Red Hat Training

A Red Hat training course is available for Red Hat Satellite

Chapter 2. Installing Capsule Server

Before you install Capsule Server, you should ensure that your environment meets the requirements for installation. Capsule Server has the same requirements for installation as Satellite Server, with the additional requirement that you have not configured it to use a proxy to connect to the Red Hat CDN. For more information, see Section 1.1, “System Requirements”.

2.1. Registering to Satellite Server

Use this procedure to register the base system on which you want to install Capsule to Satellite Server.

Subscription Manifest Considerations

  • The Satellite Server must have a manifest installed with the appropriate repositories for the organization you want the future Capsule to belong to.
  • The manifest must contain repositories for the base system on which you want to install Capsule, as well as any clients that you want to connect to the Capsule.
  • The repositories must be synchronized.

For more information on manifests and repositories, see Managing Subscriptions in the Red Hat Satellite Content Management Guide.

Proxy and Network Considerations

  • The Satellite Server’s base system must be able to resolve the host name of the base system on which you want to install Capsule and vice versa.
  • You must revert any changes related to the use of proxies which prevent access to Red Hat Satellite.
  • You must have configured host and network-based firewalls. For more information, see Section 1.4, “Ports and Firewalls Requirements”.
  • You must have a Satellite Server user name and password. For more information, see Configuring External Authentication in Administering Red Hat Satellite.

Register to Satellite Server

  1. Install the Satellite Server’s CA certificate on the base system on which you want to install Capsule.

    # rpm -Uvh
  2. Register the base system on which you want to install Capsule with the environments that you want the future Capsule to belong to. Use an activation key to simplify specifying the environments.

    # subscription-manager register --org=organization_name --activationkey=example_activation_key

2.2. Identifying and Attaching the Capsule Server Subscription

After you have registered the Capsule Server, you must identify your Capsule Server subscription Pool ID. The Pool ID enables you to attach the required subscription to your Capsule Server. The Capsule Server subscription provides access to the Capsule Server content, as well as Red Hat Enterprise Linux, Red Hat Software Collections (RHSCL), and Red Hat Satellite. This is the only subscription required.

  1. Identify your Capsule Server subscription.

    # subscription-manager list --all --available --matches='Red Hat Satellite Infrastructure Subscription'

    The command displays output similar to the following:

        Available Subscriptions
    Subscription Name: Red Hat Satellite Capsule Server
    Provides:          Red Hat Satellite Proxy
                       Red Hat Satellite Capsule
                       Red Hat Software Collections (for RHEL Server)
                       Red Hat Satellite Capsule
                       Red Hat Enterprise Linux Server
                       Red Hat Enterprise Linux High Availability (for RHEL Server)
                       Red Hat Software Collections (for RHEL Server)
                       Red Hat Enterprise Linux Load Balancer (for RHEL Server)
    SKU:               MCT0369
    Pool ID:           9e4cc4e9b9fb407583035861bb6be501
    Available:         3
    Suggested:         1
    Service Level:     Premium
    Service Type:      L1-L3
    Multi-Entitlement: No
    Ends:              10/07/2022
    System Type:       Physical
  2. Make a note of the Pool ID so that you can attach it to your Satellite host. Your Pool ID is different than the example provided.
  3. Attach your subscription to your Capsule Server, using your Pool ID:

    # subscription-manager attach --pool=pool_id

    The outputs displays something similar to the following:

    Successfully attached a subscription for: Red Hat Capsule Server
  4. To verify that the subscriptions are successfully attached, enter the following command:

    # subscription-manager list --consumed

2.3. Configuring Repositories

  1. Disable all existing repositories.

    # subscription-manager repos --disable "*"
  2. Enable the Red Hat Satellite Capsule, Red Hat Enterprise Linux, and Red Hat Software Collections repositories.

    The Red Hat Software Collections repository provides a later version of Ruby required by some Red Hat Satellite Capsule features, including the Remote Execution feature.

    # subscription-manager repos --enable rhel-7-server-rpms \
    --enable rhel-7-server-satellite-capsule-6.4-rpms \
    --enable rhel-server-rhscl-7-rpms \
    --enable rhel-7-server-satellite-maintenance-6-rpms \
    --enable rhel-7-server-ansible-2.6-rpms
  3. Clear out any metadata left from any non-Red Hat yum repositories.

    # yum clean all
  4. Verify that the repositories have been enabled.

    # yum repolist enabled

2.4. Synchronizing Time

You must start and enable a time synchronizer on the host operating system to minimize the effects of time drift. If a system’s time is incorrect, certificate verification can fail.

Two NTP based time synchronizers are available: chronyd and ntpd. The chronyd implementation is specifically recommended for systems that are frequently suspended and for systems that have intermittent network access. The ntpd implementation should only be used when you specifically need support for a protocol or driver not yet supported by chronyd.

For more information about the differences between ntpd and chronyd, see Differences Between ntpd and chronyd in the Red Hat Enterprise Linux 7 System Administrator’s Guide.

Synchronizing Time using chronyd

  1. Install chronyd.

    # yum install chrony
  2. Start and enable the chronyd service.

    # systemctl start chronyd
    # systemctl enable chronyd

2.5. Installing Capsule Server

  1. Update all packages.

    # yum update
  2. Install the installation package.

    # yum install satellite-capsule

2.6. Performing Initial Configuration of Capsule Server

This section demonstrates a default installation of Capsule Server, including use of default certificates, DNS, and DHCP configuration. For details of more advanced configuration options, see Performing Additional Configuration on Capsule Server.

2.6.1. Configuring Capsule Server with a Default Server Certificate

You can use the default certificate authority (CA) that comes with Capsule Server, which is used by both the server and the client SSL certificates for the authentication of subservices.

If you configured Satellite Server to use a custom SSL certificate, proceed to Section 3.7, “Configuring Capsule Server with a Custom Server Certificate”.

Before You Begin

  • Ensure that Capsule is installed and satellite-installer package is available on Capsule Server.
  • You must have configured host and network-based firewalls. For more information, see Section 1.4, “Ports and Firewalls Requirements”.
  • You must have installed the katello-ca-consumer-latest package. For more information, see Section 2.1, “Registering to Satellite Server”.
  • You must have registered your Capsule Server to the Satellite Server.
  • You must have attached the required subscription to the Capsule Server.

Configure Capsule Server with a Default Server Certificate

  1. On Satellite Server, create the certificates archive:

    # capsule-certs-generate \
    --foreman-proxy-fqdn \

    Retain a copy of the satellite-installer command that is output by the capsule-certs-generate command for installing the Capsule Server certificates.

  2. Copy the generated archive .tar file from Satellite Server to Capsule Server.
  3. On Capsule Server, run the satellite-installer command that the capsule-certs-generate command outputs to install Capsule Server certificates:

    # satellite-installer --scenario capsule \
    --foreman-proxy-content-parent-fqdn \
    --foreman-proxy-register-in-foreman true \
    --foreman-proxy-foreman-base-url \
    --foreman-proxy-trusted-hosts \
    --foreman-proxy-trusted-hosts \
    --foreman-proxy-oauth-consumer-key UVrAZfMaCfBiiWejoUVLYCZHT2xhzuFV \
    --foreman-proxy-oauth-consumer-secret ZhH8p7M577ttNU3WmUGWASag3JeXKgUX \
    --foreman-proxy-content-certs-tar \
    --puppet-server-foreman-url ""

    When network connections or ports to the Satellite are not yet open, you can set the --foreman-proxy-register-in-foreman option to false to prevent Capsule from attempting to connect to Satellite and reporting errors. Run the installer again with this option set to true when the network and firewalls are correctly configured.