Implications of removed Smartproxy installer option on Katello

Community
, ,
1

In version 3.13+ of Foreman, the --foreman-proxy-content-reverse-proxy installer option has been removed.

I was curious about the implications of the removal of this installer option as my configuration leverages this feature for host discovery

It seems as though the functionality has been integrated without explicitly requiring this option to be specified (which is no longer possible to do as it has been removed) however this is not clearly stated anywhere in the documentation or release notes (as far as I have read)

I was hoping to possibly get some clarification of what exactly has changed

1 Like
2

What part of the discovery process uses the (now disabled) reverse proxy on port 8443?

1 Like
3

It has been announced as part of 3.12 Release Notes, but I am also missing this information in the Foreman 3.13 release notes.

https://docs.theforeman.org/3.12/Release_Notes/index-katello.html#_port_8443_disabled_by_default

1 Like
4

Host registration is one of the processes that utilized port 8443.

With usage of this port is being removed at the application level though, it seems like we would have to handle these processes on a different port (perhaps just on 443 with the rest of apache?)

1 Like
5

Host registration uses 443, yes. You don’t have to do anything special for that.

2 Likes
6

My understanding is that process which previously ran through the reverse proxy on 8443 will work on 443. Is this correct?

I will need to do some validation of this on my systems as well of course but I was previously under the assumption that the reverse proxy functionality was simply being removed instead of being handled all under the same port

1 Like
7

The reverse proxy on port 8443 handled two key aspects:

  • Host registration
  • Full reverse proxy for all APIs and the UI of Foreman

The reverse proxy on port 443 handles:

  • Host registration
  • Specifically identified or requested API endpoints

The reverse proxy on port 8443 is the aspect that is being removed and along with it the full reverse proxy for all APIs and the UI. Why did we make this change?

  • Aligning on port 443 allows users to reduce their firewall burden
  • Full reverse proxy access to the API and UI creates a large potential attack surface through the Apache reverse proxy.

Host registration works through port 443, and all elements such as Global Registration are updated to handle this. Endpoints that are not included in the specific list of API endpoints maintained for 443 can be requested. We ask that if you do request an endpoint that you provide that the workflow for needing that endpoint is.

5 Likes
8

Thanks, I really appreciate this clarification!

1 Like
9

Actually, if you do this right then you use the Foreman Proxy for this, which in Katello runs on port 9090. You do need to enable the registration feature for this, but the foreman-proxy-content scenario does this by default:

Otherwise you can make this explicit by passing --foreman-proxy-registration true to the installer.

3 Likes