Foreman 2.5/Katello 4.1 Content Proxy Setup Woes

Support
, ,
1

Problem:

I am trying to deploy a brand-new content proxy for a Foreman 2.5 / Katello 4.1 setup.

I do not want to mirror pulp content from the master; instead I just want to act the content proxy as a reverse HTTP proxy to the Foreman server. I attempted to achieve this by employing the --foreman-proxy-content-pulpcore-mirror=false option.

I generated certificates on the master, and then ran the installation tool on the content proxy, like so:

# foreman-installer \
    --scenario foreman-proxy-content \
    --certs-tar-file "/root/contentproxy-certs.tar" \
    --foreman-proxy-register-in-foreman "true" \
    --foreman-proxy-foreman-base-url "https://foreman" \
    --foreman-proxy-trusted-hosts "foreman" \
    --foreman-proxy-trusted-hosts "contentproxy" \
    --foreman-proxy-oauth-consumer-key "..." \
    --foreman-proxy-oauth-consumer-secret "..." \
    --puppet-server-foreman-url "https://foreman" \
    --foreman-proxy-puppet=false \
    --foreman-proxy-content-pulpcore-mirror=false
2021-07-30 08:59:55 [WARN  ] [boot] Unsetting environment variable 'http_proxy' for the duration of the install.
2021-07-30 08:59:55 [WARN  ] [boot] Unsetting environment variable 'https_proxy' for the duration of the install.
2021-07-30 08:59:55 [WARN  ] [boot] Unsetting environment variable 'HTTP_PROXY' for the duration of the install.
2021-07-30 08:59:55 [WARN  ] [boot] Unsetting environment variable 'HTTPS_PROXY' for the duration of the install.
2021-07-30 08:59:55 [NOTICE] [root] Loading installer configuration. This will take some time.
2021-07-30 08:59:59 [NOTICE] [root] Running installer with log based terminal output at level NOTICE.
2021-07-30 08:59:59 [NOTICE] [root] Use -l to set the terminal output log level to ERROR, WARN, NOTICE, INFO, or DEBUG. See --full-help for definitions.
...
2021-07-30 09:00:07 [NOTICE] [configure] Starting system configuration.
2021-07-30 09:00:21 [NOTICE] [configure] 250 configuration steps out of 1500 steps complete.
2021-07-30 09:00:23 [NOTICE] [configure] 500 configuration steps out of 1501 steps complete.
2021-07-30 09:00:24 [NOTICE] [configure] 750 configuration steps out of 1506 steps complete.
2021-07-30 09:00:24 [NOTICE] [configure] 1000 configuration steps out of 1509 steps complete.
2021-07-30 09:00:24 [NOTICE] [configure] 1250 configuration steps out of 1509 steps complete.
2021-07-30 09:00:33 [NOTICE] [configure] 1500 configuration steps out of 1509 steps complete.
2021-07-30 09:00:34 [NOTICE] [configure] System configuration has finished.
  Success!
  * Foreman Proxy is running at https://contentproxy:9090

  The full log is at /var/log/foreman-installer/foreman-proxy-content.log

Well, it says Success!, but the Apache configuration directory seems awfully empty:

# find /etc/httpd/conf.d/
/etc/httpd/conf.d/
/etc/httpd/conf.d/05-foreman.d
/etc/httpd/conf.d/05-foreman.conf

Apache is not even listening on port 443/tcp; and clients trying to register using subscription-manager are not happy either:

# subscription-manager register --org myorg --activationkey mykey
Network error, unable to connect to server. Please see /var/log/rhsm/rhsm.log for more information.

What am I missing here? Can my goal actually be achieved? Documentation is sparse to the point of being non-existant in this regard (or maybe I am looking in the wrong places).

Kind Regards
Florian

Foreman and Proxy versions:

Foreman:
foreman-2.5.2-1.el8.noarch
foreman-proxy-content-4.1.1-1.el7.noarch

Foreman and Proxy plugin versions:

katello-4.1.1-1.el8.noarch
foreman-proxy-2.5.2-1.el7.noarch

Distribution and version:

CentOS 8 Stream on the Foreman master.
CentOS 7.9 on the content proxy.

Other relevant data:

2

I don’t think this option does what you think. The option is false on the main server and true on the content proxy by default. Thus, with “false” it’s a full, syncing pulpcore and with “true” is a remote proxy. As far as I can tell, the pulp3 content proxy doesn’t mirror the whole content but only retrieves and caches what clients requested.

3

Yeah, we don’t really support treating the smart proxy as a ‘reverse proxy’ for all of content. There is a download policy we need to implement with pulp that would let us do that on the pulp server running on the smart proxy, but you would still need pulp running on the smart proxy.

The closest thing we have today is that you can deploy a smart proxy and by default the download policy is ‘on_demand’ which means that rpms are not downloaded to it until they are actually requested by a client. The feature i’m mentioning that we want to support in the future is a mode where by those rpms are also not even stored locally.