For Uyuni 3 and later, you can choose to use either traditional or Salt client management framework, or a mixture of both, depending on your environment and requirements.
Is an end-to-end data-center automation tool which may also be used outside the scope of Uyuni to introduce reactive, real-time orchestration, and configuration management.
Activation keys are used with both traditional and Salt clients to ensure that your clients have the correct software entitlements, are connecting to the appropriate channels, and are subscribed to the relevant groups. Each activation key is bound to an organization, which you can set when you create the key.
This section contains information on how to create activation keys for both traditional and Salt clients, and provides some best practices for working with activation keys.
As the administrator login to the Uyuni Web UI.
Navigate to › .
To open the Activation Key Details page click the button in the upper right corner.
On the Activation Key Details page in the Description field, enter a name for the activation key.
In the Key field, enter the distribution and service pack associated with the key. For example, SLES12-SP3 for SUSE Linux Enterprise Server 12 SP3.
Do not use commas in the Key field for any SUSE products.
However, you must use commas for Red Hat Products.
For more information, see Section 7.9, “Systems > Activation Keys”.
In the Base Channels drop-down box, select the SUSE Linux Enterprise channel that you added during
First Channel Sync.
When the base channel is selected the list of available child channels will get fetched and displayed in real time below the base channel. Select the child channels you need (for example, the SUSE Manager tools and the updates channels that are actually mandatory).
We recommend you leave the Contact Method set to Default.
We recommend you leave the Universal Default setting unchecked.
Click to create the activation key.
Check the Configuration File Deployment check box to enable configuration management for this key, and click to save this change.
When you create activation keys, keep these best practices in mind:
Avoid using the SUSE Manager Default parent channel.
This setting forces Uyuni to choose a parent channel that best corresponds to the installed operating system, which can sometimes lead to unexpected behavior.
Instead, we recommend you create activation keys specific to each distribution and architecture.
If you are using bootstrap scripts, consider creating an activation key for each script. This will help you align channel assignments, package installation, system group memberships, and configuration channel assignments. You will also need less manual interaction with your system after registration.
If you do not enter a human-readable name for your activation keys, the system will automatically generate a number string, which can make it difficult to manage your keys. Consider a naming scheme for your activation keys to help you keep track of them.
Note that the Configuration File Deployment check box does not appear until after you have created the activation key.
Ensure you go back and check the box if you need to enable configuration management.
In this section you will create a tools repository on the Uyuni Server for providing client tools. The client tools repository contains packages for installing Salt on minions as well as required packages for registering traditional clients during the bootstrapping procedure. These packages will be installed from the newly generated repository during the registration process. In the following procedure you will create the SUSE Linux Enterprise tools repository.
Before following the procedure to create the tools repository make sure the SUSE vendor channel you will be using with your client has been completely synced.
You can check this by running tail -f /var/log/rhn/reposync/<CHANNEL_NAME>.log as root.
In the following example replace version with the actual version string:
# tail -f /var/log/rhn/reposync/sles`version`-pool-x86_64.log
Once completed you should see the following output in your terminal:
2017/12/12 15:20:32 +02:00 Importing packages started. 2017/12/12 15:22:02 +02:00 1.07 % ... 2017/12/12 15:34:25 +02:00 86.01 % 2017/12/12 15:35:49 +02:00 Importing packages finished. 2017/12/12 15:35:49 +02:00 Linking packages to channel. ... 2017/12/12 15:35:59 +02:00 Sync completed.
Open a terminal on the server as root and enter the following command to list available bootstrap repositories:
mgr-create-bootstrap-repo -l SLE-`version`-x86_64
Then invoke the same command using the listed repository as the product label to actually create the bootstrap repository:
mgr-create-bootstrap-repo -c SLE-version-x86_64
Uyuni will create and add the client tools to the newly created repositories directory located at /srv/www/htdocs/pub/repositories/ .
This repository is suitable for both Server and Desktop of SUSE Linux Enterprise.
This section goes over generating a template bootstrap script which will be copied and modified for use with “traditional” clients. Traditional clients register with Uyuni via a bootstrap script executed on the client which deploys all necessary packages to it. The bootstrap script contains parameters which assigns a client system to its base channel. Two of these important parameters are:
Activation Keys
GNU Privacy Guard (GPG) Keys
SLES 15 utilizes Python 3 by default. Because of this change any older bootstrap scripts (based on python 2) must be re-created for SLES 15 systems. Attempting to register SLES 15 systems with SUSE Manager using Python 2 versions of the bootstrap script will fail.
The following procedure will guide you through generating a bootstrap script.
From the Uyuni Web UI, browse to › › › . For more information, see Section 18.4.2, “ › ”.
In the SUSE Manager Configuration - Bootstrap dialog disable Bootstrap using Salt.
Use default settings and click the button.
Unchecking in the Web UI or setting USING_SSL=0 in the bootstrap script is not recommended.
If you disable SSL nevertheless you will need to manage custom CA certificates to be able to run the registration process successfully.
A template bootstrap script is generated and stored on the server’s file system in the /srv/www/htdocs/pub/bootstrap directory.
cd /srv/www/htdocs/pub/bootstrap
The bootstrap script is also available at https://example.com/pub/bootstrap/bootstrap.sh
.
Section 5.4.2, “Editing the Bootstrap Script” will cover copying and modifying your bootstrap template for use with each client.
In this section you will copy and modify the template bootstrap script you created from Section 5.4.1, “Generating a Bootstrap Script”.
A minimal requirement when modifying a bootstrap script for use with Uyuni is the inclusion of an activation key. Depending on your organizations security requirements it is strongly recommended to include one or more (GPG) keys (for example, your organization key, and package signing keys). For this tutorial you will be registering with the activation keys created in the previous section.
Login as root from the command line on your Uyuni server.
Navigate to the bootstrap directory with:
cd /srv/www/htdocs/pub/bootstrap/
Create and rename two copies of the template bootstrap script for use with each of your clients.
cp bootstrap.sh bootstrap-sles11.sh cp bootstrap.sh bootstrap-sles12.sh
Open sles12.sh for modification.
Scroll down and modify both lines marked in green.
You must comment out exit 1 with a hash mark (#) to activate the script and then enter the name of the key for this script in the ACTIVATION_KEYS= field as follows:
echo "Enable this script: comment (with #'s) this block (or, at least just" echo "the exit below)" echo #exit 1 # can be edited, but probably correct (unless created during initial install): # NOTE: ACTIVATION_KEYS *must* be used to bootstrap a client machine. ACTIVATION_KEYS=1-sles12 ORG_GPG_KEY=
Once you have completed your modifications save the file and repeat this procedure for the second bootstrap script. Proceed to Section 5.4.3, “Connecting Clients”.
To find key names you have created: In the Web UI, click › › › . All keys created for channels are listed on this page. You must enter the full name of the key you wish to use in the bootstrap script exactly as presented in the key field.
This section covers connecting your clients to Uyuni with the modified bootstrap script.
From your Uyuni Server command line as root navigate to the following directory:
cd /srv/www/htdocs/pub/bootstrap/
Run the following command to execute the bootstrap script on the client:
cat MODIFIED-SCRIPT.SH \ | ssh root@example.com /bin/bash
The script will execute and proceed to download the required dependencies located in the repositories directory you created earlier. Once the script has finished running, log in to the Web UI and click › to see the new client listed.
This concludes the bootstrap section of this guide. Section 5.5, “Registering Salt Clients” will go over registering Salt minions for use with Uyuni.
Package locks are used to prevent unauthorized installation or upgrades to software packages on traditional clients. When a package has been locked, it will display to users with a padlock icon, indicating that it can not be installed. Any attempt to install a locked package will be reported as an error in the event log.
Locked packages can not be installed, upgraded, or removed, either through the Uyuni Web UI, or directly on the client machine using a package manager. Locked packages will also indirectly lock any dependent packages.
Package locks can only be used on traditional clients that use the Zypper package manager. The feature is not currently supported on Red Hat Enterprise Linux or Salt clients.
On the client machine, install the zypp-plugin-spacewalk package:
# zypper in zypp-plugin-spacewalk
Navigate to the › › tab on the managed system to see a list of all available packages.
Select the packages to lock, and click . You can also choose to enter a date and time for the lock to activate. Note that even if you do not select a date and time, the lock might not activate immediately.
To remove a package lock, select the packages to unlock and click . You can also choose to enter a date and time for the lock to deactivate. Note that even if you do not select a date and time, the lock might not deactivate immediately.
There are currently three methods for registering Salt minions. This section describes the first method and uses a bootstrap repository. The second method uses bootstrap script, and is described in Section 5.4, “Registering Traditional Clients”. The third method uses the Web UI, and is described in Section 7.6, “Bootstrapping [Salt]”.
You can also use these methods to change existing traditional clients into Salt minions.
The following section assumes you have created a SUSE Manager tools repository. You can review creating a tools repository in Section 5.3, “Creating the Uyuni Tools Repository”.
The Salt master and its proxy should always be reachable via both IP address and the FQDN. In the following rare scenario:
The Salt master (SUSE Manager) is in some DNS.
Your Minions are in a different subnet bound to an alternate DNS and the Salt master record is absent.
The Salt master cannot know that the minion is not utilizing the same DNS record. The the Salt master nevertheless sends the FQDN of itself to the minion expecting it to join.
The minion looks for a different DNS, one where the master record does not exist therefore bootstrap fails.
Once you have fully synced a base channel from the Web UI
for clients to obtain software sources from, for example: SLES12-SP3-Pool_for_x86_64 perform the following procedure to register a Salt minion.
On your minion as root enter the following command:
zypper ar http://`FQDN.SUSE.Manager.com`/pub/repositories/sle/12/3/bootstrap/ \ sles12-sp3
Do not use HTTPS.
Use HTTP instead to avoid errors.
After adding the repository containing the necessary Salt packages execute:
zypper in salt-minion
Modify the minion configuration file to point to the fully qualified domain name (FQDN) of the Uyuni server (master):
vi /etc/salt/minion
Find and change the line:
master: salt
to:
master:`FQDN.SUSE.Manager.com`
Restart the Salt minion with:
systemctl restart salt-minion
Your newly registered minion should now show up within the Web UI under › .
Accept the pending key to begin management.
If you have used your hypervisor clone utility, and attempted to register the cloned Salt client, you might get this error:
We're sorry, but the system could not be found.
This is caused by the new, cloned, system having the same machine ID as an existing, registered, system. You can adjust this manually to correct the error and register the cloned system successfully.