RFC: Host registration and Load balancers

ekohl · October 6, 2022, 1:47pm

This should be HTTP, not HTTPS: --foreman-proxy-template-url http://loadbalancer.example.com:8000

Registration is a bit of an odd feature in that it partially relies on templates, but not 100%.

For example, templates are retrieved over HTTP because tooling (such as Anaconda) can’t deal with HTTPS (either not at all or no way to provide HTTPS certificates). Even if modern versions can, we often need to support old versions. I have not checked if EL 9 can provision over HTTPS, but it’d surprise me.

So let’s figure out how the registration command determines the URL:

github.com

theforeman/foreman/blob/3750d2ce8a3609ae1e18d72eedab33d719219e60/app/controllers/concerns/foreman/controller/registration_commands.rb#L22-L26


      
          def endpoint
            return global_registration_url if registration_params['smart_proxy_id'].blank?
          
            "#{@smart_proxy.url}/register"
          end

So that doesn’t have any way to configure it.

It can respect a different URL if it’s sent beyond the first command:

github.com

theforeman/foreman/blob/3750d2ce8a3609ae1e18d72eedab33d719219e60/app/controllers/concerns/foreman/controller/registration.rb#L85-L96


      
          def registration_url
            uri = if params[:url].present?
                    URI.join(params[:url], '/register')
                  else
                    URI(register_url)
                  end
          
            return uri if uri.scheme && uri.host
          
            msg = N_('URL in :url parameter is missing a scheme, please set http:// or https://')
            fail Foreman::Exception.new(msg)
          end

This is generated here:

github.com

theforeman/smart-proxy/blob/a48da738dd0f41cb28c7042e5f2773a8d9a29293/modules/registration/proxy_request.rb#L38-L46


      
          def request_params(request)
            params = request.params
            params[:url] = register_url(request)
            params
          end
          
          def register_url(request)
            request.env['REQUEST_URI']&.split('/register')&.first
          end

I recall back when we designed the module I wanted an explicit parameter to configure the endpoint, but IIRC @Marek_Hulan preferred a dynamic endpoint since it saved configuration options. In RFC: Simple & automatic host registration WF - #52 by Marek_Hulan and the following posts we did talk about the case.

So in short: from Foreman there is no reliable way to know the external endpoint for registration in case of a Smart Proxy in a dual homed / load balanced setup.

But I’m going to make it even more complicated. We also have the HTTPBoot module. That exposes the ports it uses, which is then exposed here:

github.com

theforeman/smart-proxy/blob/a48da738dd0f41cb28c7042e5f2773a8d9a29293/modules/httpboot/httpboot_plugin.rb#L15-L16


      
          expose_setting :http_port
          expose_setting :https_port

And made available in Foreman here:

github.com

theforeman/foreman/blob/3750d2ce8a3609ae1e18d72eedab33d719219e60/app/models/smart_proxy.rb#L112-L126


      
          def httpboot_http_port
            setting(:HTTPBoot, 'http_port')
          end
          
          def httpboot_http_port!
            httpboot_http_port || raise(::Foreman::Exception.new(N_("HTTP boot requires proxy with httpboot feature and http_port exposed setting")))
          end
          
          def httpboot_https_port
            setting(:HTTPBoot, 'https_port')
          end
          
          def httpboot_https_port!
            httpboot_https_port || raise(::Foreman::Exception.new(N_("HTTPS boot requires proxy with httpboot feature and https_port exposed setting")))
          end

And then it’s used in cases like these:

github.com

theforeman/foreman/blob/3750d2ce8a3609ae1e18d72eedab33d719219e60/app/views/unattended/provisioning_templates/PXEGrub2/kickstart_default_pxegrub2.erb#L45-L70


      
          <%
          # Workaround for https://bugzilla.redhat.com/show_bug.cgi?id=1811561 and https://bugzilla.redhat.com/show_bug.cgi?id=1842893
          subnet = @host.provision_interface.subnet || @host.provision_interface.subnet6
          if subnet && subnet.httpboot
            proxy_http_port = subnet.httpboot.httpboot_http_port
            proxy_https_port = subnet.httpboot.httpboot_https_port
            # Workaround for "no DNS server configured" https://bugzilla.redhat.com/show_bug.cgi?id=1842509
            proxy_host = dns_lookup(subnet.httpboot.hostname)
          -%>
          <% if proxy_http_port -%>
          menuentry '<%= template_name %> EFI HTTP' --id efi_http {
            <%= linuxcmd %> (http,<%= proxy_host %>:<%= proxy_http_port %>)/httpboot/<%= @kernel %> <%= pxe_kernel_options %> <%= snippet("kickstart_kernel_options").strip %>
            <%= initrdcmd %> (http,<%= proxy_host %>:<%= proxy_http_port %>)/httpboot/<%= @initrd %>
          }
          <% else -%>
          # Smart proxy does not have HTTPBoot feature with HTTP port enabled, skipping EFI HTTP boot menu entry
          <% end -%>
          
          <% if proxy_https_port -%>
          menuentry '<%= template_name %> EFI HTTPS' --id efi_https {

This file has been truncated. show original

Note that also uses the Smart Proxy hostname.

I’ll still stand by my point that the Smart Proxy can’t be properly load balanced now and anyone pretending we can support it now is fooling themselves. Doing it properly is a massive effort.

What can be done today is with a select number of modules to 100% hide the Smart Proxy behind the load balancer and pretend all hostnames are the loadbalanced hostname. That means Foreman only talks to the load balanced Smart Proxy. However, it implies Pulp is also load balanced (shared storage, shared database).