Examining a Subscription Manifest with the Red Hat Certificate Tool

1. Download the Subscription Manifest from the Customer Portal.

2. Run the command line Red Hat Certificate Tool.

   # rct cat-manifest --no-content manifest_file.zip

   The following extract is from an OpenShift Container Platform, Premium (1-2 Sockets) subscription.

   Subscription:
       Name: OpenShift Container Platform, Premium (1-2 Sockets)
       Quantity: 50
       Created: 2017-09-16T01:47:59.000+0000
       Start Date: 2017-07-04T04:00:00.000+0000
       End Date: 2018-07-04T03:59:59.000+0000
       .
       .
       .
       Virt Limit: unlimited
       Requires Virt-who: True

1. Ensure that a manifest including a VDC subscription has been uploaded to Satellite Server. See Importing a Subscription Manifest into the Satellite Server in the Content Management Guide.
2. Install and configure the virt-who service. See Chapter 5, Configuration and Services.
3. Attach a VDC subscription to the hypervisor. To attach a VDC subscription to a hypervisor using the web UI, click Hosts → Content Hosts, select a host, and click Subscriptions → Subscriptions. Click Add, select the desired subscription, and click Add Selected.
4. Restart the virt-who service so that the hypervisor and virtual machine mapping information is sent back to Satellite.
5. Register virtual machines with an activation key that has auto-attach enabled and no subscriptions attached. This way, the virtual machines will inherit the VDC subscription from the hypervisor.

1. A virtual machine is provisioned using Satellite.
2. The virtual machine requests a subscription from the Satellite Server.
3. As the subscription manager doesn’t yet know to which host the virtual machine belongs, a temporary subscription is granted, valid for a maximum 24 hours.
4. The virt-who daemon connects to the virtualization manager or hypervisor and requests details of the guest virtual machines. By default, this request is made every hour, but the interval is configurable. Red Hat recommends this value remain at the default unless requested by Red Hat Support.
5. The virtualization manager or hypervisor returns to virt-who the list of guest virtual machines, including each UUID.
6. The virt-who daemon reports to the Satellite Server the list of guest virtual machines.
7. The Satellite Server then reconciles the subscriptions required by the virtual machines with those available. If the required subscriptions are available, they are assigned to the virtual machine and its subscription is complete.

1. Open the Satellite web UI and navigate to Hosts > Content Hosts.
2. Click on the host’s name.
3. Check the content of the Subscription Status column. Each host’s subscription status is indicated by colour: green, yellow or red, and its status in text.

1. Install Red Hat Enterprise Linux, version 7 (recommended) or 6.

   Only a CLI environment is required. For help with this step, see the Red Hat Enterprise Linux 7 Installation Guide or the Red Hat Enterprise Linux 6 Installation Guide.

2. Install the Satellite Server’s CA certificate:

   # rpm -ivh http://satellite.example.com/pub/katello-ca-consumer-latest.noarch.rpm

3. Register the Red Hat Enterprise Linux server to the Satellite Server:

   # subscription-manager register --username=admin --password=p@sswd \
   --org=organization_label --auto-attach

4. Open a network port for HTTPS:

   To enable virt-who to communicate with the subscription service, TCP port 443 must be opened.

   On Red Hat Enterprise Linux 7:

   # firewall-cmd --add-port="443/tcp"
   # firewall-cmd --add-port="443/tcp" --permanent

   On Red Hat Enterprise Linux 6:

   # iptables -A INPUT -m state --state NEW -p tcp --dport 443 -j ACCEPT
   # service iptables save

1. Subscribe to the Satellite Tools repository for 6.2.

   On Red Hat Enterprise Linux 7:

   # subscription-manager repos --enable=rhel-7-server-satellite-tools-6.2-rpms

   On Red Hat Enterprise Linux 6:

   # subscription-manager repos --enable=rhel-6-server-satellite-tools-6.2-rpms

2. Verify that the server is subscribed to the Satellite Tools repository for 6.2.

   # subscription-manager repos --list-enabled

   If the output of this command lists the Satellite Tools repository for 6.2 then the subscription has been successful.

   Note

   The virt-who package is available both from the Red Hat Satellite Tools and the Red Hat Enterprise Linux repository. The latest version of the package will be installed by the yum utility.

3. Install the virt-who package.

   # yum install virt-who

1. Create a Satellite user with Administrator access.

   This account is used to allow virt-who to connect to Satellite. Red Hat recommends the account be used for only this purpose. If you have previously created a Satellite user for this purpose, skip this step.

   For help creating the user using the Satellite web UI, see Creating a User in the Server Administration Guide. For help creating the user using the Hammer CLI, see Creating Users in the Hammer CLI Guide.

2. Encrypt the user’s password.

   Encrypting the virt-who account password provides greater security compared with storing the password in plain text. The root account must encrypt the password because the encryption key is written into a file that is only readable by the root account. For that reason, only the root account can decrypt the password.

   1. Execute the virt-who-password utility.

      # virt-who-password

      Enter the password of the account to connect to the hypervisor. The encrypted form of the password is output to the screen.

      # virt-who-password
      Password: <virt who account's password>
      Use following as value for encrypted_password key in the configuration file:
      837a5d6a34203e805c998ce02bf84c03

   2. Make a note of the encrypted password.

1. Encrypt the password of the account to be used to connect to the Red Hat Enterprise Virtualization Manager instance.

   Use the virt-who-password command to encrypt the password. For an example, see Section 5.2, “Creating a User for virt-who”.

2. Copy the template configuration file to a new file.

   On the virt-who host:

   # cp /etc/virt-who.d/template.conf /etc/virt-who.d/rhevmhost1.conf

   To make it easy to identify the configuration file for each hypervisor, use the RHEV-H host’s name as the new file’s name. In this example, the host name is rhevmhost1.

3. Edit the configuration file you just created, changing the example values with those specific to your configuration.

   [rhevmhost1]              1
   type=rhevm                2
   hypervisor_id=hostname    3
   owner=organization_label           4
   env=Library               5
   server=https://rhevmhost1.example.com:443  6
   username=admin@internal   7
   encrypted_password=bd257f93d@482B76e6390cc54aec1a4d  8

   1

   This must be unique for each virt-who instance. Use the Red Hat Virtualization Manager host’s name to make it easy to identify the configuration file for each hypervisor.

   2

   The type=rhevm specifies that this virt-who connection is to a Red Hat Virtualization Manager.

   3

   Specifies that hypervisors will be identified in the Satellite web UI by their host name. The default is to use the hypervisor’s UUID, which is less meaningful.

   4

   Organization’s label. To list available organizations, enter the following command: hammer organization list. Identify which organization you want the virtual hosts to be assigned to, and use the matching entry in the LABEL column.

   5

   This specifies the environment in which the host will be placed and must be Library.

   6

   Red Hat Enterprise Virtualization Manager’s fully qualified host name or IP address. The default port number is 8443, but port 443 is used by Red Hat Enterprise Virtualization Manager after version 3.0.

   7

   Account name by which virt-who is to connect to the Red Hat Enterprise Virtualization Manager instance. The username option requires input in the format username@domain. Note that the read-only access is not sufficient to be able to acquire the Red Hat Virtualization Hypervisor host information via virt-who. It is necessary to create a new role in the Red Hat Enterprise Virtualization environment with the Admin account type and Login Permissions enabled only and assign this role to the user.

   8

   Encrypted password for the account specified by username.

4. Configure virt-who to report to the Satellite Server.

   Add the following configuration lines, replacing example values with those specific to your environment.

   rhsm_hostname=satellite.example.com  1
   rhsm_username=virt_who-admin         2
   rhsm_encrypted_password=bd257f93d@482B76e6390cc54aec1a4d  3
   rhsm_prefix=/rhsm                    4

   1

   Satellite Server’s fully-qualified host name, for example: satellite.example.com

   2

   Satellite user, used by the virt-who daemon to connect to the Satellite Server. This was created in Section 5.2, “Creating a User for virt-who”.

   3

   Encrypted password for the user specified by rhsm_username. This was created in Section 5.2, “Creating a User for virt-who”.

   4

   This must be /rhsm.

Configure virt-who to connect to the Red Hat Enterprise Linux hypervisor

1. Configure the Red Hat Enterprise Linux hypervisor to register to the Satellite Server.

   # yum install http://satellite.example.com/pub/katello-ca-consumer-latest.noarch.rpm

2. Register the Red Hat Enterprise Linux hypervisor to the Satellite Server.

   # subscription-manager register --org=organization_label

3. Attach the VDC subscription to the Red Hat Enterprise Linux hypervisor.

   # subscription-manager attach --pool=subscription_pool_ID

   To find the required subscription pool ID, list all available subscriptions.

   # subscription-manager list --available

4. Copy the template configuration file to a new file.

   To make it easy to identify the configuration file for each hypervisor, use the hypervisor host’s name as the new file’s name. In this example, the host name is rhelhost1.

   cp /etc/virt-who.d/template.conf /etc/virt-who.d/rhelhost1.conf

5. Edit the configuration file you just created, changing the example values with those specific to your configuration.

   [rhelhost1.example.com]         1
   type=vdsm                       2
   hypervisor_id=hostname          3

   1

   Red Hat Enterprise Linux Hypervisor’s FQDN.

   2

   The type=vdsm parameter specifies that this virt-who connection is to a Red Hat Enterprise Linux hypervisor.

   3

   Specifies that hypervisors will be identified in the Satellite web UI by their host name. The default is to use the hypervisor’s UUID, which is less meaningful.

1. Configure the virtual machine to register with Satellite Server.

   # yum install http://satellite.example.com/pub/katello-ca-consumer-latest.noarch.rpm

2. Register the virtual machine. The activation key created for VDC subscription has to be listed first. Add a secondary key for additional product subscription if required.

   # subscription-manager register --activationkey=VDC_Key,secondaryKey --org=organization_label

3. Disable any auto-activated repositories.

   # subscription-manager repos --disable=*

4. Enable the desired repositories for the system.

   # subscription-manager repos --enable=example-repo

Configure virt-who to connect to the Red Hat OpenStack Platform compute node

1. Configure the Red Hat OpenStack Platform compute node to register to the Satellite Server.

   # yum install http://satellite.example.com/pub/katello-ca-consumer-latest.noarch.rpm

2. Register the Red Hat OpenStack Platform compute node to the Satellite Server.

   # subscription-manager register --org="organizational_label"

3. Attach the VDC subscription to the Red Hat OpenStack Platform compute node.

   # subscription-manager attach --pool=subscription_pool_ID

   To find the required subscription pool ID, list all available subscriptions.

   # subscription-manager list --available

4. Copy the template configuration file to a new file.

   To make it easy to identify the configuration file for each hypervisor, use the hypervisor host’s name as the new file’s name. In this example, the host name is rhosphost1.

   cp /etc/virt-who.d/template.conf /etc/virt-who.d/rhosphost1.conf

5. Edit the configuration file you just created, changing the example values with those specific to your configuration.

   [rhosphost1.example.com]    1
   type=libvirt                2
   hypervisor_id=hostname      3

   1

   Red Hat OpenStack Platform compute node’s FQDN.

   2

   The type=libvirt parameter specifies that this virt-who connection is to a Red Hat OpenStack Platform compute node.

   3

   Specifies that hypervisors (compute nodes) will be identified in the Satellite web UI by their host name. The default is to use the hypervisor’s UUID, which is less meaningful.

1. Configure the virtual machine to register with the Satellite Server.

   # yum install http://satellite.example.com/pub/katello-ca-consumer-latest.noarch.rpm

2. Register the virtual machine.

   # subscription-manager register --org="organization_label"

3. Obtain a subscription

   # subscription-manager attach --pool=subscription_pool_ID

   Ensure the subscription pool is the same as that used for the compute node. The virtual machine will obtain a subscription from the Satellite Server. For details of this process, see Section 1.5, “Virtual Machine Subscription Process”.

1. Encrypt the password of the account to be used to connect to VMware vCenter.

   Use the virt-who-password command to encrypt the password. For an example, see Section 5.2, “Creating a User for virt-who”.

2. Copy the template configuration file to a new file.

   To make it easy to identify the configuration file for each hypervisor, use the VMware vCenter host’s name as the new file’s name. In this example, the host name is vcenterhost1.

   # cp /etc/virt-who.d/template.conf /etc/virt-who.d/vcenterhost1.conf

3. Edit the configuration file you just created, changing the example values with those specific to your configuration.

   [vcenterhost1]          1
   type=esx                2
   hypervisor_id=hostname  3
   owner=organization_label            4
   env=Library             5
   server=vcenterhost1.example.com  6
   username=corporate\svc-virt-who 7
   encrypted_password=bd257f93d@482B76e6390cc54aec1a4d  8

   1

   This must be unique for each virt-who instance. Use the VMware vCenter’s host name to make it easy to identify the configuration file for each hypervisor.

   2

   The type=esx parameter specifies that this virt-who connection is to a VMware vCenter.

   3

   Specifies that hypervisors will be identified in the Satellite web UI by their host name. The default is to use the hypervisor’s UUID, which is less meaningful.

   4

   Organization’s label. To list available organizations, enter the following command: hammer organization list. Identify which organization you want the virtual hosts to be assigned to, and use the matching entry in the LABEL column.

   5

   This specifies the environment in which the host will be placed and must be Library.

   6

   VMware vCenter server’s fully qualified host name or IP address.

   7

   Account name by which virt-who is to connect to the hypervisor, in the format domain_name\account_name. Note that only a single backslash separates the values for domain_name and account_name. If you are using a domain account, and the global configuration file /etc/sysconfig/virt-who, then two backslashes are required. For further details, see the Red Hat Knowledgebase solution How to use a windows domain account with virt-who.

   8

   Encrypted password for the account specified by username.

4. Configure virt-who to report to the Satellite Server.

   Add the following configuration lines, replacing example values with those specific to your environment.

   rhsm_hostname=satellite.example.com  1
   rhsm_username=virt_who-admin         2
   rhsm_encrypted_password=bd257f93d@482B76e6390cc54aec1a4d  3
   rhsm_prefix=/rhsm                    4

   1

   Satellite Server’s fully-qualified host name, for example: satellite.example.com

   2

   Satellite user, used by the virt-who daemon to connect to the Satellite Server. This was created in Section 5.2, “Creating a User for virt-who”.

   3

   Encrypted password for the user specified by rhsm_username. This was created in Section 5.2, “Creating a User for virt-who”.

   4

   This must be /rhsm.

1. Enable Windows Remote Management and either the HTTP or HTTPS listener must be running.

   On the Microsoft Hyper-V server:

   # winrm quickconfig

2. Enable remote administration on the Microsoft Hyper-V server.

   On the Microsoft Hyper-V server:

   # netsh advfirewall firewall set rule group=Remote Administration new enable=yes

3. If you are using HTTP, enable the unencrypted connection.

   On the Microsoft Hyper-V server:

   # winrm set winrm/config/service @{AllowUnencrypted="true"}

4. Verify that the authentication method configured on the Microsoft Hyper-V server is either Basic or NTLM.

   On the Microsoft Hyper-V server:

   # winrm get winrm/config/service/auth

5. Obtain organization information.

   On the Satellite Server:

   # hammer organization list

   This will show output similar to the following:

   --|-----------|-----------|------------
   ID| NAME      | LABEL     | DESCRIPTION
   --|-----------|-----------|------------
   1 | RedHat    | RedHat    |
   --|-----------|-----------|------------

   • ID: Organization identifier.
   • NAME: Satellite organization’s name.
   • LABEL: Satellite organization’s label.

   • DESCRIPTION: Satellite organization’s description (optional).

     Identify to which organization you want the virtual hosts assigned, and note the matching entry in the LABEL column. This will later be used in the virt-who configuration.

6. Encrypt the password of the account to be used to connect to the Microsoft Hyper-V server.

   Use the virt-who-password command to encrypt the password. For an example, see Section 5.2, “Creating a User for virt-who”.

7. Copy the template configuration file to a new file.

   On the virt-who host:

   # cp /etc/virt-who.d/template.conf /etc/virt-who.d/hypervhost1.conf

   To make it easy to identify the configuration file for each hypervisor, use the Microsoft Hyper-V server’s host name as the new file’s name. In this example, the host name is hypervhost1.

8. Edit the configuration file you just created, changing the example values with those specific to your configuration.

   [hypervhost1]                   1
   type=hyperv                     2
   hypervisor_id=hostname          3
   owner=organization_label                 4
   env=Library                     5
   server=hypervhost1.example.com  6
   username=admin          7
   encrypted_password=bd257f93d@482B76e6390cc54aec1a4d  8

   1

   This must be unique for each virt-who instance. Use the Microsoft Hyper-V host’s name to make it easy to identify the configuration file for each hypervisor.

   2

   The type=hyperv specifies that this virt-who connection is to a Microsoft Hyper-V host.

   3

   Specifies that hypervisors will be identified in the Satellite web UI by their host name. The default is to use the hypervisor’s UUID, which is less meaningful.

   4

   Organization’s label.

   5

   This specifies the environment in which the host will be placed and must be Library.

   6

   Microsoft Hyper-V fully qualified host name or IP address.

   7

   Account name by which virt-who is to connect to the hypervisor. By default this is Administrator. To use an alternate account, create a user account and assign that account to the following groups (Windows 2012 Server): Hyper-V Administrators and Remote Management Users.

   8

   Encrypted password for the account specified by username.

9. Configure virt-who to report to the Satellite Server.

   Add the following configuration lines, replacing example values with those specific to your environment.

   rhsm_hostname=satellite.example.com  1
   rhsm_username=virt_who-admin         2
   rhsm_encrypted_password=bd257f93d@482B76e6390cc54aec1a4d  3
   rhsm_prefix=/rhsm                    4

   1

   Satellite Server’s fully-qualified host name, for example: satellite.example.com

   2

   Satellite user, used by the virt-who daemon to connect to the Satellite Server. This was created in Section 5.2, “Creating a User for virt-who”.

   3

   Encrypted password for the user specified by rhsm_username. This was created in Section 5.2, “Creating a User for virt-who”.

   4

   This must be /rhsm.

1. Configure the virt-who service for Satellite.

   Edit the global /etc/sysconfig/virt-who configuration file and set the following parameter as shown. This specifies that virt-who is to be communicating with a Satellite host.

   VIRTWHO_SATELLITE6=1

   Warning

   By default virt-who initiates a scan hourly. The interval is defined by the VIRTWHO_INTERVAL global configuration parameter and measured in seconds. It should ONLY be changed on advice from Red Hat Support.

2. Allow for an HTTP proxy between virt-who and guest virtual machines.

   If there is an HTTP proxy between the server on which virt-who is running and the hypervisors or virtualization managers, edit the global /etc/sysconfig/virt-who configuration file and set the following parameter as shown.

   http_proxy=http://proxy-ip-or-hostname:port-number

3. Verify the virt-who configuration.

   Run the command virt-who --one-shot which reads all configuration files, retrieves the list of virtual machines from all sources, then exits immediately. This tests the configuration files, credentials, and connectivity to configured virtualization platforms.

   # virt-who --one-shot

   The output is a list of hypervisors and the hosted guest virtual machines, in JSON format. The following is an extract from virt-who output from a VMware vSphere instance. The output from all hypervisors follows the same structure.

   {
       "guestId": "422f24ed-71f1-8ddf-de53-86da7900df12",
       "state": 5,
       "attributes": {
           "active": 0,
           "virtWhoType": "esx",
           "hypervisorType": "vmware"
       }
   },

4. Start and enable the virt-who service.

   On Red Hat Enterprise Linux 7:

   # systemctl start virt-who.service
   # systemctl enable virt-who.service

   On Red Hat Enterprise Linux 6:

   # service virt-who start
   # chkconfig virt-who on

5. Verify that the virt-who service started successfully.

   On Red Hat Enterprise Linux 7:

   # systemctl status virt-who.service

   The output from this command should be similar to the following. The virt-who.service; enabled output confirms it is enabled and Active: active (running) confirms it is started.

   ● virt-who.service - Daemon for reporting virtual guest IDs to subscription-manager
      Loaded: loaded (/usr/lib/systemd/system/virt-who.service; enabled; vendor preset: disabled)
      Active: active (running) since Fri 2016-03-11 14:59:05 AEST; 47s ago

   On Red Hat Enterprise Linux 6:

   # service virt-who status

   The output from this command should be similar to the following.

   virt-who (pid  7474) is running...

6. Verify that the hypervisors appear in the Satellite web UI.

   In the Satellite web UI, select Hosts → All hosts and confirm that the host (hypervisor) system profiles display.

   Note

   From Red Hat Satellite 6.2, the naming convention for hypervisors changed to the following:

   virt-who-host_name-organization_ID

   The prefix virt-who- was added to make it easier to identify hypervisors. The suffix organization_ID was added to ensure that hypervisors' names were unique, since a hypervisor can be registered with multiple organizations.

7. Assign a subscription to the hypervisor.

   To make Virtual Datacenter subscriptions available for virtual machines, the host system requires a subscription. To know on which host the virtual machine is running:

   1. Open the virtual machine profile from the Hosts page. In the Details tab, the virtual machine displays as Virtual Host hostname.
   2. Click the hostname link that opens the host system profile.
   3. In the Subscriptions tab, assign the subscription to the host system. If you have multiple hypervisors running Red Hat Enterprise Linux guests, attach a subscription to all the hypervisors.