Bug 1288817

Summary:	[RFE] Capsule should listen for RHSM requests on port 443, like Satellite does
Product:	Red Hat Satellite	Reporter:	Pavel Moravec <pmoravec>
Component:	Installation	Assignee:	satellite6-bugs <satellite6-bugs>
Status:	CLOSED WONTFIX	QA Contact:	Devendra Singh <desingh>
Severity:	high	Docs Contact:
Priority:	medium
Version:	6.1.4	CC:	aperotti, bkearney, chrobert, dmoessne, dsirrine, egolov, ktordeur, lee.brooks, mlinden, mvanderw, pbuchan, riehecky, rjerrido, satellite6-bugs, sauchter, saydas, stbenjam, sthirugn, vanhoof, zhunting
Target Milestone:	Unspecified	Keywords:	FutureFeature, Improvement, PrioBumpGSS
Target Release:	Unused
Hardware:	x86_64
OS:	All
Whiteboard:
Fixed In Version:		Doc Type:	Enhancement
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-01-15 20:30:31 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1353215

Description Pavel Moravec 2015-12-06 09:20:07 UTC

Description of problem:
While Satellite listens for RHSM requests (of clients machine registered to it) on port 443, an external Capsule (offering just a subset of Satellite functionality) has separate port 8443 dedicated for it.

This is confusing and can easily introduce registration issues - in fact it already happened and believe me it is nontrivial to investigate why client host fails to register to Capsule (if trying to connect to port 443 that sounds logically correct but wrong due to wrong rhsm.conf setting).

Moving the listening port back to 443 will gain these pros:
- logical coherence where _any_ client machine within Satellite deployment registers to - this prevents misconfiguration issues due to lack of knowing the exception / rule with port 8443
- simplified firewall setting
- simplified POSTIN script in katello-ca-consumer RPM


Version-Release number of selected component (if applicable):
Sat 6.1.4 (i fact any Sat6)


How reproducible:
100%


Steps to Reproduce:
1. Install Sat, Caps, register content host to Sat and to Caps
2. Check what port the clients use for RHSM communication (i.e. rhsm.conf on clients)


Actual results:
clients registered to Sat talk via port 443
clients registered to Caps talk via port 8443


Expected results:
any client to talk to its "server" (Sat or Caps) via port 443


Additional info:
Once implemented, documentation needs to be updated - at least firewall setting

Comment 2 Pavel Moravec 2015-12-06 14:02:40 UTC

To make the picture little bit more confusing: port 8443 is set only when using pulp or reverse proxy feature on the Capsule. If neither one is used, then client machines communicate to the Capsule via port 443.

This is non-sense. Why port number of communication depends on the type of deployment?

Further, this fact makes communication matrix invalid.

(to check I am right: see /usr/share/katello-installer/modules/capsule/manifests/init.pp:

  $reverse_proxy_real = $pulp or $reverse_proxy

  $rhsm_port = $reverse_proxy_real ? {
    true  => $reverse_proxy_port,
    false => '443'
  }

where reverse_proxy_port defaults to 8443)

Comment 3 Stephen Benjamin 2016-03-17 19:10:33 UTC

After talking to the team, we're going to move this to 6.3.  We plan to look at simplifying the ports required for the capsule, and can take care of this as part of that.

Comment 5 Bryan Kearney 2016-08-04 20:17:40 UTC

Moving 6.2 bugs out to sat-backlog.

Comment 7 Stephen Benjamin 2016-11-16 16:08:30 UTC

Created redmine issue http://projects.theforeman.org/issues/17367 from this bug

Comment 16 Bryan Kearney 2019-12-03 16:34:45 UTC

The Satellite Team is attempting to provide an accurate backlog of bugzilla requests which we feel will be resolved in the next few releases. We do not believe this bugzilla will meet that criteria, and have plans to close it out in 1 month. This is not a reflection on the validity of the request, but a reflection of the many priorities for the product. If you have any concerns about this, feel free to contact Red Hat Technical Support or your account team. If we do not hear from you, we will close this bug out. Thank you.

Comment 19 Bryan Kearney 2020-01-15 20:30:31 UTC

Thank you for your interest in Satellite 6. We have evaluated this request, and while we recognize that it is a valid request, we do not expect this to be implemented in the product in the foreseeable future. This is due to other priorities for the product, and not a reflection on the request itself. We are therefore closing this out as WONTFIX. If you have any concerns about this, please do not reopen. Instead, feel free to contact Red Hat Technical Support. Thank you.