Red Hat Satellite engineering is moving the tracking of its product development work on Satellite to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "Satellite project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs will be migrated starting at the end of May. If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "Satellite project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/SAT-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1776930 - Enabling DNS proxy feature on Red Hat Satellite 6.6 is failing
Summary: Enabling DNS proxy feature on Red Hat Satellite 6.6 is failing
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Red Hat Satellite
Classification: Red Hat
Component: Documentation
Version: 6.6.0
Hardware: x86_64
OS: Linux
unspecified
high
Target Milestone: Unspecified
Assignee: Marie Hornickova
QA Contact:
URL:
Whiteboard: installing-capsule
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2019-11-26 15:28 UTC by Anand Jambhulkar
Modified: 2024-01-22 14:17 UTC (History)
8 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2023-12-21 17:41:20 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Issue Tracker SAT-15510 0 None None None 2024-01-22 14:17:33 UTC
Red Hat Issue Tracker SATDOC-877 0 None None None 2022-05-23 08:45:10 UTC
Red Hat Knowledge Base (Solution) 4611971 0 None None None 2019-11-26 16:14:01 UTC

Description Anand Jambhulkar 2019-11-26 15:28:42 UTC 
Description of problem:
----------------------

Enabling DNS proxy feature on Red Hat Satellite 6.6 is failing with the following errors which can be found in the "satellite.log" file - 

[ERROR 2019-11-25T15:53:33 main] Errors encountered during run:
[ERROR 2019-11-25T15:53:33 main]  Proxy fcn-sat-p001.fairconnect.internal has failed to load one or more features (DNS), check /var/log/foreman-proxy/proxy.log for configuration errors
[ERROR 2019-11-25T15:53:33 main] /usr/share/foreman-installer/modules/foreman/lib/puppet/provider/foreman_smartproxy/rest_v3.rb:70:in `validate_features!'
[ERROR 2019-11-25T15:53:33 main] /usr/share/foreman-installer/modules/foreman/lib/puppet/provider/foreman_smartproxy/rest_v3.rb:59:in `refresh_features!'
.....

[ERROR 2019-11-25T15:53:33 main]  /Stage[main]/Foreman_proxy::Register/Foreman_smartproxy[fcn-sat-p001.fairconnect.internal]/features: change from ["Ansible", "Discovery", "Dynflow", "HTTPBoot", "Logs", "Openscap", "Pulp", "Puppet", "Puppet CA", "SSH", "TFTP", "Templates"] to ["Ansible", "DNS", "Discovery", "Dynflow", "HTTPBoot", "Logs", "Openscap", "Puppet", "Puppet CA", "TFTP", "Templates"] failed: Proxy fcn-sat-p001.fairconnect.internal has failed to load one or more features (DNS), check /var/log/foreman-proxy/proxy.log for configuration errors
[DEBUG 2019-11-25T15:53:33 main] Cleaning /tmp/kafo_puppet20191125-17450-kdmi0l.conf
[DEBUG 2019-11-25T15:53:33 main] Cleaning /tmp/kafo_hiera20191125-17450-s4v93c


Version-Release number of selected component (if applicable):
------------------------------------------------------------

Red Hat Satellite 6.6


How reproducible:
----------------

Probably easily


Steps to Reproduce:
------------------

1. The error is produced when the customer executes the following command on Red Hat Satellite 6.6 -

# satellite-installer --scenario satellite \
--foreman-initial-organization "UMB" \
--foreman-initial-location "DC" \
--foreman-initial-admin-username admin \
--foreman-initial-admin-password XXX \
--foreman-proxy-dns-managed=false \
--foreman-proxy-dhcp-managed=false \
--enable-foreman-compute-vmware


2. The customer then tried to configure the external DNS server by following the official document and the following command which fails as well - 

https://access.redhat.com/documentation/en-us/red_hat_satellite/6.6/html/installing_capsule_server/configuring_external_services

# satellite-installer --foreman-proxy-dns=true \
--foreman-proxy-dns-managed=false \
--foreman-proxy-dns-provider=nsupdate \
--foreman-proxy-dns-server="10.20.1.31" \
--foreman-proxy-keyfile=/etc/rndc.key \
--foreman-proxy-dns-ttl=86400


This second command produces the error specified above.


Actual results:
--------------

The command fails with the following errors in "satellite.log" file - 

[ERROR 2019-11-25T15:53:33 main] Errors encountered during run:
[ERROR 2019-11-25T15:53:33 main]  Proxy fcn-sat-p001.fairconnect.internal has failed to load one or more features (DNS), check /var/log/foreman-proxy/proxy.log for configuration errors
[ERROR 2019-11-25T15:53:33 main] /usr/share/foreman-installer/modules/foreman/lib/puppet/provider/foreman_smartproxy/rest_v3.rb:70:in `validate_features!'
[ERROR 2019-11-25T15:53:33 main] /usr/share/foreman-installer/modules/foreman/lib/puppet/provider/foreman_smartproxy/rest_v3.rb:59:in `refresh_features!'
.....

[ERROR 2019-11-25T15:53:33 main]  /Stage[main]/Foreman_proxy::Register/Foreman_smartproxy[fcn-sat-p001.fairconnect.internal]/features: change from ["Ansible", "Discovery", "Dynflow", "HTTPBoot", "Logs", "Openscap", "Pulp", "Puppet", "Puppet CA", "SSH", "TFTP", "Templates"] to ["Ansible", "DNS", "Discovery", "Dynflow", "HTTPBoot", "Logs", "Openscap", "Puppet", "Puppet CA", "TFTP", "Templates"] failed: Proxy fcn-sat-p001.fairconnect.internal has failed to load one or more features (DNS), check /var/log/foreman-proxy/proxy.log for configuration errors
[DEBUG 2019-11-25T15:53:33 main] Cleaning /tmp/kafo_puppet20191125-17450-kdmi0l.conf
[DEBUG 2019-11-25T15:53:33 main] Cleaning /tmp/kafo_hiera20191125-17450-s4v93c


Expected results:
----------------

The command should complete its execution successfully.


Additional info:
---------------

The customer has applied the following workaround to resolve the issue -

	1. # chmod 644 /etc/rndc.key

	2. # satellite-installer --foreman-proxy-dns=true --foreman-proxy-dns-server="XXX.XXX.XXX.XXX"


May be the permission with 640 and the group=named is not working as described in the following official document - 

	https://access.redhat.com/documentation/en-us/red_hat_satellite/6.6/html/installing_capsule_server/configuring_external_services
Comment 4 Anand Jambhulkar 2020-01-13 14:04:59 UTC 
Hello Eric,

The customer has resolved the issue which was due to the incorrect permissions on "rndc.key" file.

The customer provided the following response - 

"
The used Article (https://access.redhat.com/documentation/en-us/red_hat_satellite/6.6/html/installing_capsule_server/configuring_external_services) is not for Red Hat IDM integration and I could integrate IDM with this Article (https://access.redhat.com/documentation/en-us/red_hat_satellite/6.6/html/administering_red_hat_satellite/chap-red_hat_satellite-administering_red_hat_satellite-configuring_external_authentication#sect-Red_Hat_Satellite-Administering_Red_Hat_Satellite-Configuring_External_Authentication-Using_Identity_Management) successfully. Sadly there are multiple documentations from Red Hat about similar use cases which are different and confusing.

Also the Issue of the failing satellite-installer was because of wrong Permission of the "rndc.key" (https://bugzilla.redhat.com/show_bug.cgi?id=1776930), which had sadly no hint in the Satellite Logs.

"

Thanks and Regards,
Anand Jambhulkar
Comment 5 Ewoud Kohl van Wijngaarden 2020-01-16 15:02:38 UTC 
We moved this because the installer only points to the file and doesn't manage it. For local installations we ensure foreman-proxy is in the named group because both need to read the file. In this remote case we do have a a validate_readable to ensure it's readable.

https://github.com/theforeman/smart-proxy/blob/9804512b133bfbc99e1d0d3dbf34e3971e6057bc/modules/dns_nsupdate/dns_nsupdate_plugin.rb#L9

That means the logs should already report it's failing.

In this case it looks like the configuring_external_services document should actually recommend to set the group to foreman-proxy instead of named.

(In reply to Anand Jambhulkar from comment #4)
> Also the Issue of the failing satellite-installer was because of wrong
> Permission of the "rndc.key"
> (https://bugzilla.redhat.com/show_bug.cgi?id=1776930), which had sadly no
> hint in the Satellite Logs.

There should have been in /var/log/foreman-proxy/proxy.log
Comment 6 Mike McCune 2021-07-09 17:02:24 UTC 
Thank you for your interest in Satellite 6. We have evaluated this request, and while we recognize that it is a valid request, we do not expect this to be implemented in the product in the foreseeable future. This is due to other priorities for the product, and not a reflection on the request itself. We are therefore closing this out as WONTFIX. If you have any concerns about this feel free to contact your Red Hat Account Team. Thank you.
Comment 7 Ewoud Kohl van Wijngaarden 2021-07-09 17:36:21 UTC 
For what it's worth, I actually think this is still relevant. It should have been triaged as a documentation bug. In https://github.com/theforeman/foreman-documentation/pull/498#pullrequestreview-640968680 I gave detailed instructions what should be done instead.
Comment 8 Ewoud Kohl van Wijngaarden 2021-07-09 17:45:23 UTC 
I opened https://github.com/theforeman/foreman-documentation/pull/595.
Comment 9 Ewoud Kohl van Wijngaarden 2021-07-19 14:07:55 UTC 
The upstream PR has been merged.
Note You need to log in before you can comment on or make changes to this bug.