

That tar gz has all the certs and other potential future rpm artifacts
that may be needed so that I don't need the script do -> wget
--no-check-certificate http:///pub/katello-ca.crt

What am I asking is, why wouldn't this workflow work:

$ wget --no-check-certificate http:///pub/katello-ca-consumer-latest.sh
$ ./katello-ca-consumer-latest.sh

You had mentioned RPM isn't available on an atomic host, are we guaranteed
that tar and gunzip are as well?

—

Reply to this email directly or view it on GitHub
#67 (comment).

Eric D. Helms
Red Hat Engineering
Ph.D. Student - North Carolina State University

parthaa · 2015-09-14T18:43:34Z

What am I asking is, why wouldn't this workflow work:

It may work. I just feel its more convinient and consistent with the way we do rpm + script to have it packaged as tar gz

jlsherrill · 2015-09-14T18:49:42Z

I think we were hesitant to write a script that downloads the ca file insecurely. Leaving it up to the user to transfer the tar file means both the script and the ca make it to the box. Also there is really no need to gzip the file if that is a concern. Just tar'ing it is sufficient.

mccun934 · 2015-09-14T19:17:08Z

I'm in favor of anything that reduces the steps for the user to a 1-2 liner statement if possible.

You could even reduce it to:

curl http:///pub/katello-ca-consumer-latest.sh | sudo bash

keep in mind, wget isn't always installed by default in RHEL/CentOS, curl/tar/gzip are so rely on curl when you can

ehelms · 2015-09-14T19:22:15Z

Tar or not it's still generally insecure unless they go outside of http to
transfer?
On Sep 14, 2015 3:17 PM, "Mike McCune" [email protected] wrote:

I'm in favor of anything that reduces the steps for the user to a 1-2
liner statement if possible.

You could even reduce it to:

curl http:///pub/katello-ca-consumer-latest.sh | sudo bash

keep in mind, wget isn't always installed by default in RHEL/CentOS,
curl/tar/gzip are so rely on curl when you can

—
Reply to this email directly or view it on GitHub
#67 (comment).

parthaa · 2015-09-15T21:04:47Z

What is different about the atomic reconfigure from the existing reconfigure script?

Thoughts on deploying a script that machines download and run that fetches the cert and reconfigure script and then runs them? I imagine this process will be scripted anyway so we could just handle that directly.

I tried very hard on this and almost had it working except for this stupid change in the subs manager command
Atomic Version

subscription-manager config \
  --server.hostname="$KATELLO_SERVER" \
  --server.prefix="$PREFIX" \
  --server.port="$PORT" \
  --rhsm.repo_ca_cert="%(ca_cert_dir)s$KATELLO_CERT" \
  --rhsm.baseurl="$BASEURL"

vs

RPM Version

subscription-manager config \
  --server.hostname="$KATELLO_SERVER" \
  --server.prefix="$PREFIX" \
  --server.port="$PORT" \
  --rhsm.repo_ca_cert="%%(ca_cert_dir)s$KATELLO_CERT" \
  --rhsm.baseurl="$BASEURL"

Notice the extra % in --rhsm.repo_ca_cert (extra % necessary because its an rpm post script)

ehelms · 2015-09-16T12:15:43Z

Ahh, bummer, maybe two is the proper way due to these subtleties :/ Could you re-work the declarations in katello.pp so that the atomic chain of types is not intermixed throughout the RPM side of things?

parthaa · 2015-09-16T21:33:57Z

Could you re-work the declarations in katello.pp so that the atomic chain of types is not intermixed throughout the RPM side of things?

Could you please expand on your comments here, I am trying to figure out what exactly you want me to change. I thought katello.pp was the place put everything that goes on in pub.

parthaa · 2015-09-22T21:37:45Z

Could you re-work the declarations in katello.pp so that the atomic chain of types is not intermixed throughout the RPM side of things?

@ehelms addressed

ehelms · 2015-09-23T17:26:21Z

manifests/katello.pp

@@ -46,5 +54,35 @@
    bootstrap_script => template('certs/rhsm-katello-reconfigure.erb'),
    alias            => $candlepin_cert_rpm_alias,
    subscribe        => $::certs::server_ca,
+  } ~>


This still ties the atomic workflow to the certs_bootstrap_rpm, I think it would be better to break this dependency and let the atomic stuff stand alone i.e. change this line to } and insert a blank line.

parthaa · 2016-02-14T23:26:30Z

@ehelms @stbenjam @jlsherrill @bbuckingham updating this as per our discussion.

Main intent of this commit is to setup rhsm conf on an atomic host to
setup consumer registration (a role similar to the one played by the
consumer bootstrap rpm).

Artifacts produced

/var/www/html/pub/katello-rhsm-consumer on the satellite. This script
contains the code needed to setup rhsm conf on both atomic as well as
non atomic machines. The contents of this script came out of the template
used for post install script in the bootstrap consumer rpm. It has been
tuned to work for both atomic/non-atomic machines
Update to the bootstrap rpm to copy the new script to /usr/bin and
run that as a part of post install.

ehelms · 2016-02-15T13:05:07Z

manifests/katello.pp

  $candlepin_consumer_name        = "katello-ca-consumer-${::fqdn}"
  $candlepin_consumer_summary     = "Subscription-manager consumer certificate for Katello instance ${::fqdn}"
  $candlepin_consumer_description = 'Consumer certificate and post installation script that configures rhsm.'

+  $katello_default_ca_data = file("${certs::pki_dir}/certs/${certs::default_ca_name}.crt")


You'd want to reference certs::katello::default_ca_name

parthaa · 2016-02-15T19:05:53Z

@ehelms, @bbuckingham green!

bbuckingham · 2016-02-18T19:52:32Z

@parthaa, I tested this out on my katello-devel environment with an atomic host and it is behaving perfectly. The full flow that i did was:

import manifest w/ RH OStree content
enable repo & sync OStree repo
create content view - add repo to it, publish it, promote it
create activation key - associate lifecycle environment, content view and subscriptions
installed a rhel atomic host
downloaded the katello-rhsm-consumer from katello (this step and the ones that follow are the important ones wrt the cert)
subscription-manager register the host to katello
performed basic sanity testing of atomic host (e.g. atomic host status, upgrade, ...etc)

Note: i haven't verified a RHEL7 host (non-atomic) yet, but plan to try that as well.

bbuckingham · 2016-02-18T21:44:46Z

@parthaa, I ran a test with a RHEL 7 vagrant host. I was able to download/install the bootstrap rpm, register the host, subscribe to custom content and download RPMs from katello.

bbuckingham · 2016-02-19T14:14:26Z

@parthaa, ACK from me; however, I'd recommend that also get ACK from an additional dev that is more familiar with the puppet-certs module.

ehelms · 2016-02-19T15:15:23Z

I'll take a quick pass today

ehelms · 2016-02-19T15:35:56Z

Testing this against a fresh installation, I immediately run into the following:

[ERROR 2016-02-19 10:29:53 verbose]  Could not find any files from /etc/pki/katello/certs/katello-default-ca.crt at /usr/share/katello-installer/modules/certs/manifests/katello.pp:25 on node nightly.example.com

bbuckingham · 2016-02-19T15:39:43Z

@ehelms, Good catch! My install was a dev install where I re-applied the puppet-certs update and re-ran the katello-installer-devel. (i.e. testing in a clean, but pre-existing environment)

parthaa · 2016-02-19T19:29:41Z

@ehelms updated. If you can figure out a way to get custom types to work with my template let me know :)

parthaa · 2016-02-19T19:31:27Z

@ehelms is the change I had to make to address your comment -> https://github.com/Katello/puppet-certs/pull/67/files#diff-aad4d37a11e8099dfec9d8ad8c38dec0R21

ehelms · 2016-02-19T20:28:23Z

manifests/katello.pp

  $candlepin_consumer_name        = "katello-ca-consumer-${::fqdn}"
  $candlepin_consumer_summary     = "Subscription-manager consumer certificate for Katello instance ${::fqdn}"
  $candlepin_consumer_description = 'Consumer certificate and post installation script that configures rhsm.'

+  $katello_default_ca_file = "${certs::pki_dir}/certs/${certs::katello::default_ca_name}.crt"
+  $katello_server_ca_file = "${certs::pki_dir}/certs/${certs::katello::server_ca_name}.crt"


This is essentially redefining https://github.com/Katello/puppet-certs/blob/master/manifests/init.pp#L130 which you could just use to DRY this up.

ehelms · 2016-02-19T20:29:28Z

Functionally this worked for me through and install and a regenerate.

Main intent of this commit is to setup rhsm conf on an atomic host to setup consumer registration (a role similar to the one played by the consumer bootstrap rpm). Artifacts produced 1) /var/www/html/pub/katello-rhsm-consumer on the satellite. This script contains the code needed to setup rhsm conf on both atomic as well as non atomic machines. The contents of this script came out of the template used for post install script in the bootstrap consumer rpm. It has been tuned to work for both atomic/non-atomic machines 2) Update to the bootstrap rpm to copy the new script to /usr/bin and run that as a part of post install.

ehelms · 2016-02-22T20:19:30Z

ACK - thanks @parthaa

Fixes #10052 - Code to setup rhsm.conf for atomic hosts

parthaa force-pushed the atomic-register branch from 8d63ecb to e8b7a40 Compare September 22, 2015 21:37

ehelms reviewed Sep 23, 2015
View reviewed changes

ehelms added the Waiting on contributor label Nov 25, 2015

parthaa mentioned this pull request Feb 6, 2016

Fixes #13585 - Adding Ostree functionality Katello/katello#5755

Merged

parthaa force-pushed the atomic-register branch 2 times, most recently from 8147629 to e9ab24d Compare February 14, 2016 23:24

parthaa force-pushed the atomic-register branch 7 times, most recently from 4c5f21c to 5396f91 Compare February 14, 2016 23:55

ehelms reviewed Feb 15, 2016
View reviewed changes

parthaa force-pushed the atomic-register branch 2 times, most recently from 2ce2a8f to 7d798b1 Compare February 15, 2016 19:00

parthaa force-pushed the atomic-register branch from 7d798b1 to 40cce3b Compare February 15, 2016 19:03

parthaa force-pushed the atomic-register branch from 40cce3b to 990e26a Compare February 15, 2016 21:33

ehelms added Needs testing Needs re-review and removed Waiting on contributor labels Feb 15, 2016

ehelms added the Waiting on contributor label Feb 19, 2016

parthaa force-pushed the atomic-register branch from 990e26a to 1850a9c Compare February 19, 2016 19:09

ehelms reviewed Feb 19, 2016
View reviewed changes

parthaa force-pushed the atomic-register branch from 1850a9c to 1218a54 Compare February 19, 2016 21:20

parthaa force-pushed the atomic-register branch from 1218a54 to 3028e1f Compare February 19, 2016 21:24

ehelms removed the Waiting on contributor label Feb 22, 2016

ehelms added a commit that referenced this pull request Feb 22, 2016

Merge pull request #67 from parthaa/atomic-register

2b897bb

Fixes #10052 - Code to setup rhsm.conf for atomic hosts

ehelms merged commit 2b897bb into theforeman:master Feb 22, 2016

parthaa deleted the atomic-register branch February 22, 2016 20:44

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fixes #10052 - Code to setup rhsm.conf for atomic hosts #67

Fixes #10052 - Code to setup rhsm.conf for atomic hosts #67

parthaa commented Sep 11, 2015

ehelms commented Sep 12, 2015

parthaa commented Sep 14, 2015

ehelms commented Sep 14, 2015

parthaa commented Sep 14, 2015

ehelms commented Sep 14, 2015

parthaa commented Sep 14, 2015

jlsherrill commented Sep 14, 2015

mccun934 commented Sep 14, 2015

ehelms commented Sep 14, 2015

parthaa commented Sep 15, 2015

ehelms commented Sep 16, 2015

parthaa commented Sep 16, 2015

parthaa commented Sep 22, 2015

ehelms Sep 23, 2015

parthaa commented Feb 14, 2016

ehelms Feb 15, 2016

parthaa commented Feb 15, 2016

bbuckingham commented Feb 18, 2016

bbuckingham commented Feb 18, 2016

bbuckingham commented Feb 19, 2016

ehelms commented Feb 19, 2016

ehelms commented Feb 19, 2016

bbuckingham commented Feb 19, 2016

parthaa commented Feb 19, 2016

parthaa commented Feb 19, 2016

ehelms Feb 19, 2016

ehelms commented Feb 19, 2016

ehelms commented Feb 22, 2016

Fixes #10052 - Code to setup rhsm.conf for atomic hosts #67

Fixes #10052 - Code to setup rhsm.conf for atomic hosts #67

Conversation

parthaa commented Sep 11, 2015

ehelms commented Sep 12, 2015

parthaa commented Sep 14, 2015

ehelms commented Sep 14, 2015

parthaa commented Sep 14, 2015

ehelms commented Sep 14, 2015

parthaa commented Sep 14, 2015

jlsherrill commented Sep 14, 2015

mccun934 commented Sep 14, 2015

ehelms commented Sep 14, 2015

parthaa commented Sep 15, 2015

ehelms commented Sep 16, 2015

parthaa commented Sep 16, 2015

parthaa commented Sep 22, 2015

ehelms Sep 23, 2015

Choose a reason for hiding this comment

parthaa commented Feb 14, 2016

ehelms Feb 15, 2016

Choose a reason for hiding this comment

parthaa commented Feb 15, 2016

bbuckingham commented Feb 18, 2016

bbuckingham commented Feb 18, 2016

bbuckingham commented Feb 19, 2016

ehelms commented Feb 19, 2016

ehelms commented Feb 19, 2016

bbuckingham commented Feb 19, 2016

parthaa commented Feb 19, 2016

parthaa commented Feb 19, 2016

ehelms Feb 19, 2016

Choose a reason for hiding this comment

ehelms commented Feb 19, 2016

ehelms commented Feb 22, 2016