Multiple networks with a single smart proxy

Is there any planned support to specify a boot server IP on a per-subnet
basis, similar to the "–server" parameter that cobbler has?

I am supporting a foreman setup with multiple datacenters. Each DC has a
single host handling dhcp/tftp services and has the smart proxy installed.
Since regular servers cannot reach foreman themselves due to firewall
restrictions, the servers with the smart proxy installed also run nginx to
proxy any foreman traffic to the single foreman instance.

What I have here:

  foreman.mydomain.com is the main foreman server. The short name 

"foreman" resolves to the foreman proxies in their respective datacenter by
using the datacenter-specific subdomain ${DC}.mydomain.com.

My "PXE Servers" as well call them here have three interfaces:

   foreman.${DC}.mydomain.com
     10.1.1.100  (routable network)
     10.1.2.100  (private non-routable network)
     10.1.3.100  (private non-routable network)

Someone could build on any of these three networks. Most of our production
servers have one of these two private networks attached to it, so we build
over it. However since 10.1.2.0 and 10.1.3.0 are on private networks, they
cannot do things like resolve DNS initially. We are not allowed to build
over production networks (10.1.1.0 is an admin network that we don't use
for production) It is a requirement that we do everything possible to not
have to manually make changes to a host after it's built, such as re-IPing
the host.

I got past this before by hacking up foreman 1.3 to have a "pxe server"
field in the subnet definition that I could then use in my templates. So
for my PXELinux template I have the following code, which takes the
provision URL, and if the host is on one of the private networks with a
pxe_server defined, replaces the hostname with the IP address. Otherwise,
the hostname (foreman.mydomain.com) is replaced with
foreman.${DC}.mydomain.com

<% if @host.subnet.pxe_server and !@host.subnet.pxe_server.empty? -%>
APPEND initrd=<%= @initrd %> ks=<%= foreman_url("provision").to_s.gsub(
%r{//[^/]+/}, "//#{@host.subnet.pxe_server}/") %> ksdevice=<%= @ksdevice %>
network kssendmac selinux=0
<% else -%>
APPEND initrd=<%= @initrd %> ks=<%= foreman_url("provision").to_s.gsub(
%r{//[^/]+/}, "//foreman.#{ @host.location.to_s.downcase }.#{ @host.domain
}/") %> ksdevice=<%= @ksdevice %> network kssendmac selinux=0
<% end -%>

Doing this is largely what has held me back from upgrading all this time. I
am trying to test and roll out 1.11 and am trying not to have to hack up
the code. The 1.11 setup is using iPXE, so I can have my iPXE template
insert "${net0/dhcp-server} " into the foreman url. This works for getting
the build clients on private networks to download their kickstart file
because ipxe knows the interface IP of the dhcp server it used. However,
this variable is evaluated by ipxe instead of foreman, so when the build
clients download their kickstart file, I can't modify the value of "url" to
use the correct network build location like I could when I had the
@host.subnet.pxe_server value available to me in rails.

I've looked into what it might take to make a plugin to add this
"pxe_server" field to the Subnets but am having a hard time. I know enough
ruby to handle the simple things in snippets, but I know little about
rails. I made the above mentioned hack with lots of help from google. :slight_smile:

Any thoughts?

Thanks

Bill

Digging further it looks like I will be able to do this in 1.12 with subnet
parameters.

Bill

··· On Friday, April 29, 2016 at 11:19:18 AM UTC-4, Bill Sirinek wrote: > > > Is there any planned support to specify a boot server IP on a per-subnet > basis, similar to the "--server" parameter that cobbler has? > > I am supporting a foreman setup with multiple datacenters. Each DC has a > single host handling dhcp/tftp services and has the smart proxy installed. > Since regular servers cannot reach foreman themselves due to firewall > restrictions, the servers with the smart proxy installed also run nginx to > proxy any foreman traffic to the single foreman instance. > > What I have here: > > foreman.mydomain.com is the main foreman server. The short name > "foreman" resolves to the foreman proxies in their respective datacenter by > using the datacenter-specific subdomain ${DC}.mydomain.com. > > My "PXE Servers" as well call them here have three interfaces: > > foreman.${DC}.mydomain.com > 10.1.1.100 (routable network) > 10.1.2.100 (private non-routable network) > 10.1.3.100 (private non-routable network) > > Someone could build on any of these three networks. Most of our production > servers have one of these two private networks attached to it, so we build > over it. However since 10.1.2.0 and 10.1.3.0 are on private networks, they > cannot do things like resolve DNS initially. We are not allowed to build > over production networks (10.1.1.0 is an admin network that we don't use > for production) It is a requirement that we do everything possible to not > have to manually make changes to a host after it's built, such as re-IPing > the host. > > I got past this before by hacking up foreman 1.3 to have a "pxe server" > field in the subnet definition that I could then use in my templates. So > for my PXELinux template I have the following code, which takes the > provision URL, and if the host is on one of the private networks with a > pxe_server defined, replaces the hostname with the IP address. Otherwise, > the hostname (foreman.mydomain.com) is replaced with foreman.${DC}. > mydomain.com > > <% if @host.subnet.pxe_server and !@host.subnet.pxe_server.empty? -%> > APPEND initrd=<%= @initrd %> ks=<%= > foreman_url("provision").to_s.gsub( %r{//[^/]+/}, > "//#{@host.subnet.pxe_server}/") %> ksdevice=<%= @ksdevice %> network > kssendmac selinux=0 > <% else -%> > APPEND initrd=<%= @initrd %> ks=<%= > foreman_url("provision").to_s.gsub( %r{//[^/]+/}, "//foreman.#{ > @host.location.to_s.downcase }.#{ @host.domain }/") %> ksdevice=<%= > @ksdevice %> network kssendmac selinux=0 > <% end -%> > > Doing this is largely what has held me back from upgrading all this time. > I am trying to test and roll out 1.11 and am trying not to have to hack up > the code. The 1.11 setup is using iPXE, so I can have my iPXE template > insert "${net0/dhcp-server} " into the foreman url. This works for getting > the build clients on private networks to download their kickstart file > because ipxe knows the interface IP of the dhcp server it used. However, > this variable is evaluated by ipxe instead of foreman, so when the build > clients download their kickstart file, I can't modify the value of "url" to > use the correct network build location like I could when I had the > @host.subnet.pxe_server value available to me in rails. > > I've looked into what it might take to make a plugin to add this > "pxe_server" field to the Subnets but am having a hard time. I know enough > ruby to handle the simple things in snippets, but I know little about > rails. I made the above mentioned hack with lots of help from google. :) > > Any thoughts? > > Thanks > > Bill > >

Hi Bill,

I was wondering if you could link to the resource you found?

I need to have my foreman be able to assign IPs on subnets that it cannot
speak to as well. When you say subnet paramenters, are you talking about
per-host parameters that you set and a kickstart file takes into account?

For my case, I can assign a host a subnet during provisioning but a
post-script that sets the IP to something in a parameter would also work.

··· On Tuesday, May 3, 2016 at 6:13:05 AM UTC-7, Bill Sirinek wrote: > > Digging further it looks like I will be able to do this in 1.12 with > subnet parameters. > > Bill > > > On Friday, April 29, 2016 at 11:19:18 AM UTC-4, Bill Sirinek wrote: >> >> >> Is there any planned support to specify a boot server IP on a per-subnet >> basis, similar to the "--server" parameter that cobbler has? >> >> I am supporting a foreman setup with multiple datacenters. Each DC has a >> single host handling dhcp/tftp services and has the smart proxy installed. >> Since regular servers cannot reach foreman themselves due to firewall >> restrictions, the servers with the smart proxy installed also run nginx to >> proxy any foreman traffic to the single foreman instance. >> >> What I have here: >> >> foreman.mydomain.com is the main foreman server. The short name >> "foreman" resolves to the foreman proxies in their respective datacenter by >> using the datacenter-specific subdomain ${DC}.mydomain.com. >> >> My "PXE Servers" as well call them here have three interfaces: >> >> foreman.${DC}.mydomain.com >> 10.1.1.100 (routable network) >> 10.1.2.100 (private non-routable network) >> 10.1.3.100 (private non-routable network) >> >> Someone could build on any of these three networks. Most of our >> production servers have one of these two private networks attached to it, >> so we build over it. However since 10.1.2.0 and 10.1.3.0 are on private >> networks, they cannot do things like resolve DNS initially. We are not >> allowed to build over production networks (10.1.1.0 is an admin network >> that we don't use for production) It is a requirement that we do >> everything possible to not have to manually make changes to a host after >> it's built, such as re-IPing the host. >> >> I got past this before by hacking up foreman 1.3 to have a "pxe server" >> field in the subnet definition that I could then use in my templates. So >> for my PXELinux template I have the following code, which takes the >> provision URL, and if the host is on one of the private networks with a >> pxe_server defined, replaces the hostname with the IP address. Otherwise, >> the hostname (foreman.mydomain.com) is replaced with foreman.${DC}. >> mydomain.com >> >> <% if @host.subnet.pxe_server and !@host.subnet.pxe_server.empty? -%> >> APPEND initrd=<%= @initrd %> ks=<%= >> foreman_url("provision").to_s.gsub( %r{//[^/]+/}, >> "//#{@host.subnet.pxe_server}/") %> ksdevice=<%= @ksdevice %> network >> kssendmac selinux=0 >> <% else -%> >> APPEND initrd=<%= @initrd %> ks=<%= >> foreman_url("provision").to_s.gsub( %r{//[^/]+/}, "//foreman.#{ >> @host.location.to_s.downcase }.#{ @host.domain }/") %> ksdevice=<%= >> @ksdevice %> network kssendmac selinux=0 >> <% end -%> >> >> Doing this is largely what has held me back from upgrading all this time. >> I am trying to test and roll out 1.11 and am trying not to have to hack up >> the code. The 1.11 setup is using iPXE, so I can have my iPXE template >> insert "${net0/dhcp-server} " into the foreman url. This works for getting >> the build clients on private networks to download their kickstart file >> because ipxe knows the interface IP of the dhcp server it used. However, >> this variable is evaluated by ipxe instead of foreman, so when the build >> clients download their kickstart file, I can't modify the value of "url" to >> use the correct network build location like I could when I had the >> @host.subnet.pxe_server value available to me in rails. >> >> I've looked into what it might take to make a plugin to add this >> "pxe_server" field to the Subnets but am having a hard time. I know enough >> ruby to handle the simple things in snippets, but I know little about >> rails. I made the above mentioned hack with lots of help from google. :) >> >> Any thoughts? >> >> Thanks >> >> Bill >> >>