Chapter 2. Installing Capsule Server

Before you install Capsule Server, you should ensure that your environment meets the requirements for installation. Capsule Server has the same requirements for installation as Satellite Server, with the additional requirement that you have not configured it to use a proxy to connect to the Red Hat CDN. For more information, see Section 1.1, “System Requirements”.

2.1. Registering to Satellite Server

Use this procedure to register the base system on which you want to install Capsule to Satellite Server.

Subscription Manifest Considerations

  • The Satellite Server must have a manifest installed with the appropriate repositories for the organization you want the future Capsule to belong to.
  • The manifest must contain repositories for the base system on which you want to install Capsule, as well as any clients that you want to connect to the Capsule.
  • The repositories must be synchronized.

For more information on manifests and repositories, see Managing Subscriptions in the Red Hat Satellite Content Management Guide.

Proxy and Network Considerations

  • The Satellite Server’s base system must be able to resolve the host name of the base system on which you want to install Capsule and vice versa.
  • You must revert any changes related to the use of proxies which prevent access to Red Hat Satellite.
  • You must have configured host and network-based firewalls. For more information, see Section 1.4, “Ports and Firewalls Requirements”.
  • You must have a Satellite Server user name and password. For more information, see Configuring External Authentication in Administering Red Hat Satellite.

Register to Satellite Server

  1. Install the Satellite Server’s CA certificate on the base system on which you want to install Capsule.

    # rpm -Uvh http://satellite.example.com/pub/katello-ca-consumer-latest.noarch.rpm
  2. Register the base system on which you want to install Capsule with the environments that you want the future Capsule to belong to. Use an activation key to simplify specifying the environments.

    # subscription-manager register --org=organization_name --activationkey=example_activation_key

2.2. Identifying and Attaching the Capsule Server Subscription

After you have registered the Capsule Server, you must identify your subscription Pool ID and attach an available subscription. The Red Hat Satellite Infrastructure subscription provides access to the Red Hat Satellite, Red Hat Enterprise Linux, and Red Hat Software Collections (RHSCL) content. This is the only subscription required.

Red Hat Satellite Infrastructure is included with all subscriptions that include Smart Management. For more information, see the Red Hat Knowledgebase solution Satellite Infrastructure Subscriptions MCT3718 MCT3719.

  1. Identify your Capsule Server subscription.

    # subscription-manager list --all --available --matches='Red Hat Satellite Infrastructure Subscription'

    The command displays output similar to the following:

    Subscription Name:   Red Hat Satellite Infrastructure Subscription
    Provides:            Red Hat Beta
                         Red Hat Satellite
                         Red Hat Satellite with Embedded Oracle
                         Red Hat Satellite 5 Managed DB
                         Red Hat Satellite Proxy
                         Red Hat Software Collections (for RHEL Server)
                         Red Hat Satellite Capsule
                         Red Hat Software Collections Beta (for RHEL Server)
                         Red Hat Enterprise Linux High Availability for x86_64
                         Red Hat Ansible Engine
                         Red Hat Enterprise Linux Load Balancer (for RHEL Server)
                         Red Hat Enterprise Linux Server
    SKU:                 MCT3718
    Contract:
    Account:             540155
    Serial:              6960416325892182336
    Pool ID:             8a85f999655dc45a01658350d80d7164
    Provides Management: Yes
    Active:              True
    Quantity Used:       1
    Service Level:       Premium
    Service Type:        L1-L3
    Status Details:      Subscription is current
    Subscription Type:   Standard
    Starts:              08/28/2018
    Ends:                09/19/2019
    System Type:         Physical
  2. Make a note of the Pool ID so that you can attach it to your Satellite host. Your Pool ID is different than the example provided.
  3. Attach your subscription to your Capsule Server, using your Pool ID:

    # subscription-manager attach --pool=pool_id

    The outputs displays something similar to the following:

    Successfully attached a subscription for: Red Hat Capsule Server
  4. To verify that the subscriptions are successfully attached, enter the following command:

    # subscription-manager list --consumed

2.3. Configuring Repositories

  1. Disable all existing repositories.

    # subscription-manager repos --disable "*"
  2. Enable the Red Hat Satellite Capsule, Red Hat Enterprise Linux, and Red Hat Software Collections repositories.

    The Red Hat Software Collections repository provides a later version of Ruby required by some Red Hat Satellite Capsule features, including the Remote Execution feature.

    # subscription-manager repos --enable rhel-7-server-rpms \
    --enable rhel-7-server-satellite-capsule-6.5-rpms \
    --enable rhel-server-rhscl-7-rpms \
    --enable rhel-7-server-satellite-maintenance-6-rpms \
    --enable rhel-7-server-ansible-2.6-rpms
  3. Clear out any metadata left from any non-Red Hat yum repositories.

    # yum clean all
  4. Verify that the repositories have been enabled.

    # yum repolist enabled

2.4. Synchronizing Time

You must start and enable a time synchronizer on the host operating system to minimize the effects of time drift. If a system’s time is incorrect, certificate verification can fail.

Two NTP based time synchronizers are available: chronyd and ntpd. The chronyd implementation is specifically recommended for systems that are frequently suspended and for systems that have intermittent network access. The ntpd implementation should only be used when you specifically need support for a protocol or driver not yet supported by chronyd.

For more information about the differences between ntpd and chronyd, see Differences Between ntpd and chronyd in the Red Hat Enterprise Linux 7 System Administrator’s Guide.

Synchronizing Time using chronyd

  1. Install chronyd.

    # yum install chrony
  2. Start and enable the chronyd service.

    # systemctl start chronyd
    # systemctl enable chronyd

2.5. Installing Capsule Server

  1. Update all packages.

    # yum update
  2. Install the installation package.

    # yum install satellite-capsule

2.6. Performing Initial Configuration of Capsule Server

This section demonstrates a default installation of Capsule Server, including use of default certificates, DNS, and DHCP configuration. For details of more advanced configuration options, see Performing Additional Configuration on Capsule Server.

2.6.1. Configuring Capsule Server with a Default Server Certificate

You can use the default certificate authority (CA) that comes with Capsule Server, which is used by both the server and the client SSL certificates for the authentication of subservices.

If you configured Satellite Server to use a custom SSL certificate, proceed to Section 3.7, “Configuring Capsule Server with a Custom Server Certificate”.

Before You Begin

  • Ensure that Capsule is installed and satellite-installer package is available on Capsule Server.
  • You must have configured host and network-based firewalls. For more information, see Section 1.4, “Ports and Firewalls Requirements”.
  • You must have installed the katello-ca-consumer-latest package. For more information, see Section 2.1, “Registering to Satellite Server”.
  • You must have registered your Capsule Server to the Satellite Server.
  • You must have attached the required subscription to the Capsule Server.

Configure Capsule Server with a Default Server Certificate

  1. On Satellite Server, create the certificates archive:

    # capsule-certs-generate \
    --foreman-proxy-fqdn mycapsule.example.com \
    --certs-tar mycapsule.example.com-certs.tar

    Retain a copy of the satellite-installer command that is output by the capsule-certs-generate command for installing the Capsule Server certificates.

  2. Copy the generated archive .tar file from Satellite Server to Capsule Server.
  3. On Capsule Server, run the satellite-installer command that the capsule-certs-generate command outputs to install Capsule Server certificates:

    # satellite-installer --scenario capsule \
    --foreman-proxy-content-parent-fqdn satellite.example.com \
    --foreman-proxy-register-in-foreman true \
    --foreman-proxy-foreman-base-url https://satellite.example.com \
    --foreman-proxy-trusted-hosts satellite.example.com \
    --foreman-proxy-trusted-hosts mycapsule.example.com \
    --foreman-proxy-oauth-consumer-key UVrAZfMaCfBiiWejoUVLYCZHT2xhzuFV \
    --foreman-proxy-oauth-consumer-secret ZhH8p7M577ttNU3WmUGWASag3JeXKgUX \
    --foreman-proxy-content-certs-tar mycapsule.example.com-certs.tar \
    --puppet-server-foreman-url "https://satellite.example.com"
    Note

    When network connections or ports to the Satellite are not yet open, you can set the --foreman-proxy-register-in-foreman option to false to prevent Capsule from attempting to connect to Satellite and reporting errors. Run the installer again with this option set to true when the network and firewalls are correctly configured.