憤Ⓘ鬥Ⓣ屎: Foreman on CentOS 7

更新

sudo yum -y update && sudo yum -y upgrade

修改/etc/hosts

vim /etc/hosts
127.0.0.1    localhost
IP           daniel-foreman.example.com

關閉selinx

sudo sed 's/SELINUX=enforcing/SELINUX=disabled/' -i /etc/sysconfig/selinux
sudo sed 's/SELINUX=enforcing/SELINUX=disabled/' -i /etc/selinux/config

關閉IPv6

Method 1

sudo vim /etc/sysctl.conf
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
sudo sysctl -p

Method 2

sudo echo 'net.ipv6.conf.all.disable_ipv6 = 1' >> /etc/sysctl.d/disableipv6.conf
sudo echo 'net.ipv6.conf.default.disable_ipv6 = 1' >> /etc/sysctl.d/disableipv6.conf
sudo reboot

Method 3

sudo echo 1 > /proc/sys/net/ipv6/conf/all/disable_ipv6
sudo echo 1 > /proc/sys/net/ipv6/conf/default/disable_ipv6

開放相對應的防火牆

PORT	PROTOCOL	REQUIRED FOR
53	TCP & UCP	DNS Server
67,68	UDP	DHCP Server
69	UDP	*TFTP Server
80, 443	TCP	* HTTP & HTTPS access to Foreman web UI – using Apache + Passenger
3000	TCP	HTTP access to Foreman web UI – using standalone WEBrick service
3306	TCP	Separate MySQL database
5432	TCP	Separate PostgreSQL database
5910 – 5930	TCP	Server VNC Consoles
8140	TCP	* Puppet Master
8443	TCP	* Smart Proxy, open only to Foreman

firewall-cmd --permanent --add-port=53/tcp
firewall-cmd --permanent --add-port=67-69/udp
firewall-cmd --permanent --add-port=80/tcp
firewall-cmd --permanent --add-port=443/tcp
firewall-cmd --permanent --add-port=3000/tcp
firewall-cmd --permanent --add-port=3306/tcp
firewall-cmd --permanent --add-port=5910-5930/tcp
firewall-cmd --permanent --add-port=5432/tcp
firewall-cmd --permanent --add-port=8140/tcp
firewall-cmd --permanent --add-port=8443/tcp
firewall-cmd --reload

前置作業都做好了，現在就來安裝要使用套件的Repositories

Puppet Repo

sudo rpm -ivh http://yum.puppetlabs.com/puppetlabs-release-el-7.noarch.rpm

EPEL Repo

sudo yum -y install epel-release http://yum.theforeman.org/releases/1.11/el7/x86_64/foreman-release.rpm

安裝Foreman-installer

sudo yum -y install foreman-installer

進入互動模式安裝，關閉Configure puppet，啟用foreman_plugin_ansible

sudo foreman-installer -i

Ready to start? (y/n) y

預設如下

Main Config Menu
1. [✓] Configure foreman
2. [✓] Configure foreman_cli
3. [✓] Configure foreman_proxy
4. [✓] Configure puppet
5. [✗] Configure foreman_plugin_ansible
6. [✗] Configure foreman_plugin_bootdisk
7. [✗] Configure foreman_plugin_chef
8. [✗] Configure foreman_plugin_cockpit
9. [✗] Configure foreman_plugin_default_hostgroup
10. [✗] Configure foreman_plugin_dhcp_browser
11. [✗] Configure foreman_plugin_digitalocean
12. [✗] Configure foreman_plugin_discovery
13. [✗] Configure foreman_plugin_docker
14. [✗] Configure foreman_plugin_hooks
15. [✗] Configure foreman_plugin_memcache
16. [✗] Configure foreman_plugin_openscap
17. [✗] Configure foreman_plugin_ovirt_provision
18. [✗] Configure foreman_plugin_puppetdb
19. [✗] Configure foreman_plugin_remote_execution
20. [✗] Configure foreman_plugin_salt
21. [✓] Configure foreman_plugin_setup
22. [✗] Configure foreman_plugin_tasks
23. [✗] Configure foreman_plugin_templates
24. [✗] Configure foreman_compute_ec2
25. [✗] Configure foreman_compute_gce
26. [✗] Configure foreman_compute_libvirt
27. [✗] Configure foreman_compute_openstack
28. [✗] Configure foreman_compute_ovirt
29. [✗] Configure foreman_compute_rackspace
30. [✗] Configure foreman_compute_vmware
31. [✗] Configure foreman_proxy_plugin_abrt
32. [✗] Configure foreman_proxy_plugin_chef
33. [✗] Configure foreman_proxy_plugin_discovery
34. [✗] Configure foreman_proxy_plugin_dns_powerdns
35. [✗] Configure foreman_proxy_plugin_dynflow
36. [✗] Configure foreman_proxy_plugin_openscap
37. [✗] Configure foreman_proxy_plugin_pulp
38. [✗] Configure foreman_proxy_plugin_remote_execution_ssh
39. [✗] Configure foreman_proxy_plugin_salt
40. Display current config
41. Save and run
42. Cancel run without Saving
Choose an option from the menu...

選4，關閉Configure puppet

Module puppet configuration
1. Enable/disable puppet module, current value: true
2. Set version, current value: present
3. Set user, current value: puppet
4. Set group, current value: puppet
5. Set dir, current value: /etc/puppet
6. Set codedir, current value: /etc/puppet
7. Set vardir, current value: /var/lib/puppet
8. Set logdir, current value: /var/log/puppet
9. Set rundir, current value: /var/run/puppet
10. Set ssldir, current value: /var/lib/puppet/ssl
11. Set sharedir, current value: /usr/share/puppet
12. Set manage_packages, current value: true
13. Set package_provider, current value:
14. Set package_source, current value:
15. Set port, current value: 8140
16. Set listen, current value: false
17. Set listen_to, current value: []
18. Set pluginsync, current value: true
19. Set splay, current value: false
20. Set splaylimit, current value: 1800
21. Set runinterval, current value: 1800
22. Set autosign, current value: $confdir/autosign.conf { mode = 664 }
23. Set usecacheonfailure, current value: true
24. Set runmode, current value: service
25. Set unavailable_runmodes, current value: []
26. Set cron_cmd, current value:
27. Set systemd_cmd, current value:
28. Set show_diff, current value: false
29. Set module_repository, current value:
30. Set configtimeout, current value: 120
31. Set ca_server, current value:
32. Set ca_port, current value:
33. Set dns_alt_names, current value: []
34. Set classfile, current value: $statedir/classes.txt
35. Set hiera_config, current value: $confdir/hiera.yaml
36. Set syslogfacility, current value:
37. Set auth_template, current value: puppet/auth.conf.erb
38. Set nsauth_template, current value: puppet/namespaceauth.conf.erb
39. Set main_template, current value: puppet/puppet.conf.erb
40. Set use_srv_records, current value: false
41. Set srv_domain, current value: example.com
42. Set pluginsource, current value: puppet:///plugins
43. Set pluginfactsource, current value: puppet:///pluginfacts
44. Set additional_settings, current value: {}
45. Configure puppet::agent parameters
46. Configure puppet::server parameters
47. Back to main menu
Choose an option from the menu...

選1

Module puppet configuration
1. Enable/disable puppet module, current value: false
2. Back to main menu
Choose an option from the menu...

選2

Main Config Menu
1. [✓] Configure foreman
2. [✓] Configure foreman_cli
3. [✓] Configure foreman_proxy
4. [✗] Configure puppet
5. [✗] Configure foreman_plugin_ansible
6. [✗] Configure foreman_plugin_bootdisk
7. [✗] Configure foreman_plugin_chef
8. [✗] Configure foreman_plugin_cockpit
9. [✗] Configure foreman_plugin_default_hostgroup
10. [✗] Configure foreman_plugin_dhcp_browser
11. [✗] Configure foreman_plugin_digitalocean
12. [✗] Configure foreman_plugin_discovery
13. [✗] Configure foreman_plugin_docker
14. [✗] Configure foreman_plugin_hooks
15. [✗] Configure foreman_plugin_memcache
16. [✗] Configure foreman_plugin_openscap
17. [✗] Configure foreman_plugin_ovirt_provision
18. [✗] Configure foreman_plugin_puppetdb
19. [✗] Configure foreman_plugin_remote_execution
20. [✗] Configure foreman_plugin_salt
21. [✓] Configure foreman_plugin_setup
22. [✗] Configure foreman_plugin_tasks
23. [✗] Configure foreman_plugin_templates
24. [✗] Configure foreman_compute_ec2
25. [✗] Configure foreman_compute_gce
26. [✗] Configure foreman_compute_libvirt
27. [✗] Configure foreman_compute_openstack
28. [✗] Configure foreman_compute_ovirt
29. [✗] Configure foreman_compute_rackspace
30. [✗] Configure foreman_compute_vmware
31. [✗] Configure foreman_proxy_plugin_abrt
32. [✗] Configure foreman_proxy_plugin_chef
33. [✗] Configure foreman_proxy_plugin_discovery
34. [✗] Configure foreman_proxy_plugin_dns_powerdns
35. [✗] Configure foreman_proxy_plugin_dynflow
36. [✗] Configure foreman_proxy_plugin_openscap
37. [✗] Configure foreman_proxy_plugin_pulp
38. [✗] Configure foreman_proxy_plugin_remote_execution_ssh
39. [✗] Configure foreman_proxy_plugin_salt
40. Display current config
41. Save and run
42. Cancel run without Saving
Choose an option from the menu...

啟用foreman_plugin_ansible，選5

Module foreman_plugin_ansible configuration
1. Enable/disable foreman_plugin_ansible module, current value: false
2. Back to main menu
Choose an option from the menu... 1
Enable foreman_plugin_ansible module? (y/n) y

選1，再選y

Module foreman_plugin_ansible configuration
1. Enable/disable foreman_plugin_ansible module, current value: true
2. Back to main menu
Choose an option from the menu...

選2

Main Config Menu
1. [✓] Configure foreman
2. [✓] Configure foreman_cli
3. [✓] Configure foreman_proxy
4. [✗] Configure puppet
5. [✓] Configure foreman_plugin_ansible
6. [✗] Configure foreman_plugin_bootdisk
7. [✗] Configure foreman_plugin_chef
8. [✗] Configure foreman_plugin_cockpit
9. [✗] Configure foreman_plugin_default_hostgroup
10. [✗] Configure foreman_plugin_dhcp_browser
11. [✗] Configure foreman_plugin_digitalocean
12. [✗] Configure foreman_plugin_discovery
13. [✗] Configure foreman_plugin_docker
14. [✗] Configure foreman_plugin_hooks
15. [✗] Configure foreman_plugin_memcache
16. [✗] Configure foreman_plugin_openscap
17. [✗] Configure foreman_plugin_ovirt_provision
18. [✗] Configure foreman_plugin_puppetdb
19. [✗] Configure foreman_plugin_remote_execution
20. [✗] Configure foreman_plugin_salt
21. [✓] Configure foreman_plugin_setup
22. [✗] Configure foreman_plugin_tasks
23. [✗] Configure foreman_plugin_templates
24. [✗] Configure foreman_compute_ec2
25. [✗] Configure foreman_compute_gce
26. [✗] Configure foreman_compute_libvirt
27. [✗] Configure foreman_compute_openstack
28. [✗] Configure foreman_compute_ovirt
29. [✗] Configure foreman_compute_rackspace
30. [✗] Configure foreman_compute_vmware
31. [✗] Configure foreman_proxy_plugin_abrt
32. [✗] Configure foreman_proxy_plugin_chef
33. [✗] Configure foreman_proxy_plugin_discovery
34. [✗] Configure foreman_proxy_plugin_dns_powerdns
35. [✗] Configure foreman_proxy_plugin_dynflow
36. [✗] Configure foreman_proxy_plugin_openscap
37. [✗] Configure foreman_proxy_plugin_pulp
38. [✗] Configure foreman_proxy_plugin_remote_execution_ssh
39. [✗] Configure foreman_proxy_plugin_salt
40. Display current config
41. Save and run
42. Cancel run without Saving
Choose an option from the menu...

確定如上面這樣後，就選41，就會進行安裝了

Could not start Service[foreman-proxy]: Execution of '/bin/systemctl start foreman-proxy' returned 1: Job for foreman-proxy.service failed because the control process exited with error code. See "systemctl status foreman-proxy.service" and "journalctl -xe" for details.
 /Stage[main]/Foreman_proxy::Service/Service[foreman-proxy]/ensure: change from stopped to running failed: Could not start Service[foreman-proxy]: Execution of '/bin/systemctl start foreman-proxy' returned 1: Job for foreman-proxy.service failed because the control process exited with error code. See "systemctl status foreman-proxy.service" and "journalctl -xe" for details.
 Could not start Service[httpd]: Execution of '/bin/systemctl start httpd' returned 1: Job for httpd.service failed because the control process exited with error code. See "systemctl status httpd.service" and "journalctl -xe" for details.
 /Stage[main]/Apache::Service/Service[httpd]/ensure: change from stopped to running failed: Could not start Service[httpd]: Execution of '/bin/systemctl start httpd' returned 1: Job for httpd.service failed because the control process exited with error code. See "systemctl status httpd.service" and "journalctl -xe" for details.
 /Stage[main]/Foreman_proxy::Register/Foreman_smartproxy[daniel-foreman.example.com]: Failed to call refresh: Proxy daniel-foreman.example.com cannot be registered (Could not load data from https://daniel-foreman.example.com
 /Stage[main]/Foreman_proxy::Register/Foreman_smartproxy[daniel-foreman.example.com]: Proxy daniel-foreman.example.com cannot be registered (Could not load data from https://daniel-foreman.example.com
Installing             Done                                               [100%] [............................................................................................................................................................................................]

Something went wrong! Check the log for ERROR-level output
* Foreman is running at https://daniel-foreman.example.com
Initial credentials are admin / EWWaLugGTdqT4na3
* Foreman Proxy is running at https://daniel-foreman.example.com:8443
* Puppetmaster is running at port 8140
The full log is at /var/log/foreman-installer/foreman.log

安裝完後會出現登入 Foreman 的資訊，請勿必要記下來，並更改 admin 的密碼，同時你也會看到有報錯誤，就開始進行修復

sudo systemctl status foreman-proxy.service

smart-proxy[3493]: Errors detected on startup, see log for details. Exiting: No such file or directory - /var/lib/puppet/ssl/private_keys/daniel-foreman.example.com.pem

如上面的錯誤訊息得知，找不到 /var/lib/puppet/ssl/private_keys/daniel-foreman.example.com.pem 這個檔案，所以我們需要建立 daniel-foreman.example.com.pem

解法：

puppet cert --generate daniel-foreman.example.com
Notice: Signed certificate request for ca
Notice: daniel-foreman.example.com.pem has a waiting certificate request
Notice: Signed certificate request for daniel-foreman.example.com.pem
Notice: Removing file Puppet::SSL::CertificateRequest daniel-foreman.example.com.pem at '/var/lib/puppet/ssl/ca/requests/daniel-foreman.example.com.pem'
INotice: Removing file Puppet::SSL::CertificateRequest daniel-foreman.example.com.pem at '/var/lib/puppet/ssl/certificate_requests/daniel-foreman.example.com.pem'

systemctl status httpd.service

May 16 14:53:06 daniel-foreman.example.com httpd[3840]: AH00526: Syntax error on line 30 of /etc/httpd/conf.d/05-foreman-ssl.conf:
May 16 14:53:06 daniel-foreman.example.com httpd[3840]: SSLCertificateFile: file '/var/lib/puppet/ssl/certs/daniel-foreman.example.com.pem' does not exist or is empty

如上面的錯誤訊息得知，第一個是 語法錯誤 ，第二個是 /var/lib/puppet/ssl/certs/daniel-foreman.example.com.pem 找不到

vim /etc/httpd/conf.d/05-foreman-ssl.conf
SSLCertificateFile      "/var/lib/puppet/ssl/certs/daniel-foreman.example.com.pem"
SSLCertificateKeyFile   "/var/lib/puppet/ssl/private_keys/daniel-foreman.example.com.pem"

結果也發現，原來也是SSL的錯誤，但因為我們剛剛在解上一個問題時，就也順帶解決了這個問題，此時可以確認一下

ls -la /var/lib/puppet/ssl/certs/daniel-foreman.example.com.pem
-rw-r--r--. 1 puppet puppet 2057 May 16 17:50 /var/lib/puppet/ssl/certs/daniel-foreman.example.com.pem
ls -la /var/lib/puppet/ssl/private_keys/daniel-foreman.example.com.pem
-rw-r-----. 1 puppet puppet 3247 May 16 17:50 /var/lib/puppet/ssl/private_keys/daniel-foreman.example.com.pem

很明顯都有存在，所以真的確定解決了，接下來就是將這二個給服務給重啟

sudo systemctl start foreman-proxy.service
sudo systemctl start httpd.service

Reference：

Foreman官網

修復foreman-proxy找不到key

憤Ⓘ鬥Ⓣ屎

2016年5月18日星期三

Foreman on CentOS 7 - Part1

沒有留言:

張貼留言

2016年5月18日 星期三

Foreman on CentOS 7 - Part1

沒有留言:

張貼留言

2016年5月18日星期三