Configuring orcharhino Proxies with a Load Balancer

Overview of load balancing in orcharhino

You can configure your orcharhino environment to use a load balancer to distribute host requests and network load across multiple orcharhino Proxy Servers. This results in an improved performance on orcharhino Proxy Servers and improved performance and stability for host connections to orcharhino. In a load-balanced setup, orcharhino Proxy functionality supported for load balancing continues to work as expected when one orcharhino Proxy Server is down for planned or unplanned maintenance.

Components of a load-balanced setup

A load-balanced setup in a orcharhino environment consists of the following components:

  • orcharhino Server

  • Two or more orcharhino Proxy Servers

  • A load balancer

  • Multiple hosts

A host sends a request to the TCP load balancer. The load balancer receives the request and determines which orcharhino Proxy Server will handle the request to ensure optimal performance and availability.

Components of a load-balanced setup
Figure 1. Components of a load-balanced setup

Services and features supported in a load-balanced setup

A load balancer in orcharhino distributes load only for the following services and features:

  • Registering hosts

  • Providing content to hosts

  • Configuring hosts by using Puppet

Other orcharhino services, such as provisioning, virt-who, or remote execution, go directly through the individual orcharhino Proxies on which these services are running.

Additional maintenance required for load balancing

Configuring orcharhino Proxies to use a load balancer results in a more complex environment and requires additional maintenance.

The following additional steps are required for load balancing:

  • You must ensure that all orcharhino Proxies have the same content. If you publish a content view version on orcharhino, synchronize it to all orcharhino Proxy Servers.

  • You must upgrade each orcharhino Proxy in sequence.

Preparing orcharhino Proxy Servers for load balancing

orcharhino does not support configuring existing orcharhino Proxy Servers for load balancing. You must create a new orcharhino Proxy Server for this purpose.

Configuring orcharhino Proxy Servers with default SSL certificates for load balancing

You can configure one or more orcharhino Proxy Servers that use default SSL certificates for load balancing.

If you use Puppet in your orcharhino deployment, the configuration steps are different. See Configuring orcharhino Proxy Servers with default SSL certificates for load balancing (with Puppet).

Prerequisites

Configuring orcharhino Proxy Server with default SSL certificates for load balancing without Puppet

On each orcharhino Proxy Server that you want to configure for load balancing, install Katello certificates.

Procedure

  1. On orcharhino Server, generate Katello certificates for orcharhino Proxy Server:

    $ foreman-proxy-certs-generate \
--certs-tar "/root/orcharhino-proxy.network2.example.com-certs.tar" \
--foreman-proxy-cname loadbalancer.example.com \
--foreman-proxy-fqdn orcharhino-proxy.network2.example.com

    Retain a copy of the example orcharhino-installer command that is output by the foreman-proxy-certs-generate command for installing orcharhino Proxy Server certificate.

  2. Copy the certificate archive file from orcharhino Server to orcharhino Proxy Server.

    $ scp /root/orcharhino-proxy.network2.example.com-certs.tar root@orcharhino-proxy.network2.example.com:/root/orcharhino-proxy.network2.example.com-certs.tar

  3. Append the following options to the orcharhino-installer command that you obtain from the output of the foreman-proxy-certs-generate command:

    --certs-cname "loadbalancer.example.com" \
--enable-foreman-proxy-plugin-remote-execution-script

  4. On orcharhino Proxy Server, enter the orcharhino-installer command:

    $ orcharhino-installer \
--certs-cname "loadbalancer.example.com" \
--certs-tar-file "orcharhino-proxy.network2.example.com-certs.tar" \
--enable-foreman-proxy-plugin-remote-execution-script \
--foreman-proxy-foreman-base-url "https://orcharhino.example.com" \
--foreman-proxy-oauth-consumer-key "oauth key" \
--foreman-proxy-oauth-consumer-secret "oauth secret" \
--foreman-proxy-register-in-foreman "true" \
--foreman-proxy-trusted-hosts "orcharhino.example.com" \
--foreman-proxy-trusted-hosts "orcharhino-proxy.network2.example.com"

Configuring orcharhino Proxy Servers with custom SSL certificates for load balancing

You can configure one or more orcharhino Proxy Servers that use custom SSL certificates for load balancing. To do this, configure and install certificates on each orcharhino Proxy Server you want to use for load balancing.

If you use Puppet in your orcharhino deployment, the configuration steps are different. See Configuring orcharhino Proxy Servers with custom SSL certificates for load balancing (with Puppet).

Prerequisites

Creating a custom SSL certificate for orcharhino Proxy Server

On each orcharhino Proxy Server you want to configure for load balancing, create a configuration file for the Certificate Signing Request and include the load balancer and orcharhino Proxy Server as Subject Alternative Names (SAN).

Procedure

  1. To store all the source certificate files, create a directory that is accessible only to the root user:

    $ mkdir /root/orcharhino-proxy_cert

  2. Create a private key with which to sign the certificate signing request (CSR).

    Note that the private key must be unencrypted. If you use a password-protected private key, remove the private key password.

    If you already have a private key for this orcharhino Proxy Server, skip this step.

    $ openssl genrsa -out /root/orcharhino-proxy_cert/orcharhino-proxy_cert_key.pem 4096

  3. Create the /root/orcharhino-proxy_cert/openssl.cnf configuration file for the CSR and include the following content:

    [ req ]
req_extensions = v3_req
distinguished_name = req_distinguished_name
x509_extensions = usr_cert
prompt = no

[ req_distinguished_name ]
commonName = orcharhino-proxy.network2.example.com (1)

[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth, clientAuth, codeSigning, emailProtection
subjectAltName = @alt_names

[alt_names] (2)
DNS.1 = loadbalancer.example.com
DNS.2 = orcharhino-proxy.network2.example.com
    1 The certificate’s common name must match the FQDN of orcharhino Proxy Server. Ensure to change this when running the command on each orcharhino Proxy Server that you configure for load balancing. You can also set a wildcard value *. If you set a wildcard value, you must add the -t foreman-proxy option when you use the katello-certs-check command.
    2 Under [alt_names], include the FQDN of the load balancer as DNS.1 and the FQDN of orcharhino Proxy Server as DNS.2.

  4. Optional: If you want to add Distinguished Name (DN) details to the CSR, add the following information to the [ req_distinguished_name ] section:

    [req_distinguished_name]
CN = orcharhino-proxy.network2.example.com
countryName =My_Country_Name (1)
stateOrProvinceName = My_State_Or_Province_Name (2)
localityName = My_Locality_Name (3)
organizationName = My_Organization_Or_Company_Name
organizationalUnitName = My_Organizational_Unit_Name (4)
    1 Two letter code
    2 Full name
    3 Full name (example: New York)
    4 Division responsible for the certificate (example: IT department)

  5. Generate CSR:

    $ openssl req -new \
-key /root/orcharhino-proxy_cert/orcharhino-proxy_cert_key.pem \ (1)
-config /root/orcharhino-proxy_cert/openssl.cnf \ (2)
-out /root/orcharhino-proxy_cert/orcharhino-proxy_cert_csr.pem (3)
    1 Path to the private key
    2 Path to the configuration file
    3 Path to the CSR to generate

  6. Send the certificate signing request to the certificate authority (CA). The same CA must sign certificates for orcharhino Server and orcharhino Proxy Server.

    When you submit the request, specify the lifespan of the certificate. The method for sending the certificate request varies, so consult the CA for the preferred method. In response to the request, you can expect to receive a CA bundle and a signed certificate, in separate files.

  7. Copy the Certificate Authority bundle and orcharhino Proxy Server certificate file that you receive from the Certificate Authority, and orcharhino Proxy Server private key to your orcharhino Server.

  8. On orcharhino Server, validate orcharhino Proxy Server certificate input files:

    $ katello-certs-check \
-c /root/orcharhino-proxy_cert/orcharhino-proxy_cert.pem \ (1)
-k /root/orcharhino-proxy_cert/orcharhino-proxy_cert_key.pem \ (2)
-b /root/orcharhino-proxy_cert/ca_cert_bundle.pem (3)
    1 orcharhino Proxy Server certificate file, provided by your Certificate Authority
    2 orcharhino Proxy Server’s private key that you used to sign the certificate
    3 Certificate Authority bundle, provided by your Certificate Authority

    If you set the commonName= to a wildcard value *, you must add the -t foreman-proxy option to the katello-certs-check command.

    Retain a copy of the example foreman-proxy-certs-generate command that is output by the katello-certs-check command for creating the Certificate Archive File for this orcharhino Proxy Server.

Configuring orcharhino Proxy Server with custom SSL certificates for load balancing without Puppet

On each orcharhino Proxy Server you want to configure for load balancing, install Katello certificates.

Procedure

  1. Append the following option to the foreman-proxy-certs-generate command that you obtain from the output of the katello-certs-check command:

    --foreman-proxy-cname loadbalancer.example.com

  2. On orcharhino Server, enter the foreman-proxy-certs-generate command to generate orcharhino Proxy certificates:

    $ foreman-proxy-certs-generate \
--certs-tar /root/orcharhino-proxy_cert/orcharhino-proxy.tar \
--foreman-proxy-cname loadbalancer.example.com \
--foreman-proxy-fqdn orcharhino-proxy.network2.example.com \
--server-ca-cert /root/orcharhino-proxy_cert/ca_cert_bundle.pem \
--server-cert /root/orcharhino-proxy_cert/orcharhino-proxy.pem \
--server-key /root/orcharhino-proxy_cert/orcharhino-proxy.pem

    Retain a copy of the example orcharhino-installer command from the output for installing orcharhino Proxy Server certificates.

  3. Copy the certificate archive file from orcharhino Server to orcharhino Proxy Server:

    $ scp /root/orcharhino-proxy.network2.example.com-certs.tar root@orcharhino-proxy.network2.example.com:orcharhino-proxy.network2.example.com-certs.tar

  4. Append the following options to the orcharhino-installer command that you obtain from the output of the foreman-proxy-certs-generate command:

    --certs-cname "loadbalancer.example.com" \
--enable-foreman-proxy-plugin-remote-execution-script

  5. On orcharhino Proxy Server, enter the orcharhino-installer command:

    $ orcharhino-installer \
--certs-cname "loadbalancer.example.com" \
--certs-tar-file "orcharhino-proxy.network2.example.com-certs.tar" \
--enable-foreman-proxy-plugin-remote-execution-script \
--foreman-proxy-foreman-base-url "https://orcharhino.example.com" \
--foreman-proxy-oauth-consumer-key "oauth key" \
--foreman-proxy-oauth-consumer-secret "oauth secret" \
--foreman-proxy-register-in-foreman "true" \
--foreman-proxy-trusted-hosts "orcharhino.example.com" \
--foreman-proxy-trusted-hosts "orcharhino-proxy.network2.example.com"

Configuring orcharhino Proxy Servers with default SSL certificates for load balancing (with Puppet)

If you use Puppet in your orcharhino setup, you can configure one or more orcharhino Proxy Servers that use default SSL certificates for load balancing.

To do this, you configure Puppet certificate signing on one of your orcharhino Proxy Servers. Then, you configure each remaining Puppet orcharhino Proxy used for load balancing to use the certificates. The first orcharhino Proxy Server will generate and sign Puppet certificates for the remaining orcharhino Proxies configured for load balancing.

Prerequisites

Configuring orcharhino Proxy Server with default SSL certificates to generate and sign Puppet certificates

On the orcharhino Proxy Server that will generate Puppet certificates for all other load-balancing orcharhino Proxy Servers, configure Puppet certificate generation and signing.

Procedure

  1. On orcharhino Server, generate Katello certificates for the system where you configure orcharhino Proxy Server to generate and sign Puppet certificates:

    $ foreman-proxy-certs-generate \
--certs-tar "/root/orcharhino-proxy-ca.example.com-certs.tar" \
--foreman-proxy-cname loadbalancer.example.com \
--foreman-proxy-fqdn orcharhino-proxy-ca.example.com

    Retain a copy of the example orcharhino-installer command that is output by the foreman-proxy-certs-generate command for installing orcharhino Proxy Server certificate.

  2. Copy the certificate archive file from orcharhino Server to orcharhino Proxy Server:

    $ scp /root/orcharhino-proxy-ca.example.com-certs.tar root@orcharhino-proxy-ca.example.com:orcharhino-proxy-ca.example.com-certs.tar

  3. Append the following options to the orcharhino-installer command that you obtain from the output of the foreman-proxy-certs-generate command:

    --certs-cname "loadbalancer.example.com" \
--enable-foreman-proxy-plugin-remote-execution-script \
--foreman-proxy-puppetca "true" \
--puppet-ca-server "orcharhino-proxy-ca.example.com" \
--puppet-dns-alt-names "loadbalancer.example.com" \
--puppet-server-ca "true"

  4. On orcharhino Proxy Server, enter the orcharhino-installer command:

    $ orcharhino-installer \
--certs-cname "loadbalancer.example.com" \
--certs-tar-file "orcharhino-proxy-ca.example.com-certs.tar" \
--enable-foreman-proxy-plugin-remote-execution-script \
--enable-puppet \
--foreman-proxy-foreman-base-url "https://orcharhino.example.com" \
--foreman-proxy-oauth-consumer-key "oauth key" \
--foreman-proxy-oauth-consumer-secret "oauth secret" \
--foreman-proxy-puppetca "true" \
--foreman-proxy-register-in-foreman "true" \
--foreman-proxy-trusted-hosts "orcharhino.example.com" \
--foreman-proxy-trusted-hosts "orcharhino-proxy-ca.example.com" \
--puppet-ca-server "orcharhino-proxy-ca.example.com" \
--puppet-dns-alt-names "loadbalancer.example.com" \
--puppet-server true \
--puppet-server-ca "true"

  5. On orcharhino Proxy Server that is the Puppetserver Certificate Authority, stop the Puppet server:

    $ systemctl stop puppetserver

  6. Generate Puppet certificates for all other orcharhino Proxy Servers that you configure for load balancing, except the system where you first configured Puppet certificate signing:

    $ puppetserver ca generate \
--ca-client \
--certname orcharhino-proxy.network2.example.com \
--subject-alt-names loadbalancer.example.com

    This command creates the following files:

    • /etc/puppetlabs/puppet/ssl/certs/orcharhino-proxy.network2.example.com.pem

    • /etc/puppetlabs/puppet/ssl/private_keys/orcharhino-proxy.network2.example.com.pem

    • /etc/puppetlabs/puppet/ssl/public_keys/orcharhino-proxy.network2.example.com.pem

    • /etc/puppetlabs/puppetserver/ca/signed/orcharhino-proxy.network2.example.com.pem

  7. Start the Puppet server:

    $ systemctl start puppetserver

Configuring remaining orcharhino Proxy Servers with default SSL certificates for load balancing

On each load-balancing orcharhino Proxy Server, excluding the orcharhino Proxy Server configured to sign Puppet certificates, configure the system to use Puppet certificates.

Procedure

  1. On orcharhino Server, generate Katello certificates for orcharhino Proxy Server:

    $ foreman-proxy-certs-generate \
--certs-tar "/root/orcharhino-proxy.network2.example.com-certs.tar" \
--foreman-proxy-cname loadbalancer.example.com \
--foreman-proxy-fqdn orcharhino-proxy.network2.example.com

    Retain a copy of the example orcharhino-installer command that is output by the foreman-proxy-certs-generate command for installing orcharhino Proxy Server certificate.

  2. Copy the certificate archive file from orcharhino Server to orcharhino Proxy Server:

    $ scp /root/orcharhino-proxy.network2.example.com-certs.tar root@orcharhino-proxy.network2.example.com:/root/orcharhino-proxy.network2.example.com-certs.tar

  3. On orcharhino Proxy Server, install the puppetserver package:

    $ dnf install puppetserver

  4. On orcharhino Proxy Server, create directories for puppet certificates:

    $ mkdir -p /etc/puppetlabs/puppet/ssl/certs/ \
/etc/puppetlabs/puppet/ssl/private_keys/ \
/etc/puppetlabs/puppet/ssl/public_keys/

  5. On orcharhino Proxy Server, copy the Puppet certificates for this orcharhino Proxy Server from the system where you configure orcharhino Proxy Server to sign Puppet certificates:

    $ scp root@orcharhino-proxy-ca.example.com:/etc/puppetlabs/puppet/ssl/certs/orcharhino-proxy.network2.example.com.pem /etc/puppetlabs/puppet/ssl/certs/orcharhino-proxy.network2.example.com.pem
$ scp root@orcharhino-proxy-ca.example.com:/etc/puppetlabs/puppet/ssl/certs/ca.pem /etc/puppetlabs/puppet/ssl/certs/ca.pem
$ scp root@orcharhino-proxy-ca.example.com:/etc/puppetlabs/puppet/ssl/private_keys/orcharhino-proxy.network2.example.com.pem /etc/puppetlabs/puppet/ssl/private_keys/orcharhino-proxy.network2.example.com.pem
$ scp root@orcharhino-proxy-ca.example.com:/etc/puppetlabs/puppet/ssl/public_keys/orcharhino-proxy.network2.example.com.pem /etc/puppetlabs/puppet/ssl/public_keys/orcharhino-proxy.network2.example.com.pem

  6. On orcharhino Proxy Server, change the /etc/puppetlabs/puppet/ssl/ directory ownership to user puppet and group puppet:

    $ chown -R puppet:puppet /etc/puppetlabs/puppet/ssl/

  7. On orcharhino Proxy Server, set the SELinux context for the /etc/puppetlabs/puppet/ssl/ directory:

    $ restorecon -Rv /etc/puppetlabs/puppet/ssl/

  8. Append the following options to the orcharhino-installer command that you obtain from the output of the foreman-proxy-certs-generate command:

    --certs-cname "loadbalancer.example.com" \
--enable-foreman-proxy-plugin-remote-execution-script \
--foreman-proxy-puppetca "false" \
--puppet-ca-server "orcharhino-proxy-ca.example.com" \
--puppet-dns-alt-names "loadbalancer.example.com" \
--puppet-server-ca "false"

  9. On orcharhino Proxy Server, enter the orcharhino-installer command:

    $ orcharhino-installer \
--certs-cname "loadbalancer.example.com" \
--certs-tar-file "orcharhino-proxy.network2.example.com-certs.tar" \
--enable-foreman-proxy-plugin-remote-execution-script \
--foreman-proxy-foreman-base-url "https://orcharhino.example.com" \
--foreman-proxy-oauth-consumer-key "oauth key" \
--foreman-proxy-oauth-consumer-secret "oauth secret" \
--foreman-proxy-puppetca "false" \
--foreman-proxy-register-in-foreman "true" \
--foreman-proxy-trusted-hosts "orcharhino.example.com" \
--foreman-proxy-trusted-hosts "orcharhino-proxy.network2.example.com" \
--puppet-ca-server "orcharhino-proxy-ca.example.com" \
--puppet-dns-alt-names "loadbalancer.example.com" \
--puppet-server-ca "false"

Managing Puppet limitations with load balancing in orcharhino

If you use Puppet, Puppet certificate signing is assigned to the first orcharhino Proxy that you configure. If the first orcharhino Proxy is down, hosts cannot obtain Puppet content.

Puppet Certificate Authority (CA) management does not support certificate signing in a load-balanced setup. Puppet CA stores certificate information, such as the serial number counter and CRL, on the file system. Multiple writer processes that attempt to use the same data can corrupt it.

To manage this Puppet limitation, complete the following steps:

  1. Configure Puppet certificate signing on one orcharhino Proxy Server, typically the first system where you configure orcharhino Proxy Server for load balancing.

  2. Configure the clients to send CA requests to port 8141 on a load balancer.

  3. Configure a load balancer to redirect CA requests from port 8141 to port 8140 on the system where you configure orcharhino Proxy Server to sign Puppet certificates.

To troubleshoot issues, reproduce the issue on each orcharhino Proxy, bypassing the load balancer. This solution does not use Pacemaker or other similar HA tools to maintain one state across all orcharhino Proxies.

Configuring orcharhino Proxy Servers with custom SSL certificates for load balancing (with Puppet)

You can configure one or more orcharhino Proxy Servers that use custom SSL certificates for load balancing.

Prerequisites

Creating a custom SSL certificate for orcharhino Proxy Server

On each orcharhino Proxy Server you want to configure for load balancing, create a configuration file for the Certificate Signing Request and include the load balancer and orcharhino Proxy Server as Subject Alternative Names (SAN).

Procedure

  1. To store all the source certificate files, create a directory that is accessible only to the root user:

    $ mkdir /root/orcharhino-proxy_cert

  2. Create a private key with which to sign the certificate signing request (CSR).

    Note that the private key must be unencrypted. If you use a password-protected private key, remove the private key password.

    If you already have a private key for this orcharhino Proxy Server, skip this step.

    $ openssl genrsa -out /root/orcharhino-proxy_cert/orcharhino-proxy_cert_key.pem 4096

  3. Create the /root/orcharhino-proxy_cert/openssl.cnf configuration file for the CSR and include the following content:

    [ req ]
req_extensions = v3_req
distinguished_name = req_distinguished_name
x509_extensions = usr_cert
prompt = no

[ req_distinguished_name ]
commonName = orcharhino-proxy.network2.example.com (1)

[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth, clientAuth, codeSigning, emailProtection
subjectAltName = @alt_names

[alt_names] (2)
DNS.1 = loadbalancer.example.com
DNS.2 = orcharhino-proxy.network2.example.com
    1 The certificate’s common name must match the FQDN of orcharhino Proxy Server. Ensure to change this when running the command on each orcharhino Proxy Server that you configure for load balancing. You can also set a wildcard value *. If you set a wildcard value, you must add the -t foreman-proxy option when you use the katello-certs-check command.
    2 Under [alt_names], include the FQDN of the load balancer as DNS.1 and the FQDN of orcharhino Proxy Server as DNS.2.

  4. Optional: If you want to add Distinguished Name (DN) details to the CSR, add the following information to the [ req_distinguished_name ] section:

    [req_distinguished_name]
CN = orcharhino-proxy.network2.example.com
countryName =My_Country_Name (1)
stateOrProvinceName = My_State_Or_Province_Name (2)
localityName = My_Locality_Name (3)
organizationName = My_Organization_Or_Company_Name
organizationalUnitName = My_Organizational_Unit_Name (4)
    1 Two letter code
    2 Full name
    3 Full name (example: New York)
    4 Division responsible for the certificate (example: IT department)

  5. Generate CSR:

    $ openssl req -new \
-key /root/orcharhino-proxy_cert/orcharhino-proxy_cert_key.pem \ (1)
-config /root/orcharhino-proxy_cert/openssl.cnf \ (2)
-out /root/orcharhino-proxy_cert/orcharhino-proxy_cert_csr.pem (3)
    1 Path to the private key
    2 Path to the configuration file
    3 Path to the CSR to generate

  6. Send the certificate signing request to the certificate authority (CA). The same CA must sign certificates for orcharhino Server and orcharhino Proxy Server.

    When you submit the request, specify the lifespan of the certificate. The method for sending the certificate request varies, so consult the CA for the preferred method. In response to the request, you can expect to receive a CA bundle and a signed certificate, in separate files.

  7. Copy the Certificate Authority bundle and orcharhino Proxy Server certificate file that you receive from the Certificate Authority, and orcharhino Proxy Server private key to your orcharhino Server.

  8. On orcharhino Server, validate orcharhino Proxy Server certificate input files:

    $ katello-certs-check \
-c /root/orcharhino-proxy_cert/orcharhino-proxy_cert.pem \ (1)
-k /root/orcharhino-proxy_cert/orcharhino-proxy_cert_key.pem \ (2)
-b /root/orcharhino-proxy_cert/ca_cert_bundle.pem (3)
    1 orcharhino Proxy Server certificate file, provided by your Certificate Authority
    2 orcharhino Proxy Server’s private key that you used to sign the certificate
    3 Certificate Authority bundle, provided by your Certificate Authority

    If you set the commonName= to a wildcard value *, you must add the -t foreman-proxy option to the katello-certs-check command.

    Retain a copy of the example foreman-proxy-certs-generate command that is output by the katello-certs-check command for creating the Certificate Archive File for this orcharhino Proxy Server.

Configuring orcharhino Proxy Server with custom SSL certificates to generate and sign Puppet certificates

On the orcharhino Proxy Server that will generate Puppet certificates for all other load-balancing orcharhino Proxy Servers, configure Puppet certificate generation and signing.

Procedure

  1. Append the following option to the foreman-proxy-certs-generate command that you obtain from the output of the katello-certs-check command:

    --foreman-proxy-cname loadbalancer.example.com

  2. On orcharhino Server, enter the foreman-proxy-certs-generate command to generate orcharhino Proxy certificates:

    $ foreman-proxy-certs-generate \
--certs-tar /root/orcharhino-proxy_cert/orcharhino-proxy-ca.tar \
--foreman-proxy-cname loadbalancer.example.com \
--foreman-proxy-fqdn orcharhino-proxy-ca.example.com \
--server-ca-cert /root/orcharhino-proxy_cert/ca_cert_bundle.pem \
--server-cert /root/orcharhino-proxy_cert/orcharhino-proxy-ca.pem \
--server-key /root/orcharhino-proxy_cert/orcharhino-proxy-ca.pem

    Retain a copy of the example orcharhino-installer command from the output for installing orcharhino Proxy Server certificates.

  3. Copy the certificate archive file from orcharhino Server to orcharhino Proxy Server.

  4. Append the following options to the orcharhino-installer command that you obtain from the output of the foreman-proxy-certs-generate command:

    --enable-foreman-proxy-plugin-remote-execution-script \
--foreman-proxy-puppetca "true" \
--puppet-ca-server "orcharhino-proxy-ca.example.com" \
--puppet-dns-alt-names "loadbalancer.example.com" \
--puppet-server-ca "true"

  5. On orcharhino Proxy Server, enter the orcharhino-installer command:

    $ orcharhino-installer \
--certs-cname "loadbalancer.example.com" \
--certs-tar-file "certs.tgz" \
--enable-foreman-proxy-plugin-remote-execution-script \
--enable-puppet \
--foreman-proxy-foreman-base-url "https://orcharhino.example.com" \
--foreman-proxy-oauth-consumer-key "oauth key" \
--foreman-proxy-oauth-consumer-secret "oauth secret" \
--foreman-proxy-puppetca "true" \
--foreman-proxy-register-in-foreman "true" \
--foreman-proxy-trusted-hosts "orcharhino.example.com" \
--foreman-proxy-trusted-hosts "orcharhino-proxy-ca.example.com" \
--puppet-ca-server "orcharhino-proxy-ca.example.com" \
--puppet-dns-alt-names "loadbalancer.example.com" \
--puppet-server true \
--puppet-server-ca "true"

  6. On orcharhino Proxy Server that is the Puppetserver Certificate Authority, stop the Puppet server:

    $ systemctl stop puppetserver

  7. Generate Puppet certificates for all other orcharhino Proxy Servers that you configure for load balancing, except the system where you first configured Puppet certificate signing:

    $ puppetserver ca generate \
--ca-client \
--certname orcharhino-proxy.network2.example.com \
--subject-alt-names loadbalancer.example.com

    This command creates the following files:

    • /etc/puppetlabs/puppet/ssl/certs/orcharhino-proxy.network2.example.com.pem

    • /etc/puppetlabs/puppet/ssl/private_keys/orcharhino-proxy.network2.example.com.pem

    • /etc/puppetlabs/puppet/ssl/public_keys/orcharhino-proxy.network2.example.com.pem

    • /etc/puppetlabs/puppetserver/ca/signed/orcharhino-proxy.network2.example.com.pem

  8. Start the Puppet server:

    $ systemctl start puppetserver

Configuring remaining orcharhino Proxy Servers with custom SSL certificates for load balancing

On each load-balancing orcharhino Proxy Server, excluding the orcharhino Proxy Server configured to sign Puppet certificates, configure the system to use Puppet certificates.

Procedure

  1. Append the following option to the foreman-proxy-certs-generate command that you obtain from the output of the katello-certs-check command:

    --foreman-proxy-cname loadbalancer.example.com

  2. On orcharhino Server, enter the foreman-proxy-certs-generate command to generate orcharhino Proxy certificates:

    $ foreman-proxy-certs-generate \
--certs-tar /root/orcharhino-proxy_cert/orcharhino-proxy.tar \
--foreman-proxy-cname loadbalancer.example.com \
--foreman-proxy-fqdn orcharhino-proxy.network2.example.com \
--server-ca-cert /root/orcharhino-proxy_cert/ca_cert_bundle.pem \
--server-cert /root/orcharhino-proxy_cert/orcharhino-proxy.pem \
--server-key /root/orcharhino-proxy_cert/orcharhino-proxy.pem

    Retain a copy of the example orcharhino-installer command from the output for installing orcharhino Proxy Server certificates.

  3. Copy the certificate archive file from orcharhino Server to orcharhino Proxy Server.

    $ scp /root/orcharhino-proxy.network2.example.com-certs.tar root@orcharhino-proxy.network2.example.com:orcharhino-proxy.network2.example.com-certs.tar

  4. On orcharhino Proxy Server, install the puppetserver package:

    $ dnf install puppetserver

  5. On orcharhino Proxy Server, create directories for puppet certificates:

    $ mkdir -p /etc/puppetlabs/puppet/ssl/certs/ \
/etc/puppetlabs/puppet/ssl/private_keys/ \
/etc/puppetlabs/puppet/ssl/public_keys/

  6. On orcharhino Proxy Server, copy the Puppet certificates for this orcharhino Proxy Server from the system where you configure orcharhino Proxy Server to sign Puppet certificates:

    $ scp root@orcharhino-proxy-ca.example.com:/etc/puppetlabs/puppet/ssl/certs/orcharhino-proxy.network2.example.com.pem /etc/puppetlabs/puppet/ssl/certs/orcharhino-proxy.network2.example.com.pem
$ scp root@orcharhino-proxy-ca.example.com:/etc/puppetlabs/puppet/ssl/certs/ca.pem /etc/puppetlabs/puppet/ssl/certs/ca.pem
$ scp root@orcharhino-proxy-ca.example.com:/etc/puppetlabs/puppet/ssl/private_keys/orcharhino-proxy.network2.example.com.pem /etc/puppetlabs/puppet/ssl/private_keys/orcharhino-proxy.network2.example.com.pem
$ scp root@orcharhino-proxy-ca.example.com:/etc/puppetlabs/puppet/ssl/public_keys/orcharhino-proxy.network2.example.com.pem /etc/puppetlabs/puppet/ssl/public_keys/orcharhino-proxy.network2.example.com.pem

  7. On orcharhino Proxy Server, change the /etc/puppetlabs/puppet/ssl/ directory ownership to user puppet and group puppet:

    $ chown -R puppet:puppet /etc/puppetlabs/puppet/ssl/

  8. On orcharhino Proxy Server, set the SELinux context for the /etc/puppetlabs/puppet/ssl/ directory:

    $ restorecon -Rv /etc/puppetlabs/puppet/ssl/

  9. Append the following options to the orcharhino-installer command that you obtain from the output of the foreman-proxy-certs-generate command:

    --certs-cname "loadbalancer.example.com" \
--enable-foreman-proxy-plugin-remote-execution-script \
--foreman-proxy-puppetca "false" \
--puppet-ca-server "orcharhino-proxy-ca.example.com" \
--puppet-dns-alt-names "loadbalancer.example.com" \
--puppet-server-ca "false"

  10. On orcharhino Proxy Server, enter the orcharhino-installer command:

    $ orcharhino-installer \
--certs-cname "loadbalancer.example.com" \
--certs-tar-file "orcharhino-proxy.network2.example.com-certs.tar" \
--enable-foreman-proxy-plugin-remote-execution-script \
--foreman-proxy-foreman-base-url "https://orcharhino.example.com" \
--foreman-proxy-oauth-consumer-key "oauth key" \
--foreman-proxy-oauth-consumer-secret "oauth secret" \
--foreman-proxy-puppetca "false" \
--foreman-proxy-register-in-foreman "true" \
--foreman-proxy-trusted-hosts "orcharhino.example.com" \
--foreman-proxy-trusted-hosts "orcharhino-proxy.network2.example.com" \
--puppet-ca-server "orcharhino-proxy-ca.example.com" \
--puppet-dns-alt-names "loadbalancer.example.com" \
--puppet-server-ca "false"

Managing Puppet limitations with load balancing in orcharhino

If you use Puppet, Puppet certificate signing is assigned to the first orcharhino Proxy that you configure. If the first orcharhino Proxy is down, hosts cannot obtain Puppet content.

Puppet Certificate Authority (CA) management does not support certificate signing in a load-balanced setup. Puppet CA stores certificate information, such as the serial number counter and CRL, on the file system. Multiple writer processes that attempt to use the same data can corrupt it.

To manage this Puppet limitation, complete the following steps:

  1. Configure Puppet certificate signing on one orcharhino Proxy Server, typically the first system where you configure orcharhino Proxy Server for load balancing.

  2. Configure the clients to send CA requests to port 8141 on a load balancer.

  3. Configure a load balancer to redirect CA requests from port 8141 to port 8140 on the system where you configure orcharhino Proxy Server to sign Puppet certificates.

To troubleshoot issues, reproduce the issue on each orcharhino Proxy, bypassing the load balancer. This solution does not use Pacemaker or other similar HA tools to maintain one state across all orcharhino Proxies.

Upgrading orcharhino Proxy Servers in a load-balancing setup

There are no additional steps required for orcharhino Proxy Servers in a load-balancing configuration.

Setting the load balancer for host registration

You can configure orcharhino to register clients through a load balancer when using the host registration feature.

You will be able to register hosts to the load balancer instead of orcharhino Proxy. The load balancer will decide through which orcharhino Proxy to register the host at the time of request. Upon registration, the subscription manager on the host will be configured to manage content through the load balancer.

Prerequisites
Procedure

  1. On all orcharhino Proxy Servers, set the registration and template URLs using orcharhino-installer:

    $ orcharhino-installer \
--foreman-proxy-registration-url "https://loadbalancer.example.com:9090" \
--foreman-proxy-template-url "http://loadbalancer.example.com:8000"

  2. In the orcharhino management UI, navigate to Infrastructure > orcharhino Proxies.

  3. For each orcharhino Proxy, click the dropdown menu in the Actions column and select Refresh.

Installing the load balancer

The following example provides general guidance for configuring an HAProxy load balancer using Enterprise Linux 9 or Enterprise Linux 8. However, you can install any suitable load balancing software solution that supports TCP forwarding.

Procedure

  1. Install HAProxy:

    $ dnf install haproxy

  2. Install the following package that includes the semanage tool:

    $ dnf install policycoreutils-python-utils

  3. Configure SELinux to allow HAProxy to bind any port:

    $ semanage boolean --modify --on haproxy_connect_any

  4. Configure the load balancer to balance the network load for the ports as described in Ports configuration for the load balancer. For example, to configure ports for HAProxy, edit the /etc/haproxy/haproxy.cfg file to correspond with the table.

    Table 1. Ports configuration for the load balancer
    Service Port Mode Balance Mode Destination

    HTTP

    80

    TCP

    roundrobin

    port 80 on all orcharhino Proxy Servers

    HTTPS and RHSM

    443

    TCP

    source

    port 443 on all orcharhino Proxy Servers

    Anaconda for template retrieval

    8000

    TCP

    roundrobin

    port 8000 on all orcharhino Proxy Servers

    Puppet (Optional)

    8140

    TCP

    roundrobin

    port 8140 on all orcharhino Proxy Servers

    PuppetCA (Optional)

    8141

    TCP

    roundrobin

    port 8140 only on the system where you configure orcharhino Proxy Server to sign Puppet certificates

    orcharhino Proxy HTTPS for Host Registration and optionally OpenSCAP

    9090

    TCP

    roundrobin

    port 9090 on all orcharhino Proxy Servers

  5. Configure the load balancer to disable SSL offloading and allow client-side SSL certificates to pass through to back end servers. This is required because communication from clients to orcharhino Proxy Servers depends on client-side SSL certificates.

  6. Start and enable the HAProxy service:

    $ systemctl enable --now haproxy

Verifying the load balancing configuration

Use this procedure to verify the load balancing configuration for each orcharhino Proxy Server.

Procedure

  1. Shut down the base operating system for your orcharhino Proxy Server.

  2. Verify that content or subscription management features are available on clients registered to this orcharhino Proxy. For example, enter the subscription-manager refresh command on a client.

  3. Restart the base operating system for your orcharhino Proxy Server.

Registering clients to the load balancer

To balance the load of network traffic from clients, you must register the clients to the load balancer.

To register clients, proceed with one of the following procedures:

Registering clients using host registration

You can register hosts with orcharhino using the host registration feature in the orcharhino management UI, Hammer CLI, or the orcharhino API. For more information, see Registering Hosts in Managing Hosts.

Prerequisites
Procedure

  1. In the orcharhino management UI, navigate to Hosts > Register Host.

  2. From the orcharhino Proxy dropdown list, select the load balancer.

  3. Select Force to register a host that has been previously registered to a orcharhino Proxy Server.

  4. From the Activation Keys list, select the activation keys to assign to your host.

  5. Click Generate to create the registration command.

  6. Click on the files icon to copy the command to your clipboard.

  7. Connect to your host using SSH and run the registration command.

  8. Ensure that the appropriate repositories have been enabled:

    • On Debian/Ubuntu: Check the /etc/apt/sources.list file and ensure that the appropriate repositories have been enabled.

    • On Enterprise Linux: Check the /etc/yum.repos.d/redhat.repo file and ensure that the appropriate repositories have been enabled.

    • On SUSE Linux Enterprise Server: Check the /etc/zypp/repos.d/ directory and ensure that the appropriate repositories have been enabled.

CLI procedure

  1. Generate the host registration command using the Hammer CLI:

    $ hammer host-registration generate-command \
--activation-keys "My_Activation_Key"

    If your hosts do not trust the SSL certificate of orcharhino Server, you can disable SSL validation by adding the --insecure flag to the registration command.

    $ hammer host-registration generate-command \
--activation-keys "My_Activation_Key" \
--insecure true

    Include the --smart-proxy-id My_orcharhino_Proxy_ID option. You can use the ID of any orcharhino Proxy Server that you configured for host registration load balancing. orcharhino will apply the load balancer to the registration command automatically.

    Include the --force option to register a host that has been previously registered to a orcharhino Proxy Server.

  2. Connect to your host using SSH and run the registration command.

  3. Ensure that the appropriate repositories have been enabled:

    • On Debian/Ubuntu: Check the /etc/apt/sources.list file and ensure that the appropriate repositories have been enabled.

    • On Enterprise Linux: Check the /etc/yum.repos.d/redhat.repo file and ensure that the appropriate repositories have been enabled.

    • On SUSE Linux Enterprise Server: Check the /etc/zypp/repos.d/ directory and ensure that the appropriate repositories have been enabled.

API procedure

  1. Generate the host registration command using the orcharhino API:

    $ curl -X POST https://orcharhino.example.com/api/registration_commands \
--user "My_User_Name" \
-H 'Content-Type: application/json' \
-d '{ "registration_command": { "activation_keys": ["My_Activation_Key_1, My_Activation_Key_2"] }}'

    If your hosts do not trust the SSL certificate of orcharhino Server, you can disable SSL validation by adding the --insecure flag to the registration command.

    $ curl -X POST https://orcharhino.example.com/api/registration_commands \
--user "My_User_Name" \
-H 'Content-Type: application/json' \
-d '{ "registration_command": { "activation_keys": ["My_Activation_Key_1, My_Activation_Key_2"], "insecure": true }}'

    Use an activation key to simplify specifying the environments. For more information, see Managing Activation Keys in Managing Content.

    Include { "smart_proxy_id": My_orcharhino_Proxy_ID }. You can use the ID of any orcharhino Proxy Server that you configured for host registration load balancing. orcharhino will apply the load balancer to the registration command automatically.

    Include { "force": true } to register a host that has been previously registered to a orcharhino Proxy Server.

    To enter a password as a command line argument, use username:password syntax. Keep in mind this can save the password in the shell history. Alternatively, you can use a temporary personal access token instead of a password. To generate a token in the orcharhino management UI, navigate to My Account > Personal Access Tokens.

  2. Connect to your host using SSH and run the registration command.

  3. Ensure that the appropriate repositories have been enabled:

    • On Debian/Ubuntu: Check the /etc/apt/sources.list file and ensure that the appropriate repositories have been enabled.

    • On Enterprise Linux: Check the /etc/yum.repos.d/redhat.repo file and ensure that the appropriate repositories have been enabled.

    • On SUSE Linux Enterprise Server: Check the /etc/zypp/repos.d/ directory and ensure that the appropriate repositories have been enabled.

(Deprecated) Registering clients using the bootstrap script

To register clients, enter the following command on the client. You must complete the registration procedure for each client.

Prerequisites
Procedure

  • On Enterprise Linux 8, enter the following command:

    $ /usr/libexec/platform-python bootstrap.py \
--activationkey="My_Activation_Key" \
--enablerepos=orcharhino Client \ (1)
--force \ (2)
--hostgroup="My_Host_Group" \
--location="My_Location" \
--login=admin \
--organization="My_Organization" \
--puppet-ca-port 8141 \ (3)
--server loadbalancer.example.com
    1 Replace <arch> with the client architecture, for example x86.
    2 Include the --force option to register the client that has been previously registered to a standalone orcharhino Proxy.
    3 Include the --puppet-ca-port 8141 option if you use Puppet.

  • On Enterprise Linux 7 or 6, enter the following command:

    $ python bootstrap.py --login=admin \
--activationkey="My_Activation_Key" \
--enablerepos=orcharhino Client \
--force \ (1)
--hostgroup="My_Host_Group" \
--location="My_Location" \
--organization="My_Organization" \
--puppet-ca-port 8141 \ (2)
--server loadbalancer.example.com
    1 Include the --force option to register the client that has been previously registered to a standalone orcharhino Proxy.
    2 Include the --puppet-ca-port 8141 option if you use Puppet.

The script prompts for the password corresponding to the orcharhino user name you entered with the --login option.

Propagating SCAP content through the load balancer

If you use OpenSCAP to manage security compliance on your clients, you must configure the SCAP client to send ARF reports to the load balancer instead of orcharhino Proxy. The configuration procedure depends on the method you have selected to deploy compliance policies.

Propagating SCAP content using Ansible deployment

Using this procedure, you can promote Security Content Automation Protocol (SCAP) content through the load balancer in the scope of the Ansible deployment method.

Prerequisites
Procedure

  1. In the orcharhino management UI, navigate to Configure > Ansible > Variables.

  2. Search for the foreman_scap_client_port variable and click its name.

  3. In the Default Behavior area, ensure that the Override checkbox is selected.

  4. In the Parameter Type list, ensure that integer is selected.

  5. In the Default Value field, enter 9090.

  6. In the Specify Matchers area, remove all matchers that override the default value.

  7. Click Submit.

  8. Search for the foreman_scap_client_server variable and click its name.

  9. In the Default Behavior area, ensure that the Override checkbox is selected.

  10. In the Parameter Type list, ensure that string is selected.

  11. In the Default Value field, enter the FQDN of your load balancer, such as loadbalancer.example.com.

  12. In the Specify Matchers area, remove all matchers that override the default value.

  13. Click Submit.

  14. Continue with deploying a compliance policy using Ansible. For more information, see:

Verification

  • On the client, verify that the /etc/foreman_scap_client/config.yaml file contains the following lines:

    $ Foreman proxy to which reports should be uploaded
:server: 'loadbalancer.example.com'
:port: 9090

Propagating SCAP content using Puppet deployment

Using this procedure, you can promote Security Content Automation Protocol (SCAP) content through the load balancer in the scope of the Puppet deployment method.

Prerequisites
Procedure

  1. In the orcharhino management UI, navigate to Configure > Puppet ENC > Classes.

  2. Click foreman_scap_client.

  3. Click the Smart Class Parameter tab.

  4. In the pane to the left of the Smart Class Parameter window, click port.

  5. In the Default Behavior area, select the Override checkbox.

  6. From the Key Type list, select integer.

  7. In the Default Value field, enter 9090.

  8. In the pane to the left of the Smart Class Parameter window, click server.

  9. In the Default Behavior area, select the Override checkbox.

  10. From the Key Type list, select string.

  11. In the Default Value field, enter the FQDN of your load balancer, such as loadbalancer.example.com.

  12. In the lower left of the Smart Class Parameter window, click Submit.

  13. Continue with deploying a compliance policy using Puppet. For more information, see:

Verification

  • On the client, verify that the /etc/foreman_scap_client/config.yaml file contains the following lines:

    $ Foreman proxy to which reports should be uploaded
:server: 'loadbalancer.example.com'
:port: 9090

The text and illustrations on this page are licensed by ATIX AG under a Creative Commons Attribution Share Alike 4.0 International ("CC BY-SA 4.0") license. This page also contains text from the official Foreman documentation which uses the same license ("CC BY-SA 4.0").