November 2, 2022

OpenShift 4.6 Automation and Integration: Adding Working Nodes

Installer-Provisioned Infrastructure

3.2. Scaling a machine set manually
https://access.redhat.com/documentation/en-us/openshift_container_platform/4.6/html-single/machine_management/index#machineset-manually-scaling_manually-scaling-machineset

In installer-provisioned OCP cluster does the the Machine API automatically performs scaling operations, just modify the number of replicas specified in a Machine Set, and the OCP communicates to the provider to provision or deprovision instances.

User-Provisioned Infrastructure

Adding compute machines to bare metal

10.4. Adding compute machines to bare metal
https://access.redhat.com/documentation/en-us/openshift_container_platform/4.6/html-single/machine_management/index#adding-bare-metal-compute-user-infra

Here you must create the new machines yourself. You can create new Red Hat Enterprise Linux CoreOS (RHCOS) machines either from ISO image or use Preboot eXecution Environment (PXE) boot.

PXE relies on a set of very basic technologies:

  • Dynamic Host Configuration Protocol (DHCP) for locating instances.
  • Trivial File Transfer Protocol (TFTP) for serving the PXE files.
  • HTTP for the ISO images and configuration files.

Example PXE. NOTE THE APPEND PARAMETERS NEED TO BE ON A SINGLE LINE

DEFAULT pxeboot
TIMEOUT 20
PROMPT 0
LABEL pxeboot
  KERNEL http://<HTTP_server>/rhcos-<version>-live-kernel-<architecture>
  APPEND initrd=http://<HTTP_server>/rhcos-<version>-live-initramfs.<architecture>.img 
    coreos.inst.install_dev=/dev/sda 
    coreos.inst.ignition_url=http://<HTTP_server>/worker.ign 
    coreos.live.rootfs_url=http://<HTTP_server>/rhcos-<version>-live-rootfs.<architecture>.img
    coreos.inst=yes
    console=tty0 
    console=ttyS0  
    ip=dhcp rd.neednet=1 

The coreos.inst.ignition_url param points to a working ignition file.

5.1.10. Creating the Kubernetes manifest and Ignition config files
https://access.redhat.com/documentation/en-us/openshift_container_platform/4.6/html-single/installing/index#installation-user-infra-generate-k8s-manifest-ignition_installing-bare-metal

The OpenShift Container Platform installation program ($ ./openshift-install create manifests --dir <installation_directory>) generates

  • bootstrap.ign
  • master.ign
  • worker.ign

Example worker.ign

{
  "ignition": {
    "config": {
      "merge": [
        {
          "source": "https://api-int.mkk.example.com:22623/config/worker",
          "verification": {}
        }
      ]
    },
    "security": {
      "tls": {
        "certificateAuthorities": [
          {
            "source": "data:text/plain;charset=utf-8;base64,XXX...XX",
            "verification": {}
          }
        ]
      }
    },
    "version": "3.1.0"
  },
}

certificateAuthorities contains the custom truststore for the internal CA. You can check a HTTPS endpoint cert chain with openssl, and for above endpoint.

$ openssl s_client -connect api-int.mkk.example.com:22623 -showcerts

And you can check that it is the same Root CA in worker.ign with

$ echo "XXX...XX" | base64 -d | openssl -text -noout

Red Hat OpenStack Platform HAProxy

Chapter 5. Using HAProxy
https://access.redhat.com/documentation/fr-fr/red_hat_openstack_platform/10/html-single/understanding_red_hat_openstack_platform_high_availability/index#haproxy

On a Red Hat OpenStack Platform you must then update the HAProxy (/etc/haproxy/haproxy.cfg) with the nodes

Approving the certificate signing requests for your machines

10.4.3. Approving the certificate signing requests for your machines
https://access.redhat.com/documentation/en-us/openshift_container_platform/4.6/html-single/machine_management/index#installation-approve-csrs_adding-bare-metal-compute-user-infra

$ oc get csr -A

$ oc adm certificate approve csr-abc

Verify

You should now see the new worker nodes, but it will take some time for them to reach Ready state.

$ oc get nodes

October 29, 2022

RH Satellite 6.11: Registering Hosts to Satellite

Fix DNS in Test Environment

Manually set DNS on every servers

# cat /etc/hosts 
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.122.22    satellite.mkk.se satellite
192.168.122.33    rhel90-01.mkk.se rhel90-01

Prepare Hosts for Satellite Registration

# timedatectl
               Local time: Sat 2022-07-02 00:46:59 UTC
           Universal time: Sat 2022-07-02 00:46:59 UTC
                 RTC time: Sat 2022-07-02 00:46:59
                Time zone: Etc/UTC (UTC, +0000)
System clock synchronized: yes
              NTP service: active
          RTC in local TZ: no

# chronyc -n tracking

Registering Hosts to Satellite

Chapter 3. Registering Hosts to Satellite
https://access.redhat.com/documentation/en-us/red_hat_satellite/6.11/html-single/managing_hosts/index#Registering_Hosts_to_Server_managing-hosts

Clear any previous subscription and registration.

[root@rhel90-01 ~]# subscription-manager remove --all
[root@rhel90-01 ~]# subscription-manager unregister
[root@rhel90-01 ~]# subscription-manager clean

Download and install the consumer RPM.

[root@rhel90-01 tmp]# yum localinstall http://satellite.mkk.se/pub/katello-ca-consumer-latest.noarch.rpm

Register the host with a Satellite admin account

# subscription-manager register --org <Organization> --environment <Lifecycle Environment Name>/<Content View>
[root@rhel90-01 tmp]# subscription-manager register --org MKK --environment Development/Base
Registering to: satellite.mkk.se:443/rhsm
Username: admin
Password: 
The system has been registered with ID: a2bdbfbb-13f3-430f-9a11-431da3a43b87
The registered system name is: rhel90-01.mkk.se

[root@rhel90-01 tmp]# subscription-manager status
+-------------------------------------------+
   System Status Details
+-------------------------------------------+
Overall Status: Disabled
Content Access Mode is set to Simple Content Access. This host has access to content, regardless of subscription status.

System Purpose Status: Disabled

[root@rhel90-01 tmp]# subscription-manager repos --list
+----------------------------------------------------------+
    Available Repositories in /etc/yum.repos.d/redhat.repo
+----------------------------------------------------------+
Repo ID:   rhel-9-for-x86_64-baseos-rpms
Repo Name: Red Hat Enterprise Linux 9 for x86_64 - BaseOS (RPMs)
Repo URL:  https://satellite.mkk.se/pulp/content/MKK/Development/Base/content/dist/rhel9/$releasever/x86_64/baseos/os
Enabled:   1

Repo ID:   rhel-9-for-x86_64-appstream-rpms
Repo Name: Red Hat Enterprise Linux 9 for x86_64 - AppStream (RPMs)
Repo URL:  https://satellite.mkk.se/pulp/content/MKK/Development/Base/content/dist/rhel9/$releasever/x86_64/appstream/os
Enabled:   1

[root@rhel90-01 tmp]# cat /etc/yum.repos.d/redhat.repo 
#
# Certificate-Based Repositories
# Managed by (rhsm) subscription-manager
#
# *** This file is auto-generated.  Changes made here will be over-written. ***
# *** Use "subscription-manager repo-override --help" if you wish to make changes. ***
#
# If this file is empty and this system is subscribed consider
# a "yum repolist" to refresh available repos
#

[rhel-9-for-x86_64-appstream-rpms]
name = Red Hat Enterprise Linux 9 for x86_64 - AppStream (RPMs)
baseurl = https://satellite.mkk.se/pulp/content/MKK/Development/Base/content/dist/rhel9/$releasever/x86_64/appstream/os
enabled = 1
gpgcheck = 1
gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
sslverify = 1
sslcacert = /etc/rhsm/ca/katello-server-ca.pem
sslclientkey = /etc/pki/entitlement/7011859186933837834-key.pem
sslclientcert = /etc/pki/entitlement/7011859186933837834.pem
metadata_expire = 1
enabled_metadata = 1

[rhel-9-for-x86_64-baseos-rpms]
name = Red Hat Enterprise Linux 9 for x86_64 - BaseOS (RPMs)
baseurl = https://satellite.mkk.se/pulp/content/MKK/Development/Base/content/dist/rhel9/$releasever/x86_64/baseos/os
enabled = 1
gpgcheck = 1
gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
sslverify = 1
sslcacert = /etc/rhsm/ca/katello-server-ca.pem
sslclientkey = /etc/pki/entitlement/7011859186933837834-key.pem
sslclientcert = /etc/pki/entitlement/7011859186933837834.pem
metadata_expire = 1
enabled_metadata = 1

Verify registred host on Satellite

https://satellite.mkk.se/ -> <Select Organization> -> Hosts -> Content Hosts

RH Satellite 6.11: Managing Red Hat Subscription, Satellite Repository, Lifecycle Environment and Content View

Manage Subscriptions and Content

Create a Subscription Manifest

Chapter 5. Managing Red Hat Subscriptions
https://access.redhat.com/documentation/en-us/red_hat_satellite/6.11/html-single/managing_content/index#Managing_Red_Hat_Subscriptions_content-management

https://access.redhat.com/ -> Subscriptions -> Subscription Allocations -> Create New subscription allocation

Name: mkk-satellite
Type (select a type and version of the subscription management application that you are using): Satellite 6.11

Subscription Allocations -> mkk-satellite -> Subscriptions -> Add Subscriptions

You enable Simple Content Access (SCA) separately for each organization, allowing you to maintain some organizations with the SCA behavior and others without the behavior.

Export a Subscription Manifest from the Customer Portal

Subscription Allocations -> mkk-satellite -> Subscriptions -> Export Manifest

Import a Subscription Manifest to Satellite Server

3.9. Importing a Red Hat Subscription Manifest into Satellite Server
https://access.redhat.com/documentation/en-us/red_hat_satellite/6.11/html-single/installing_satellite_server_in_a_connected_network_environment/index#Importing_a_Red_Hat_Subscription_Manifest_into_Server_satellite

Select Organization to associate the subscription manifest to

https://satellite.mkk.se/ -> <Select Organization> -> Content -> Subscriptions -> Manage Manifest

CDN Configuration
CDN Configuration for Red Hat Content
Red Hat CDN
URL: https://cdn.redhat.com

Manifest
Subscription Manifest
Import New Manifest

Verify Organization, Location and theirs Association

[root@satellite ~]# hammer organization list
---|-------|------|-------------|------
ID | TITLE | NAME | DESCRIPTION | LABEL
---|-------|------|-------------|------
1  | MKK   | MKK  |             | MKK  
---|-------|------|-------------|------

[root@satellite ~]# hammer location list
---|-----------|-----------|------------
ID | TITLE     | NAME      | DESCRIPTION
---|-----------|-----------|------------
2  | Stockholm | Stockholm |            
---|-----------|-----------|------------

Verify that Location is associated with Organization

[root@satellite ~]# hammer location list --organization MKK
---|-----------|-----------|------------
ID | TITLE     | NAME      | DESCRIPTION
---|-----------|-----------|------------
2  | Stockholm | Stockholm |            
---|-----------|-----------|------------

Synchronize Red Hat Content

To Enable a Repository in an Organization

6.5. Enabling Red Hat Repositories
https://access.redhat.com/documentation/en-us/red_hat_satellite/6.11/html-single/managing_content/index#Enabling_Red_Hat_Repositories_content-management

https://satellite.mkk.se/ -> <Select Organization> -> Content -> Red Hat Repositories -> <Repository Name>

To Manually Synchronize Red Hat Product Repositories

6.6. Synchronizing Repositories
https://access.redhat.com/documentation/en-us/red_hat_satellite/6.11/html-single/managing_content/index#Synchronizing_Repositories_content-management

https://satellite.mkk.se/ -> <Select Organization> -> Content -> Products -> <Product Name> -> <Repository Name> -> Sync Now

To Schedule Synchronization of Red Hat Product Repositories

Create Sync Plan

https://satellite.mkk.se/ -> <Select Organization> -> Content -> Sync Plans -> Create Sync Plan

Name: rhel8
Interval: hourly
Start Date: Today
Start Time: Now

Products -> Add -> <Select Product Name> -> Add Selected

Define Download Policies

6.7. Download Policies Overview
https://access.redhat.com/documentation/en-us/red_hat_satellite/6.11/html-single/managing_content/index#Download_Policies_Overview_content-management

https://satellite.mkk.se/ -> <Select Organization> -> Administer -> Settings -> Content

Default Custom Repository download policy: immediate

Default Red Hat Repository download policy: on_demand

Verify Content from the CLI

[root@satellite ~]# hammer repository list 
---|----------------------------------------------------------|-------------------------------------|--------------|----------------------------------------------------------------
ID | NAME                                                     | PRODUCT                             | CONTENT TYPE | URL                                                            
---|----------------------------------------------------------|-------------------------------------|--------------|----------------------------------------------------------------
3  | Red Hat Enterprise Linux 8 for x86_64 - AppStream RPMs 8 | Red Hat Enterprise Linux for x86_64 | yum          | https://cdn.redhat.com/content/dist/rhel8/8/x86_64/appstream/os
1  | Red Hat Enterprise Linux 8 for x86_64 - BaseOS RPMs 8    | Red Hat Enterprise Linux for x86_64 | yum          | https://cdn.redhat.com/content/dist/rhel8/8/x86_64/baseos/os   
---|----------------------------------------------------------|-------------------------------------|--------------|----------------------------------------------------------------

[root@satellite ~]# hammer repository synchronize --id 1

Verify Content from the Web UI

https://satellite.mkk.se/ -> <Select Organization> -> Monitor -> Recurring Logics

https://satellite.mkk.se/ -> <Select Organization> -> -> Content -> Products -> <Product Name> -> <Repository Name>

Create Software Lifecycles

7.3. Creating a Life Cycle Environment Path
https://access.redhat.com/documentation/en-us/red_hat_satellite/6.11/html-single/managing_content/index#Creating_a_Life_Cycle_Environment_Path_content-management

The first environment in every environment path is the Library environment that receives synced content from available sources. The Library environment is continuously syncing with source repositories, which are configured by the sync plans that you assigned to each repository.

Create a lifecycle environment path:

https://satellite.mkk.se/ -> <Select Organization> -> -> Content -> Lifecycle Environments -> Create Environment Path

Name: Development
Label: Development
Descriptiom: Development environment

Add New Environment

Name: Production
Label: Production
Descriptiom: Production environment
Prior Environment: Development 

Verify Content from the CLI

[root@satellite ~]# hammer lifecycle-environment list --organization MKK
---|-------------|------------
ID | NAME        | PRIOR      
---|-------------|------------
2  | Development | Library    
1  | Library     |            
3  | Production  | Development
---|-------------|------------

[root@satellite ~]# hammer lifecycle-environment paths --organization MKK
------------------------------------
LIFECYCLE PATH                      
------------------------------------
Library >> Development >> Production
------------------------------------

Publish and Promote Content Views

Chapter 8. Managing Content Views
https://access.redhat.com/documentation/en-us/red_hat_satellite/6.11/html-single/managing_content/index#Managing_Content_Views_content-management

Content Views

A content view is a customized content repository to define the software that a specific environment uses.

https://satellite.mkk.se/ -> <Select Organization> -> -> Content -> Content Views -> Create New View

Name: Base
Label: Base
Description: Base packages

Manage Repositories in Content Views

Add a repository to a content view:

https://satellite.mkk.se/ -> <Select Organization> -> -> Content -> Content Views -> <Content View Name> -> Repositories -> <Select Checkbox Repository> -> Add Repositories

Content View Filters

Publish a Content View

https://satellite.mkk.se/ -> <Select Organization> -> -> Content -> Content Views -> <Content View Name> -> Publish New Version

Description: Added RHEL 8 BaseOS and AppStream RPM repo

Promote a Content View

After publishing a content view version to the library, you can promote the content view to the first lifecycle environment in the environment path.

To promote a content view:

https://satellite.mkk.se/ -> <Select Organization> -> -> Content -> Content Views -> <Content View Name> -> Versions -> vertical ellipsis menu -> Promote

Description: RHEL 8 BaseOS and AppStream RPM repo

Content View Scenarios

In an all-in-one content view scenario, the content view contains all the needed content for all of your hosts.

In the host-specific content view scenario, dedicated content views exist for each host type.

October 27, 2022

RH Satellite 6.11: Install Standalone in a Connected Network Environment on RHEL 8.6

Install RHEL 8.6

# subscription-manager register

# subscription-manager list --all --available
...
Subscription Name:   Red Hat Enterprise Linux
...
Pool ID:             XXX
...

# subscription-manager attach --pool=XXX

# cat /etc/os-release 
NAME="Red Hat Enterprise Linux"
VERSION="8.6 (Ootpa)"
ID="rhel"
ID_LIKE="fedora"
VERSION_ID="8.6"
PLATFORM_ID="platform:el8"
PRETTY_NAME="Red Hat Enterprise Linux 8.6 (Ootpa)"
...

Install vim and bash-completion

RH Satellite 6.11 System Requirements

https://access.redhat.com/documentation/en-us/red_hat_satellite/6.11/html-single/installing_satellite_server_in_a_disconnected_network_environment/index#system-requirements_satellite

The following requirements apply to the networked base operating system:

  • x86_64 architecture
  • The latest version of Red Hat Enterprise Linux 8 or Red Hat Enterprise Linux 7 Server
  • 4-core 2.0 GHz CPU at a minimum
  • A minimum of 20 GB RAM is required for Satellite Server to function. In addition, a minimum of 4 GB RAM of swap space is also recommended. Satellite running with less RAM than the minimum value might not operate correctly.
  • A unique host name, which can contain lower-case letters, numbers, dots (.) and hyphens (-)
  • A current Red Hat Satellite subscription
  • Administrative user (root) access
  • A system umask of 0022
  • Full forward and reverse DNS resolution using a fully-qualified domain name
# getenforce
Enforcing

# hostnamectl status 
   Static hostname: satellite.mkk.se
...
  Operating System: Red Hat Enterprise Linux 8.6 (Ootpa)
...
      Architecture: x86-64

# echo '192.168.122.22    satellite.mkk.se satellite' >> /etc/hosts 

# ping -c 1 localhost

# ping -c 1 $(hostname -s)

# ping -c 1 $(hostname -f)

# dnf install bind-utils -y

# dig -x 192.168.122.22
...
;; ANSWER SECTION:
22.122.168.192.in-addr.arpa. 0	IN	PTR	satellite.
...

# systemctl status firewalld.service 
● firewalld.service - firewalld - dynamic firewall daemon
   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled)
   Active: active (running) since Thu 2022-10-27 14:54:36 CEST; 25min ago

# firewall-cmd --get-services | grep -i satellite
RH-Satellite-6 RH-Satellite-6-capsule ...

# firewall-cmd --info-service=RH-Satellite-6
RH-Satellite-6
  ports: 5000/tcp 5646-5647/tcp 5671/tcp 8000/tcp 8080/tcp 9090/tcp
  protocols: 
  source-ports: 
  modules: 
  destination: 
  includes: foreman
  helpers: 

# firewall-cmd --permanent --add-service=RH-Satellite-6

# firewall-cmd --reload

# free -g

Install Satellite 6.11

https://access.redhat.com/documentation/en-us/red_hat_satellite/6.11/html-single/installing_satellite_server_in_a_connected_network_environment/index#attaching-infrastructure-subscription_satellite
# subscription-manager list --all --available
...
Subscription Name:   Red Hat Satellite
...
Pool ID:             XXX
...

# subscription-manager attach --pool=XXX

# dnf update

# systemctl reboot
https://access.redhat.com/documentation/en-us/red_hat_satellite/6.11/html-single/installing_satellite_server_in_a_connected_network_environment/index#anchor_xml_id_repositories_rhel_8_xreflabel_repositories_rhel_8_red_hat_enterprise_linux_8
# subscription-manager repos --disable "*"

# subscription-manager repos --enable=rhel-8-for-x86_64-baseos-rpms \
--enable=rhel-8-for-x86_64-appstream-rpms \
--enable=satellite-6.11-for-rhel-8-x86_64-rpms \
--enable=satellite-maintenance-6.11-for-rhel-8-x86_64-rpms

# dnf module enable satellite:el8

# dnf repolist 
Updating Subscription Management repositories.
repo id                                                                                  repo name
rhel-8-for-x86_64-appstream-rpms                                                         Red Hat Enterprise Linux 8 for x86_64 - AppStream (RPMs)
rhel-8-for-x86_64-baseos-rpms                                                            Red Hat Enterprise Linux 8 for x86_64 - BaseOS (RPMs)
satellite-6.11-for-rhel-8-x86_64-rpms                                                    Red Hat Satellite 6.11 for RHEL 8 x86_64 (RPMs)
satellite-maintenance-6.11-for-rhel-8-x86_64-rpms                                        Red Hat Satellite Maintenance 6.11 for RHEL 8 x86_64 (RPMs)

# dnf module list
...
Red Hat Satellite 6.11 for RHEL 8 x86_64 (RPMs)
Name                 Stream          Profiles Summary                                                                                                                                       
satellite            el8 [e]                  Satellite module         

# dnf install satellite

Configure Satellite Installation

https://access.redhat.com/documentation/en-us/red_hat_satellite/6.11/html-single/installing_satellite_server_in_a_connected_network_environment/index#Configuring_Installation_satellite
# dnf install chrony -y

# systemctl enable --now chronyd

# systemctl status chronyd.service 
● chronyd.service - NTP client/server
   Loaded: loaded (/usr/lib/systemd/system/chronyd.service; enabled; vendor preset: enabled)
   Active: active (running) since Thu 2022-10-27 15:12:21 CEST; 17s ago
...

# dnf install sos

# satellite-installer --list-scenarios
Available scenarios
  Capsule (use: --scenario capsule)
        Install a stand-alone Satellite Capsule.
  Satellite (use: --scenario satellite)
        Install Satellite server

# satellite-installer --scenario satellite --help

# satellite-installer --scenario satellite \
--foreman-initial-organization "MKK" \
--foreman-initial-location "Stockholm" \
--foreman-initial-admin-username admin \
--foreman-initial-admin-password redhat123
...
  Success!
  * Satellite is running at https://satellite.mkk.se
      Initial credentials are admin / redhat123

  * To install an additional Capsule on separate machine continue by running:

      capsule-certs-generate --foreman-proxy-fqdn "$CAPSULE" --certs-tar "/root/$CAPSULE-certs.tar"
  * Capsule is running at https://satellite.mkk.se:9090

  The full log is at /var/log/foreman-installer/satellite.log
Package versions are being locked.

Validate a Satellite Server Installation

[root@satellite ~]# satellite-maintain --help

# satellite-maintain health check
Running ForemanMaintain::Scenario::FilteredScenario
================================================================================
Check number of fact names in database:                               [OK]
--------------------------------------------------------------------------------
Check whether all services are running:                               [OK]
--------------------------------------------------------------------------------
Check whether all services are running using the ping call:           [OK]
--------------------------------------------------------------------------------
Check for paused tasks:                                               [OK]
--------------------------------------------------------------------------------
Check whether system is self-registered or not:                       [OK]
--------------------------------------------------------------------------------

[root@satellite ~]# satellite-maintain service list
Running Service List
================================================================================
List applicable services: 
dynflow-sidekiq@.service                   indirect
foreman-proxy.service                      enabled 
foreman.service                            enabled 
httpd.service                              enabled 
postgresql.service                         enabled 
pulpcore-api.service                       enabled 
pulpcore-content.service                   enabled 
pulpcore-worker@.service                   indirect
redis.service                              enabled 
tomcat.service                             enabled

All services listed                                                   [OK]
--------------------------------------------------------------------------------

[root@satellite ~]# cat .hammer/cli.modules.d/foreman.yml 
:foreman:
  # Credentials. You'll be asked for the interactively if you leave them blank here
  :username: 'admin'
  :password: 'redhat123'

[root@satellite ~]# hammer ping
database:         
    Status:          ok
    Server Response: Duration: 1ms
candlepin:        
    Status:          ok
    Server Response: Duration: 38ms
candlepin_auth:   
    Status:          ok
    Server Response: Duration: 24ms
candlepin_events: 
    Status:          ok
    message:         0 Processed, 0 Failed
    Server Response: Duration: 0ms
katello_events:   
    Status:          ok
    message:         0 Processed, 0 Failed
    Server Response: Duration: 0ms
pulp3:            
    Status:          ok
    Server Response: Duration: 75ms
pulp3_content:    
    Status:          ok
    Server Response: Duration: 59ms
foreman_tasks:    
    Status:          ok
    Server Response: Duration: 4ms

# hammer organization list
---|-------|------|-------------|------
ID | TITLE | NAME | DESCRIPTION | LABEL
---|-------|------|-------------|------
1  | MKK   | MKK  |             | MKK  
---|-------|------|-------------|------

# hammer location list
---|-----------|-----------|------------
ID | TITLE     | NAME      | DESCRIPTION
---|-----------|-----------|------------
2  | Stockholm | Stockholm |            
---|-----------|-----------|------------

Open https://satellite.mkk.se in browser and login as admin with password redhat123.

October 20, 2022

Install Visual Studio Code (VSCode) on RHEL, Fedora, or CentOS

Installation

https://code.visualstudio.com/docs/setup/linux#_rhel-fedora-and-centos-based-distributions

sudo rpm --import https://packages.microsoft.com/keys/microsoft.asc

sudo sh -c 'echo -e "[code]\nname=Visual Studio Code\nbaseurl=https://packages.microsoft.com/yumrepos/vscode\nenabled=1\ngpgcheck=1\ngpgkey=https://packages.microsoft.com/keys/microsoft.asc" > /etc/yum.repos.d/vscode.repo'

dnf check-update

sudo dnf install code

Install Python3 on RHEL, Fedora, or CentOS

sudo dnf install python3

The built-in Python 3 installation on Linux works well, but to install other Python packages you must install pip with get-pip.py

https://pip.pypa.io/en/stable/installation/#get-pip-py

Install Python Extension in VS Code

https://code.visualstudio.com/docs/python/python-tutorial

Start VSCode.

$ code

Open View -> Extension and type python and install .

Setup python interpreter in VSCode

  1. Opening the Command Palette (Ctrl+Shift+P)
  2. And type "Python: Select Interpreter"
  3. And select recommended python

Write and Execute Simple Python Script

Create a new file hello.py

#!/usr/bin/env python3
print("Hello World!")

Run from VSCode by pressing Ctrl+F5.

Execute from command line.

$ chmod +x tmp/hello.py
$ tmp/hello.py

OpenShift 4.6 Automation and Integration: Configure trusted TLS Certificates

3.1. Replacing the default ingress certificate

https://access.redhat.com/documentation/en-us/openshift_container_platform/4.6/html-single/security_and_compliance/index#replacing-default-ingress

subjectAltName: DNS:*.apps.<cluster_name>.<base_domain>

$ cat ingress.pem ca.pem > ingress-chain.pem

Create a config map that includes only the root CA certificate used to sign the wildcard certificate:

$ oc create configmap custom-ca \
     --from-file=ca-bundle.crt=ca.pem \
     -n openshift-config

Update the cluster-wide proxy configuration with the newly created config map:

$ oc patch proxy/cluster \
     --type=merge \
     --patch='{"spec":{"trustedCA":{"name":"custom-ca"}}}'

Create a secret that contains the wildcard certificate chain and key:

$ oc create secret tls custom-ingress \
     --cert=ingress-chain.pem \
     --key=</path/to/cert.key> \
     -n openshift-ingress

Update the Ingress Controller configuration with the newly created secret:

$ oc patch ingresscontroller.operator default \
     --type=merge -p \
     '{"spec":{"defaultCertificate": {"name": "custom-ingress"}}}' \
     -n openshift-ingress-operator

$ watch oc get pods -n openshift-ingress

Adding API server certificates

https://access.redhat.com/documentation/en-us/openshift_container_platform/4.6/html-single/security_and_compliance/index#api-server-certificates

subjectAltName: DNS:api.<cluster_name>.<base_domain>

$ cat api.pem ca.pem > api-chain.pem

Create a secret that contains the certificate chain and private key in the openshift-config namespace.

$ oc create secret tls custom-api \
     --cert=api-chain.pem \
     --key=</path/to/cert.key> \
     -n openshift-config

Update the API server to reference the created secret.

$ oc patch apiserver cluster \
     --type=merge -p \
     '{"spec":{"servingCerts": {"namedCertificates":
     [{"names": ["<FQDN>"], 1
     "servingCertificate": {"name": "custom-api"}}]}}}'

$ oc get clusteroperators kube-apiserver

$ oc get events --sort-by='.lastTimestamp' -n openshift-kube-apiserver

Replacing the CA Bundle certificate

https://access.redhat.com/documentation/en-us/openshift_container_platform/4.6/html-single/security_and_compliance/index#ca-bundle-replacing_updating-ca-bundle

See above "Update the cluster-wide proxy configuration with the newly created config map:"

Certificate injection using Operators

https://access.redhat.com/documentation/en-us/openshift_container_platform/4.6/html-single/networking/index#certificate-injection-using-operators_configuring-a-custom-pki

$ oc create configmap trusted-ca -n my-example-custom-ca-ns

$ oc label configmap trusted-ca \
  config.openshift.io/inject-trusted-cabundle=true -n my-example-custom-ca-ns

Add the lines in bold so that the pod mounts the certificate bundle at /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-example-custom-ca-deployment
  namespace: my-example-custom-ca-ns
spec:
  ...
    spec:
      ...
      containers:
        - name: my-container-that-needs-custom-ca
          volumeMounts:
          - name: trusted-ca
            mountPath: /etc/pki/ca-trust/extracted/pem
            readOnly: true
      volumes:
      - name: trusted-ca
        configMap:
          name: trusted-ca
          items:
            - key: ca-bundle.crt
              path: tls-ca-bundle.pem