Bug 1839781
| Summary: | [RFE] - Create a firewalld service component for Red Hat Satellite Capsule. | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Rudnei Bertol Jr. <rbertolj> |
| Component: | firewalld | Assignee: | Eric Garver <egarver> |
| Status: | CLOSED ERRATA | QA Contact: | Tomas Dolezal <todoleza> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 7.8 | CC: | egarver, pvlasin, todoleza |
| Target Milestone: | rc | Keywords: | FutureFeature |
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | firewalld-0.6.3-11.el7 | Doc Type: | No Doc Update |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-09-29 19:21:17 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Rudnei Bertol Jr.
2020-05-25 14:20:21 UTC
We went through this pretty recently in bug 1422149. See bug 1422149 comment 14. Do we really need _more_ ports? If capsule is optional, then maybe it should use a separate service definition, e.g. "satellite-capsule". Hey Eric, Yes, this would be awesome if we could have a specific service for Capsule i.e. "RH-Satellite-6-Capsule", as the capsule needs the port 8443/tcp opened on the firewall to allow this port for the Subscription Management Services and Telemetry Services. Please let us know if anything else that we can help from the support. regards rbertol Can you provide an exhaustive list of ports needed for capsule? I'll add "satellite-capsule" and also alias "satellite" to "RH-satellite-6". Does that make sense? Secondly, is this really needed for RHEL-7, or is doing this in RHEL-8 sufficient? Hey Eric, Q - Can you provide an exhaustive list of ports needed for capsule? A - Sure, following the port list from the official doc. Port Protocol Service Required For 80 TCP HTTP Anaconda, yum, and for obtaining Katello certificate updates 443 TCP HTTPS Anaconda, yum, Telemetry Services, and Puppet 5646 TCP AMQP The Capsule Qpid dispatch router to the Qpid dispatch router in Satellite 5647 TCP AMQP Katello agent to communicate with Capsule’s Qpid dispatch router 8000 TCP HTTPS Anaconda to download kickstart templates to hosts, and for downloading iPXE firmware 8140 TCP HTTPS Puppet agent to Puppet master connections 8443 TCP HTTPS Subscription Management Services and Telemetry Services 9090 TCP HTTPS Sending SCAP reports to the Capsule and for the discovery image during provisioning 53 TCP and UDP DNS Client DNS queries to a Capsule’s DNS service (Optional) 67 UDP DHCP Client to Capsule broadcasts, DHCP broadcasts for Client provisioning from a Capsule (Optional) 69 UDP TFTP Clients downloading PXE boot image files from a Capsule for provisioning (Optional) 5000 TCP HTTPS Connection to Katello for the Docker registry (Optional) Q - I'll add "satellite-capsule" and also alias "satellite" to "RH-satellite-6". Does that make sense? A - Yes, it would be awesome and makes sense to us. Q - Secondly, is this really needed for RHEL-7, or is doing this in RHEL-8 sufficient? A - We need on RHEL-7 as the Satellite 6.7 is supported just on RHEL-7 at this moment. regards rbertol (In reply to Rudnei Bertol Jr. from comment #6) > Hey Eric, > > Q - Can you provide an exhaustive list of ports needed for capsule? > A - Sure, following the port list from the official doc. > > Port Protocol Service Required For > 80 TCP HTTP Anaconda, yum, and for obtaining Katello > certificate updates > 443 TCP HTTPS Anaconda, yum, Telemetry Services, and > Puppet > 5646 TCP AMQP The Capsule Qpid dispatch router to the > Qpid dispatch router in Satellite > 5647 TCP AMQP Katello agent to communicate with > Capsule’s Qpid dispatch router > 8000 TCP HTTPS Anaconda to download kickstart templates > to hosts, and for downloading iPXE firmware > 8140 TCP HTTPS Puppet agent to Puppet master connections > 8443 TCP HTTPS Subscription Management Services and > Telemetry Services > 9090 TCP HTTPS Sending SCAP reports to the Capsule and > for the discovery image during provisioning > 53 TCP and UDP DNS Client DNS queries to a Capsule’s DNS > service (Optional) > 67 UDP DHCP Client to Capsule broadcasts, DHCP > broadcasts for Client provisioning from a Capsule (Optional) > 69 UDP TFTP Clients downloading PXE boot image files > from a Capsule for provisioning (Optional) > 5000 TCP HTTPS Connection to Katello for the Docker > registry (Optional) Much of this overlaps with the existing definition for "RH-satellite-6". <?xml version="1.0" encoding="utf-8"?> <service> <short>Red Hat Satellite 6</short> <description>Red Hat Satellite 6 is a systems management server that can be used to configure new systems, subscribe to updates, and maintain installations in distributed environments.</description> <include service="dns"/> <include service="http"/> <include service="https"/> <include service="dhcp"/> <include service="tftp"/> <port protocol="udp" port="68"/> <port protocol="tcp" port="5000"/> <port protocol="tcp" port="5646-5647"/> <port protocol="tcp" port="5671"/> <port protocol="tcp" port="8000"/> <port protocol="tcp" port="8080"/> <port protocol="tcp" port="8140"/> <port protocol="tcp" port="9090"/> </service> What do you need for satellite capsule exclusively? Only 8443? Hey Eric, Sorry for the delay. Yes, basically all Satellite ports and services plus 8443. regards rbertol upstream:
7beeb958d40c ("test(service): coverage for RH-Satellite-6")
cb20bcfe47ab ("feat(service): add RH-Satellite-6-Capsule")
b2ac0b3c11d5 ("improvement(service): RH-Satellite-6: include foreman service")
e10cae964a26 ("feat(service): add foreman and foreman-proxy")
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (firewalld bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2020:3863 |