Bug 1197806

Summary:	[RFE] Direct Client->Foreman communication shouldn't be needed for provisioning templates
Product:	Red Hat Satellite	Reporter:	Stephen Benjamin <stbenjam>
Component:	Foreman Proxy	Assignee:	Mike McCune <mmccune>
Status:	CLOSED ERRATA	QA Contact:	Kedar Bidarkar <kbidarka>
Severity:	high	Docs Contact:
Priority:	unspecified
Version:	6.0.4	CC:	bkearney, cwelton, dcaplan, jmontleo, mmccune
Target Milestone:	Unspecified	Keywords:	FutureFeature
Target Release:	Unused
Hardware:	Unspecified
OS:	Unspecified
URL:	http://projects.theforeman.org/issues/969
Whiteboard:
Fixed In Version:		Doc Type:	Enhancement
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-08-12 05:28:19 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1175803

Description Stephen Benjamin 2015-03-02 16:24:07 UTC

When provisioning a machine, the client needs to access foreman unattended urls, such as: 
http://foreman/unattended/kickstart
and
http://foreman/unattended/built

That means firewall open to foreman (and the API).
I think the architecture and security would improve if Foreman could be as isolated as possible, not depending on being open to the machines it manages... Those tasks should be left to the proxy.

The suggested solution:
Client communications directed to Foreman should me moved to proxy (in this case, the one running on the master) so you only need port 8140(puppetmaster) + 8443 (foreman-proxy) open.

Note:
The proxy doesn’t really need to simply forward the request (although this is also a valid initial solution). It could have some intelligence to validate them or serve the unattended itself (pre fetching template information or something like it)…

http://i.imgur.com/aJlN5.png

Comment 1 Stephen Benjamin 2015-03-02 16:24:09 UTC

Created from redmine issue http://projects.theforeman.org/issues/969

Comment 5 Steve Loranz 2015-03-11 22:14:12 UTC

Upstream bug assigned to dtsang

Comment 6 Corey Welton 2015-03-25 02:18:51 UTC

qe -> kbidarka since he's been looking at the provisioning stuff.  Assuming this can be verified...

Comment 10 Stephen Benjamin 2015-04-30 15:28:40 UTC

When validating, be sure to run the capsule-installer with the options to enable the Templates feature in addition to TFTP:


"--tftp=true --templates=true"

Comment 12 Kedar Bidarkar 2015-05-07 16:49:21 UTC

VERIFIED With capsule running on Satellite-6.1.0-RHEL-7-20150424.0

Comment 13 Stephen Benjamin 2015-05-12 11:54:47 UTC

*** Bug 1218115 has been marked as a duplicate of this bug. ***

Comment 15 Bryan Kearney 2015-08-11 13:30:25 UTC

This bug is slated to be released with Satellite 6.1.

Comment 16 errata-xmlrpc 2015-08-12 05:28:19 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2015:1592