Containerized SUSE Manager Proxy Setup
Once container host for SUSE Manager Proxy containers is prepared, setup of containers require few additional steps to finish configuration.
-
Generate SUSE Manager Proxy configuration archive file
-
Transfer configuration archive to the container host prepared in installation step and extract it
-
Start the proxy sevices with
mgrpxy
1. Generate the Proxy Configuration
The configuration archive of the SUSE Manager Proxy is generated by the SUSE Manager Server. Each additional Proxy requires its own configuration archive.
2 GB represents the default proxy squid cache size. This will need to be adjusted for your environment. |
For Podman deployment, the container host for the SUSE Manager Proxy must be registered as a client to the SUSE Manager Server prior to generating this proxy configuration. |
If a proxy FQDN is used to generate a proxy container configuration that is not a registered client (as in the Kubernetes use case), a new system entry will appear in system list.
This new entry will be shown under previously entered Proxy FQDN value and will be of Foreign
system type.
1.1. Generate the Proxy Configuration with Web UI
-
In the Web UI, navigate to
and fill the required data: -
In the
Proxy FQDN
field type fully qualified domain name for the proxy. -
In the
Parent FQDN
field type fully qualified domain name for the SUSE Manager Server or another SUSE Manager Proxy. -
In the
Proxy SSH port
field type SSH port on which SSH service is listening on SUSE Manager Proxy. Recommended is to keep default 8022. -
In the
Max Squid cache size [MB]
field type maximal allowed size for Squid cache. Recommended is to use at most 60% of available storage for the containers.2 GB represents the default proxy squid cache size. This will need to be adjusted for your environment.
-
In the
SSL certificate
selection list choose if new server certificate should be generated for SUSE Manager Proxy or an existing one should be used. You can consider generated certificates as SUSE Manager builtin (self signed) certificates.Depending on the choice then provide either path to signing CA certificate to generate a new certificate or path to an existing certificate and its key to be used as proxy certificate.
The CA certificates generated by the server are stored in the
/var/lib/containers/storage/volumes/root/_data/ssl-build
directory.For more information about existing or custom certificates and the concept of corporate and intermediate certificates, see Import SSL Certificates.
-
Click Generate to register a new proxy FQDN in the SUSE Manager Server and generate a configuration archive (
config.tar.gz
) containing details for the container host. -
After a few moments you are presented with file to download. Save this file locally.
1.2. Generate the Proxy Configuration with spacecmd and Self-Signed Certificate
You can generate a Proxy configuration using spacecmd.
-
SSH into your container host.
-
Execute the following command replacing the Server and Proxy FQDN:
mgrctl exec -ti 'spacecmd proxy_container_config_generate_cert -- dev-pxy.example.com dev-srv.example.com 2048 email@example.com -o /tmp/config.tar.gz'
-
Copy the generated configuration from the server container:
mgrctl cp server:/tmp/config.tar.gz .
1.3. Generate the Proxy Configuration with spacecmd and Custom Certificate
You can generate a Proxy configuration using spacecmd for a custom certificates rather than the default self-signed certificates.
-
SSH into your Server container host.
-
Execute the following command replacing the Server and Proxy FQDN:
for f in ca.crt proxy.crt proxy.key; do mgrctl cp $f server:/tmp/$f done mgrctl exec -ti 'spacecmd proxy_container_config -- -p 8022 pxy.example.com srv.example.com 2048 email@example.com /tmp/ca.crt /tmp/proxy.crt /tmp/proxy.key -o /tmp/config.tar.gz'
-
Copy the generated configuration from the server container:
mgrctl cp server:/tmp/config.tar.gz .
2. Transfer SUSE Manager Proxy configuration
Both spacecmd
command and Web UI ways generate a configuration archive.
This archive needs to be made available on container host.
Transfer this generated archive to the container host.
For installation instructions to use the archive to get the proxy containers, see Install containerized SUSE Manager Proxy.
3. Start SUSE Manager Proxy containers
Container can now be started with the mgrpxy
command:
mgrpxy start uyuni-proxy-pod
Check if all containers started up as expected by calling
podman ps
Five SUSE Manager Proxy containers should be present:
-
proxy-salt-broker
-
proxy-httpd
-
proxy-tftpd
-
proxy-squid
-
proxy-ssh
And should be part of proxy-pod
container pod.