Introduction to provisioning

Provisioning is a process that starts with a blank machine and ends with a fully configured, ready-to-use operating system. Using orcharhino, you can define and automate fine-grained provisioning for a large number of hosts.

ATIX AG does not support provisioning Rocky Linux hosts using the minimal ISO image because it does not contain the subscription-manager package and its dependencies.

Provisioning methods

orcharhino supports multiple ways to provision a host: image-based, network-based, boot disk-based, and Discovery-based host provisioning. The optimal host provisioning method depends on the type of host, the availability of DHCP, and if it is to be cloned from an existing VM template.

Pick a provisioning method based on the type of host that you want to provision:

Cloud instances

Choose image-based provisioning.

Virtual machines

If you want to clone the VM from a template/golden image, choose image-based provisioning.
If your host has a static IP address, choose boot disk-based provisioning.
If the network of your host provides DHCP, choose network-based provisioning.

Bare-metal hosts

Choose Discovery-based provisioning.
If your host has a static IP address, choose boot disk-based provisioning.
If the network of your host provides DHCP, choose network-based provisioning.

Each provisioning method has a distinct set of steps to provision a host:

Overview of provisioning workflow in orcharhino

Network-based provisioning

Start the system based on your deployment model:
- For a virtual machine, orcharhino instructs the compute resource provider to create a virtual machine.
- For a bare-metal host, you must start it manually. You can do this by hand or through a lights out management tool. For bare-metal hosts, you must submit the MAC address of the new host to orcharhino.
The host boots over the network and automatically searches for a DHCP server, which in turn assigns an IP address and configures the network. The DHCP server provides a PXE/iPXE file, which is a type of provisioning template.

ATIX AG recommends having orcharhino configure and manage the DHCP server or even take over its duties through orcharhino Server or orcharhino Proxy Server.
The new host fetches the Kickstart template from orcharhino Server or orcharhino Proxy Server through TFTP and starts the unattended installation and initial configuration of the operating system.
The new host reports back to orcharhino after finishing the installation. This switches the status in orcharhino to installed.

Boot Disk-based provisioning

The boot_disk.iso image contains the network configuration of the new host, that is it replaces the network configuration through DHCP in contrast to network-based provisioning. There are four different kinds of boot disk images:

Per-host image

This is the default image and does not require DHCP. It only contains the network configuration and then points to orcharhino for the iPXE template followed by the Kickstart template.

Full-host image

This contains the network configuration, the kernel, the iPXE file, and the provisioning template. The image is operating system specific.

Generic image

This is a reusable image which works for any host registered on orcharhino and requires DHCP.

Subnet-generic image

This requires DHCP and chainloads the installation media from your orcharhino Proxy assigned to the subnet of the host.
Both a bare-metal host or a virtual machine require the boot_disk.iso to be attached.
- Virtual machines running on VMware vSphere automatically receive the image and attach it to the new host. For other compute resource providers, you must attach the image by hand.
- Bare-metal host always need to receive the image manually. The same applies if you want to boot from a different boot_disk.iso image, other than the one provided by orcharhino. For bare-metal hosts, the MAC address of the new host must be submitted to orcharhino.
The new host reports back to orcharhino after finishing the installation. This switches the status in orcharhino to installed.

Image-based provisioning (PXE-less provisioning)

Depending on how you want to configure your image, this can be done either

with a finish provisioning template through SSH only, in which case you require the network configuration to be provided through DHCP;
or by using cloud-init with a userdata provisioning template, in which case the image needs to point to your orcharhino Server or orcharhino Proxy Server and have built-in support for cloud-init. The exact configuration depends on your compute resource provider.

ATIX AG recommends using image-based provisioning only for hosts that have access to a DHCP server.

orcharhino instructs the compute resource provider to create a virtual machine based on an existing VM template.
Depending on whether a DHCP server is available,
- the new virtual machine either receives its IP address and network configuration from the DHCP server,
- or a cloud-init provisioning template is used to set up the network configuration. This can be used with and without DHCP.
  
  Alternatively, orcharhino finishes the provisioning process based on provisioning templates through SSH.
If the compute resource is a cloud provider and the image is capable of user_data, the new host does not need to be reachable by orcharhino Server or orcharhino Proxy Server over SSH but can itself notify orcharhino Server or orcharhino Proxy Server when it is ready.

Table 1. Operating system - template mapping
Operating system	Provisioning template
AlmaLinux, Amazon Linux, CentOS, Oracle Linux, Red Hat Enterprise Linux, and Rocky Linux	Kickstart templates
Debian	Preseed templates
SUSE Linux Enterprise Server 16	Agama templates
SUSE Linux Enterprise Server 15 and 12	AutoYaST templates
Ubuntu	Preseed Autoinstall templates

Discovery-based provisioning

Discovery-based provisioning is similar to boot disk-based provisioning. It uses a discovery.iso image to boot the host into a minimal Linux system, reports it to orcharhino, and sends various facts including its MAC address to identify the host. Afterwards, the host is listed on the discovered hosts page. Discovery is an optional plugin.

Depending on whether a DHCP server is available, the host receives its network configuration and Discovery image:
- The host manually receives its network configuration and Discovery image and boots the discovery.iso image in an interactive way.
- The host automatically fetches its network configuration and Discovery image from the DHCP server and boots the discovery.iso image in a non-interactive way.
The discovery.iso image contains the information to which orcharhino Server or orcharhino Proxy Server the host must report and collects facts about the host and sends it to orcharhino Server or orcharhino Proxy Server.
- If there are existing Discovery rules, the host automatically start a network-based provisioning process based on Discovery rules and host groups.
- Else, the host appears on the list of discovered hosts. The following process is very similar to creating a hew host.
  
  There are two ways to start the installation of the operating system:
  - The host is rebooted and then gets the network-based provisioning template by the DHCP server.
  - The installation is started by using kexec with the current network configuration.

Provisioning methods in orcharhino

With orcharhino, you can provision hosts by using the following provisioning methods.

Network based

You can use this method with hosts that are capable of PXE booting or UEFI HTTP booting.

You must configure the necessary network booting services, such as DHCP or TFTP. When you create a host entry, you select a PXE loader that can configure DHCP options for network booting if orcharhino Proxy is set up to configure the DHCP service automatically.

This method uses an operating system installer, such as Anaconda, Debian Installer, Agama, or AutoYaST, and a template-generated file with installation options downloaded from orcharhino, such as Agama, AutoYaST, Kickstart, Preseed, or Preseed Autoinstall templates.

Network based with PXE Discovery: You can create host entries by discovering hosts on a network. The discovery process uses the Discovery image to boot the host and report its hardware details to orcharhino. You can automate provisioning of discovered hosts by creating Discovery rules.

PXE-less Discovery with kexec: You can use this method with hosts that do not support network boot.

You must configure DHCP for host discovery.

This method uses the Discovery image ISO to boot the host and report its hardware details to orcharhino. Using kernel execute (kexec), the Discovery image runs the installer downloaded from orcharhino.

Kernel execute is a Technology Preview feature only. Technology Preview features are not supported by ATIX AG. ATIX AG does not recommend using them in production. These features provide early access to upcoming product features, enabling customers to test functionality and provide feedback during the development process.

For more information about the support scope of ATIX AG Technology Preview features, see Technical Previews in the ATIX Service Portal.

Boot disk based: You can use this method with hosts that do not support network boot or when you do not have the option of configuring network booting services, such as DHCP.

This method supplies the booting capability but the rest of the provisioning process still downloads the installer and template-generated files from orcharhino to automate the installation.
Image based: You can use this method with virtual machines or cloud instances.

This method uses a virtual image template or a cloud image from a compute resource to provision the operating system. orcharhino can customize the image by running either a pre-boot or post-boot configuration script generated from a provisioning template.

Figure 1. Choosing a provisioning method

Provisioning hardware types

With orcharhino, you can provision hosts of the following hardware types.

Bare-metal hosts

orcharhino provisions bare-metal hosts primarily by using network boot and MAC address identification. When provisioning bare-metal hosts with orcharhino, you can do the following:

Create host entries and specify the MAC address of the host to provision.
Boot blank hosts to the orcharhino Discovery service, which creates a pool of hosts that are ready to be provisioned.
Boot and provision PXE-less hosts by using boot disks.

Virtual machines

orcharhino connects to virtualization infrastructure services, such as VMware. You can instruct orcharhino to use a particular hardware profile by defining a compute profile. When provisioning virtual machines with orcharhino, you can do the following:

Select which hardware profile to use.
Provision virtual machines from virtual image templates.
Use the same provisioning methods that you use to provision bare-metal hosts.

Cloud instances

orcharhino connects to private and public cloud providers to provision instances of hosts from images stored in the cloud environment. You can instruct orcharhino to use a particular hardware profile by defining a compute profile.

Additional resources

compute resources

Supported client platforms in provisioning

You can provision supported operating systems on hosts with supported architectures.

The hosts can use the following operating systems:

AlmaLinux
Amazon Linux
CentOS
Debian
Oracle Linux
Red Hat Enterprise Linux
Rocky Linux
SUSE Linux Enterprise Server
Ubuntu

The hosts can use the following architectures:

AMD and Intel 64-bit architectures are supported for all operating systems
The 64-bit ARM architecture and IBM Power Systems, Little Endian, are supported for certain operating systems

For more information, see orcharhino Clients gen3 in the ATIX Service Portal.

Supported cloud providers

You can connect the following cloud providers as compute resources to orcharhino:

Amazon EC2
Google Compute Engine
Microsoft Azure

Additional resources

Supported virtualization infrastructures

You can connect the following virtualization infrastructures as compute resources to orcharhino:

KVM (libvirt)
oVirt
VMware
Proxmox

Additional resources

Using noVNC to access virtual machines

You can use your browser to access the VNC console of VMs created by orcharhino.

orcharhino supports using noVNC on the following virtualization platforms:

VMware
Libvirt
oVirt

Prerequisites

You have a virtual machine created by orcharhino.
For existing virtual machines, ensure that the Display type in the Compute Resource settings is VNC.
You have imported the CA certificate used for orcharhino into your browser. Adding a security exception in the browser is not enough for using noVNC. For more information, see Importing the Katello root CA certificate by using browser in Configuring authentication for orcharhino users.

Procedure

On your orcharhino Server, configure the firewall to allow VNC service on ports 5900 to 5930.
```
$ firewall-cmd --add-port=5900-5930/tcp
$ firewall-cmd --add-port=5900-5930/tcp --permanent
```
In the orcharhino management UI, navigate to Infrastructure > Compute Resources and select the name of a compute resource.
In the Virtual Machines tab, select the name of your virtual machine. Ensure the machine is powered on and then select Console.

Host parameter hierarchy

You can access host parameters when provisioning hosts.

Hosts inherit their parameters from the following locations, in order of increasing precedence:

Parameter Level	Set in orcharhino management UI
Globally defined parameters	Configure > Global parameters
Organization-level parameters	Administer > Organizations
Location-level parameters	Administer > Locations
Domain-level parameters	Infrastructure > Domains
Subnet-level parameters	Infrastructure > Subnets
Operating system-level parameters	Hosts > Provisioning Setup > Operating Systems
Host group-level parameters	Configure > Host Groups
Host parameters	Hosts > All Hosts

Parameter Level

Set in orcharhino management UI

Globally defined parameters

Configure > Global parameters

Organization-level parameters

Administer > Organizations

Location-level parameters

Administer > Locations

Domain-level parameters

Infrastructure > Domains

Subnet-level parameters

Infrastructure > Subnets

Operating system-level parameters

Hosts > Provisioning Setup > Operating Systems

Host group-level parameters

Configure > Host Groups

Host parameters

Hosts > All Hosts

Permissions required to provision hosts

Grant these permissions to enable users to provision hosts without full administrator access.

Resource name Permissions Additional details

Resource name	Permissions	Additional details
Activation Keys	`view_activation_keys`
Ansible role	`view_ansible_roles`	Required if Ansible is used.
Architecture	`view_architectures`
Compute profile	`view_compute_profiles`
Compute resource	`view_compute_resources`, `create_compute_resources`, `destroy_compute_resources`, `power_compute_resources`	Required to provision bare-metal hosts.
`view_compute_resources_vms`, `create_compute_resources_vms`, `destroy_compute_resources_vms`, `power_compute_resources_vms`	Required to provision virtual machines.
Content Views	`view_content_views`
Domain	`view_domains`
Environment	`view_environments`
Host	`view_hosts`, `create_hosts`, `edit_hosts`, `destroy_hosts`, `build_hosts`, `power_hosts`, `play_roles_on_host`
`view_discovered_hosts`, `submit_discovered_hosts`, `auto_provision_discovered_hosts`, `provision_discovered_hosts`, `edit_discovered_hosts`, `destroy_discovered_hosts`	Required if the Discovery service is enabled.
Hostgroup	`view_hostgroups`, `create_hostgroups`, `edit_hostgroups`, `play_roles_on_hostgroup`
Image	`view_images`
Lifecycle environment	`view_lifecycle_environments`
Location	`view_locations`
`assign_locations`	Required to assign locations to hosts or other resources. You can only assign locations that you belong to.
Medium	`view_media`
Operatingsystem	`view_operatingsystems`
Organization	`view_organizations`
`assign_organizations`	Required to assign organizations to hosts or other resources. You can only assign organizations that you belong to.
Parameter	`view_params`, `create_params`, `edit_params`, `destroy_params`
Product and Repositories	`view_products`
Provisioning template	`view_provisioning_templates`
Ptable	`view_ptables`
orcharhino Proxy	`view_smart_proxies`, `view_smart_proxies_puppetca`
`view_openscap_proxies`	Required if the OpenSCAP plugin is enabled.
Subnet	`view_subnets`

Activation Keys

view_activation_keys

Ansible role

view_ansible_roles

Required if Ansible is used.

Architecture

view_architectures

Compute profile

view_compute_profiles

Compute resource

view_compute_resources, create_compute_resources, destroy_compute_resources, power_compute_resources

Required to provision bare-metal hosts.

view_compute_resources_vms, create_compute_resources_vms, destroy_compute_resources_vms, power_compute_resources_vms

Required to provision virtual machines.

Content Views

view_content_views

Domain

view_domains

Environment

view_environments

Host

view_hosts, create_hosts, edit_hosts, destroy_hosts, build_hosts, power_hosts, play_roles_on_host

view_discovered_hosts, submit_discovered_hosts, auto_provision_discovered_hosts, provision_discovered_hosts, edit_discovered_hosts, destroy_discovered_hosts

Required if the Discovery service is enabled.

Hostgroup

view_hostgroups, create_hostgroups, edit_hostgroups, play_roles_on_hostgroup

Image

view_images

Lifecycle environment

view_lifecycle_environments

Location

view_locations

assign_locations

Required to assign locations to hosts or other resources. You can only assign locations that you belong to.

Medium

view_media

Operatingsystem

view_operatingsystems

Organization

view_organizations

assign_organizations

Required to assign organizations to hosts or other resources. You can only assign organizations that you belong to.

Parameter

view_params, create_params, edit_params, destroy_params

Product and Repositories

view_products

Provisioning template

view_provisioning_templates

Ptable

view_ptables

orcharhino Proxy

view_smart_proxies, view_smart_proxies_puppetca

view_openscap_proxies

Required if the OpenSCAP plugin is enabled.

Subnet

view_subnets

Additional resources

The text and illustrations on this page are licensed by ATIX AG under a Creative Commons Attribution Share Alike 4.0 International ("CC BY-SA 4.0") license. This page also contains text from the official Foreman documentation which uses the same license ("CC BY-SA 4.0").