GSTN - Satelite As Build Document

Red Hat Satellite is an easy-to-use system management product that helps keep Red Hat Enterprise Linux® environments and other Red Hat infrastructure running efficiently, properly secured, and compliant with various standards.

Provisioning - Provision on bare metal, virtualized infrastructure, and public or private clouds—all from 1 centralized console and with 1 simple process.

Software management - Use a systematic process to apply content, including patches, to deployed systems in all stages, from development to production. The result is better consistency and availability of systems, letting IT more quickly respond to business needs and vulnerabilities.

Configuration management - Configure your Red Hat systems in a more agile and efficient way. Analyze and automatically remediate configuration drift and control, and enforce the desired host end state, all from 1 convenient console.

Subscription management - Easily report and map your Red Hat-purchased products to registered systems for end-to-end subscription consumption visibility.

1.2. Architecture at GSTN[edit]

Satellite server is placed in MZ zone will update the Server in Same zone. For DMZ zone server updates and patches policy at firewall will be defined.Satellite will get the update from Internet via firewall / Proxy.

1.3. Server Sizing Considerations[edit]

ServerName	OS	Role	vRAM	vCPU	HDD [GB]	VLANID	IP Address	Subnet	Gateway
GD9105	RHEL	Patch (Linux)	8	4	OS-100 Data-400	101	172.18.101.16	255.255.255.0	172.18.101.1

1.4. How it Works[edit]

RHN Satellite Server consists of the following components:

Database — for the Stand-Alone Database, this may be the organization's existing database or,

preferably, a separate machine. RHN Satellite Server supports Oracle Database 10g Release 2, Standard or Enterprise Edition. For the Embedded Database, the database comes bundled with RHN Satellite Server and is installed on the same machine as the Satellite during the installation process. GTSN environment of Redhat Satellite server will have Embedded database which is postgreSQL and mongodb.

RHN Satellite Server — core "business logic" and entry point for Red Hat Update Agent running on client systems. The RHN Satellite Server also includes an Apache HTTP Server (serving XML-RPC requests).

RHN Satellite Server Web interface — advanced system, system group, user, and channel management interface.

RPM Repository — package repository for Red Hat RPM packages and custom RPM packages identified by the organization.

Management Tools:

Database and file system synchronization tools

RPM importing tools

Channel maintenance tools (Web-based)

Errata management tools (Web-based)

User management tools (Web-based)

Client system and system grouping tools (Web-based)

Red Hat Update Agent on the client systems

The Red Hat Update Agent on the client systems must be reconfigured to retrieve updates from the organization's internal RHN Satellite Server instead of the central Red Hat Network Servers. After this one-time reconfiguration, client systems may retrieve updates locally using the Red Hat Update Agent, or system administrators may schedule actions through the RHN Satellite Server website.

When a client requests updates, the organization's internal RHN Satellite Server queries its database, authenticates the client system, identifies the updated packages available for the client system, and sends the requested RPMs back to the client system. Depending upon the client's preferences, the package may also be installed. If the packages are installed, the client system sends an updated package profile to the database on the RHN Satellite Server; those packages are removed from the list of outdated packages for the client.

The organization can configure the website for the RHN Satellite Server to be accessible from the local area network only or from both the local area network and the Internet. The Satellite's version of the RHN website allows full control over client systems, system groups, and users.

The RHN Satellite Server management tools are used to synchronize the RHN Satellite Server database and package repository with Red Hat Network. The RHN Satellite Server import tool allows the system administrator to include custom RPM packages in the package repository.

1.5. Update or errata Management[edit]

Software packages in Red Hat products are subject to updates, referred to as errata that are released at regular intervals as well as asynchronously. Red Hat Satellite provides tools to inspect and filter errata, allowing for precise update management. This way, you can select relevant updates and propagate them through content views to selected content hosts.

Errata contain advisories that describe the changes introduced by the update. There are three types of advisories (in order of importance):

Security Advisory describes fixed security issues found in the package. The security impact of the issue can be Low, Moderate, Important, or Critical.

Bug Fix Advisory describes bug fixes for the package.

Product Enhancement Advisory describes enhancements and new features added to the package.

In Red Hat Satellite, there are two keywords that describe an erratum's relationship to the available content hosts:

Applicable: erratum applies to one or more content hosts, which means it updates packages present on the content host. Applicable errata are not yet accessible by the content host.

Installable: erratum applies to one or more content hosts and it has been made available to the content host. Installable errata are present in the content host’s life cycle environment and content view, but are not yet installed. This way, errata can be installed by users who have permissions to manage content hosts, but are not entitled for errata management at higher levels.

The procedure is to view the errata , inspect and apply .You can configure email notifications for Satellite users . Users can receive a summary of applicable and installable errata, notifications on content view promotion or after synchronizing a repository.

1.6. Security Compliance Management with OpenSCAP[edit]

The Security Content Automation Protocol (SCAP) enables the definition of configuration and security policies, also the means of auditing for compliance with those policies. In Satellite 6, SCAP is implemented with the tools provided by the OpenSCAP project.

OpenSCAP provides the means of conducting compliance auditing across your managed environment. Configuration and security policies are expressed in a SCAP-compliant format and hosts are checked for compliance. The Satellite web UI provides the means of compliance auditing and tools to analyse non-compliance. Scheduled auditing against policies ensures that non-compliant hosts are identified, even if they were previously compliant.

The compliance policy dashboard provides an overview of hosts' compliance with a policy. To view a compliance policy's dashboard, open the Satellite web UI and navigate to Hosts→Policies, then click the policy's name.

1.7. Provisioning[edit]

The Red Hat Satellite Provisioning help to provision physical and virtual hosts. This includes setting up the required network topology, configuring the necessary services, and providing all of the other configuration information needed to provision hosts on your network.

The host running Satellite 6 is deployed on a dedicated subnet where it can enable DHCP, DNS, and TFTP services. Process of provisioning involves following process.

Importing Subscriptions and Synchronizing Content

Creating a Manifest

Uploading a Manifest to your Satellite Server

Enabling Red Hat Repositories

Creating Custom Products and Repositories

Synchronizing Content

Content Management and Promotion

Creating Application Life Cycle Environments

Creating Content Views

Adding Red Hat Enterprise Linux Repositories

Adding Puppet Modules

Publishing a Content View

Creating and Editing Activation Keys

Finalizing Provisioning Configuration

Creating Provisioning Templates

Creating Host Groups

Provisioning Hosts

Provisioning a Host Using PXE

Provisioning a Host Using a Boot Disk

Although The solution of provision will be deployed as part of Redhat Satellite Server, the Initial provisioning of RHEV,RHEL,VM will not be done via this tool .RHEV Hypervisors will be manually provisioned and VM will be provisioned via RHEV Manager .Going forward,provisioning system of Redhat should be used to provision VM or RHEL Machines during operation phase.

1.8. Rollback Management of patches[edit]

The recommended way to do a rollback is to use the Red Hat Network/Satellite provisioning module and snapshot capabilities.

Snapshots are captured whenever an action takes place on a system. These snapshots identify groups, channels, packages, and configuration files.

Once Snapshot configuration are created and tagged , Snapshot rollback at the time of rollback decision needs to be followed .

It is also possible to rollback the patches to previous version via cli tool on the RHEL systems via Yum . YUM has downgrade option to manage the rollback.

Rollback is not the default feature of satellite 6 but we can perform this task with the help of yum and satellite remote command execution feature.Below are the procedure of patch deployment and rollback.

a. Login in to satellite Web UI with login credentials as like below.

b. Go to Host -> Content Hosts as like below screenshot.

c. Select the host on which you want to apply patches.

d. Select the errata (Patch ) type Eg. Security.

e. Select the method by which you want to apply patches. There are three types of method available for applying patches.

Katello Agent.
Remote execution.
Remote execution with seculing and repetition.

f. It will give you message like patch deployment was fail or pass as below excution is successful.

Patch Rollback.

a. Now go to host > All host and select the host on which you want to patch to be rollback.Select Run Job like below.

b. Type “yum history” on command section and click on submit button.

c. Go to Job Task > Sub tasks and select the last task , like below screenshots.

d.Grep the ID of the patch which you performed.

e. Go to Monitor > Jobs > Run Jobs like below,

f. Enter system name(From which you want to patch rollback ) in search query, on command section type,

# yum history undo yum_id -y

and enter on submit button .

g. If success comes means patch has rolled back successfully. You can also varify this from Yum history.

Note: yum history undo will require access to all the previous RPM version; thus, need to ensure the older RPM versions are available to the system. It is recommended that prior to doing updates, you closely inspect the output of package-cleanup --orphans to know what currently installed RPMs are no longer available in the enabled repositories. This should not be a concern if using the standard RHEL repositories provided by Red Hat as multiple versions of RPM are maintained in these locations.

1.9. Bandwidth Throttling and Blackout times while patch process[edit]

As RHN Satellite (Patch Solution) will be installed as RHEV Guest (VM) , The QOS of RHEV will be used for Bandwidth Throttling as per https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Virtualization/3.5/html/Administration_Guide/sect-Network_Quality_of_Service.html .

Network quality of service is a feature that allows you to create profiles for limiting both the inbound and outbound traffic of individual virtual network interface controllers. With this feature, you can limit bandwidth in a number of layers, controlling the consumption of network resources. Network QoS settings allow you to configure bandwidth limits for both inbound and outbound traffic on three distinct levels of Average , Peak and Burst Levels

Mitigation for Balck out Times will be done via Network monitoring linux tools to estimate the network traffic and itegrating with Hooks api of RHN Satellite solution to Blackout software deliver during high network Traffic.

Linux has many tools like nload, bmon, slurm, bwm-ng, cbm, speedometer, netload or snmp query to estimate the Network Traffic or load on the Network . The values of peak / high loads on Network can be decided during the low level design . One of the tool will be deployed on the Patch management VM . This tool will monitor the network load on continuous basis via Cronjobs . Once the Network load goes beyond a defined level , script will be triggered to stop the software delivery or visa versa in case the network load comes down . This scripts has integration with patch solution ( RHN Satellite ) via hooks API.

1.10. Active Directory Authentication[edit]

Active directory is supported as external authentication (https://access.redhat.com/documentation/en-US/Red_Hat_Satellite/6.1/html/User_Guide/sect-Red_Hat_Satellite-User_Guide-AD_direct.html) . Currently is not planned at GSTN environment as this integration is only beneficial in cross forest Environment and process to complicated.

Active Directory Authentication is available in satellite 6.2 but intagration is not happened here.

1.11 Software Package Prerequisites[edit]

The patch deployment process evaluate the prerequisites and deployed satisfying the dependencies. In fact RHEL and any linux for that matter has to full fill this requirements.

1.12. Hardware and application inventory and Reports[edit]

The whole package and hardware inventory with versions are generated via report functionality. The following reports are generally available

channel-packages - Packages in channels

channels - Channel report

custom-info - Display system custom info

entitlements - Entitlement and channel list and usage

errata-channels - List of errata in channels

errata-list - Errata information based upon compliance checks against systems

errata-list-all - List of all erratas

errata-systems - Listing of each errata applicable to each affected system

inactive-systems - Inactive systems in Satellite

inventory - Inventory report

kickstartable-trees - List of kickstartable trees

packages-updates-all - List of packages that can be upgraded

packages-updates-newest - List of packages that can be upgraded

scap-scan - Results of OpenSCAPxccdf evaluation

scap-scan-results - Results of OpenSCAPxccdf evaluation

system-crash-count - Crash count for systems

system-crash-details - Crash details for systems

system-currency - System currency list

system-groups - System groups in Satellite

system-groups-keys - Activation keys for system groups

system-groups-systems - Systems in system groups

system-groups-users - System groups users report

system-history - System event history

system-history-channels - Channel event history

system-history-configuration - Configuration event history

system-history-entitlements - System entitlement event history

system-history-errata - Errata event history

system-history-kickstart - Kickstart event history

system-history-packages - Package event history

system-history-scap - OpenSCAP event history

system-packages-installed - Packages installed on systems

users - Users in the system

users-systems - Systems administered by individual users

1.13. Operations Management[edit]

1.13.1. Operation Management – RHEL Configuration Management[edit]

Operations Management in case of RHEL is referred to as configuration management . This is managed by the puppet Module of Redhat Satellite. Puppet is a tool for applying and managing system configurations. Puppet collects system information, or facts, and uses this information to create a customized system configuration using a set of modules. These modules contain parameters, conditional arguments, actions, and templates. Puppet is used as either a local system command line tool or in a client-server relationship where the server acts as the Puppet master and applies configuration to multiple client systems using a Puppet agent. This provides a way to automatically configure newly provisioned systems, either individually or simultaneously to create a specific infrastructure.

1.13.2. Puppet's configuration management overview[edit]

Puppet uses the following workflow to apply configuration to a system.

Collect facts about each system. These facts can include hardware, operating systems, package versions, and other information. The Puppet agent on each system collects this information and sends it to the Puppet master.

The Puppet master generates a custom configuration for each system and sends it to the Puppet agent. This custom configuration is called a catalog.

The Puppet agent applies the configuration to the system.

The Puppet agent sends a report back to the Puppet master that indicates the changes applied and if any changes were unsuccessful.

Third-party applications can collect these reports using Puppet's API.

1.13.3. Configuration Methodology[edit]

Satellite 6 uses Puppet in several ways:

Satellite 6 imports Puppet modules used to define the system configuration. This includes control over module versions and their environments.

Satellite 6 imports sets of parameters, also known as Puppet class parameters, from Puppet modules. Users can accept the default values from Puppet classes or provide their own at a global or system-specific level.

Satellite 6 triggers the execution of Puppet between the master and the respective agents on each system. Puppet runs can occur either:

Automatically, such as after the provisioning process completes or as a daemon that checks and manages the machine's configuration over its lifecycle.

Manually, such as needing to trigger an immediate Puppet run.

Satellite 6 collects reports from Puppet after the configuration workflow completes. This helps with auditing and archiving system configuration over long term periods.

These functions provide an easy way for users to control system configuration aspects of the application lifecycle using Puppet. ====== 1.13.4. Configuration Suggested parameter for RHEL ======

puppet Modules

Password Ageing

Firewall

NTP

Apache

Mysql

Selinux

PostgreSQL

sysctl

Timezone

LVM

SUDO

Ssh

rsyslog

dns

dhcp

snmp

accounts

postfix

Crons

Mongodb

Bind

Timezone

JDK7

nfs

Openstack

1.13.5. Reports[edit]

Puppet generates a report each time it applies configuration. Provisioned hosts send this report to the Red Hat Satellite 6 server. View these reports on the hosts details page

Each report shows the status of each Puppet resource and its configuration applied to the host.