#theforeman

hi everyone, im having an issue with the realm join feature in katello 3.0 (foreman 1.11) with redhat ipa.

i am looking at the privilege added for the realm-proxy user and wondering if there is a list of what permissions are required for that user.

foreman-prepare-realm creates

it

you can just edit the script and look

i found this: http://projects.theforeman.org/projects/foreman... and noticed that my user does not have the smae permissions as whats listed here.

i have no idea why that's in the wiki

just edit the script on your box, you can see the permissions

where is the script?

which foreman-prepare-realm

will tell you

you did run foreman-prepare-realm?

yea.

so hosts get created and dns gets created, but on host deletion, dns records stay around.

and also we noticed that when choosing 'rebuild host' .. the realm join seems to fail because the entry is still around in ipa and the OTP doesnt get set properly.

so the host in freeipa isn't getting deleted either?

stbenjam: sometimes it works, sometimes it doesnt.

i havent narrowed down specific scenarios yet as to when it works vs when it fails.

logs would help

host deletion works (removes host from ipa) but the DNS doesnt get deleted.

everything is logged in /var/log/foreman/production.log, /var/log/foreman-proxy/proxy.log, and the freeipa server

ok, i do notice that the privilege in IPA does NOT have all the things listed in this script.

you can just rerun it

what is the difference between v1 and v2 in this script?

just which version of ipa we are running?

basically

freeipa 4.x uses permissions system v2

ok, im going to grab some logs and dump them in pastebin and report back s hortly.

I'm trying to install katello 3.1rc2 and the installed fails in few places. The first one is during rake db:migrate step. The backtrace is https://paste.fedoraproject.org/417332/56819514/ Any ideas?

another issue im seeing with a new install of katello 3.0 is that hammer doesnt seem to add all the necessary options from hostgroups when using hammer host create. it seems to skip lifecycle environment, content view, media, and partition table.

Are Katello versions bound to specific Foreman versions? For example, does Katello 3.0 expect Foreman 1.11?

aitrus: yes

jsherrill: Thanks

I've been running 3.1rc2 with TFM 1.12.2 and my Puppet stuff has just fallen apart (my emails to the list about naming conflicts)

So I'm setting up a new 3.0/1.11 box, but after a fresh install I don't see my Smart Proxy listed as a host like I did with 3.1

When deploying VM images, is i possible to deploy more than 1 at a time?

Which means that there is no "import environments" / "import classes" buttons

Is it normal for the Smart Proxy to not show up as a registered host in a fresh install?

aitrus: you have to register it via sub-man

then it will finish the linking process and you'll be good to go

(well, assuming you are asking about a katello + foreman install:)

beav: yeah, fresh kat 3.0 / tfm 1.11 install

I just don't remember doing that with the 3.1rc/1.12 stuff :-\

does anyone integrate foreman with PE 2016?

or has improvements to razor and console services made that pointless?

beav: I just want to make sure I'm understanding you correctly. You're saying to install the katello-ca-consumer RPM on my Smart Proxy (which is the same as my Katello/TFM server - I only have one server overall) and then run sub-man, right? I'm double-checking because my 3.1/1.12 setup doesn't have this and still showed up as a Content Host

aitrus: oh sorry, i thought you had a different server for the smart proxy

aitrus: that should not be needed

aitrus: what issue are you having?

Lots :-(

But to focus on one...

I did a fresh single-server install of Kat 3.0/Foreman 1.11

And my host isn't showing up as a content host

by host, you mean the system itself?

Yeah

i think that is expected

So if I go to Configure -> Environments there is no "import from <smart proxy>"

oh

aitrus: i would need to try to replicate it

If I go to Infrastructure -> Smart Proxies my host is listed, and includes Puppet and Puppet CA "features"

aitrus: so you are attempting to publish puppet modules?

that are in a CV

I don't have any modules yet, I'm trying to get there

This all came about because I had puppet working on 3.1rc2 w/ TFM 1.12, and then added OpenSCAP and everything blew up

And I'm trying to figure out if I just don't understand the relationships or if there is a bug

I posted a few big emails to the list but haven't gotten any responses

Here's my foreman-installer command: https://tresgeek.net/pb/view/48960040