Deploy a SUSE Manager 5.0 Proxy

Table of Contents

1. Hardware Requirements for the Proxy
2. Sync the Parent and Proxy Extension Child Channels
3. SLE Micro 5.5 Installation
- 3.1. Update the System
- 3.2. Configure Custom Persistent Storage
4. Create an Activation Key for the Proxy
5. Bootstrap the Proxy Host as a Client
6. Generate the Proxy Configuration
7. Transfer the Proxy Configuration
8. Start the SUSE Manager 5.0 Proxy
- 8.1. Using a Custom Container Image for a Service

This guide outlines the deployment process for the SUSE Manager 5.0 Proxy. This guide presumes you have already successfully deployed a SUSE Manager 5.0 Server.

SLE Micro is only supported as regular minion (default contact method) for the time being. We are working on managing it as Salt SSH client (salt-ssh contact method), too.

To successfully deploy, you will perform the following actions:

Task: Proxy Deployment

Review hardware requirements.
Synchronize the SLE Micro 5.5 parent channel and the proxy extension child channel on the server.
Install SLE Micro 5.5 on a bare-metal machine.
During the installation, register SLE Micro 5.5 along with the SUSE Manager 5.0 Proxy extension.
Create a Salt activation key.
Bootstrap the proxy as a client with the default connection method.
Generate a proxy configuration.
Transfer the proxy configuration from server to proxy.
Use the proxy configuration to register the client as a proxy with SUSE Manager.

Supported operating system for the Proxy Container Host

The supported operating system for the container host is SLE Micro 5.5.

Container host: A container host is a server equipped with a container engine like Podman, which lets it manage and deploy containers. These containers hold applications and their essential parts, such as libraries, but not a full operating system, making them lightweight. This setup ensures applications run the same way in different environments. The container host supplies the necessary resources such as CPU, memory, and storage for these containers.

1. Hardware Requirements for the Proxy

This table shows the hardware requirements for deploying SUSE Manager Proxy.

Table 1. Proxy Hardware Requirements
Hardware	Details	Recommendation
CPU	x86-64, ARM	Minimum 2 dedicated 64-bit CPU cores
RAM	Minimum	2 GB
	Recommended	8 GB
Disk Space	`/` (root directory)	Minimum 40 GB
	`/var/lib/containers/storage/volumes/srv-www`	Minimum 100 GB, storage requirements should be calculated for the number of ISO distribution images, containers, and bootstrap repositories you will use.
	`/var/lib/containers/storage/volumes/var-cache` (Squid)	Minimum 100 GB

2. Sync the Parent and Proxy Extension Child Channels

This section presumes that you have already entered your organization credentials under the Admin Setup Wizard → Organization Credentials in the Servers Web UI. Products are listed on the Admin Setup Wizard → Products page. This channel must be fully synchronized on the server, with the child channel Proxy as an extension option selected.

Figure 1. SUSE Manager 5.0 Channel Sync for Proxy

Task: Sync the Proxy Parent Channel and Proxy Extension

In the SUSE Manager Web UI select Admin Products.
From the products page enter SLE Micro in the filter field.
Next use the drop-down to select the required architecture. For this example x86-64.
In the Product Description field select the SLE Micro 5.5 checkbox then use the drop-down to select the SUSE Manager Proxy Extension 5.0 x86_64 BETA extension.
Click the Add products button.
Wait for the synchronization to complete.

3. SLE Micro 5.5 Installation

Task: Download the Installation Media

Locate the SLE Micro 5.5 installation media at https://www.suse.com/download/sle-micro/.
You will need an account with SUSE Customer Center and must be logged in to download the ISO.
Download SLE-Micro-5.5-DVD-x86_64-GM-Media1.iso.
Prepare a USB flash disk or DVD for installation.
Insert a DVD or a bootable USB stick containing the installation image for SLE Micro 5.5.
Boot or reboot your system.

For detailed documentation on preparing your machines OS (virtual or physical), see SLE Micro 5.5 Deployment Guide.

Task: SLE Micro 5.5 Installation

Use the arrow keys to select Installation.
Adjust Keyboard and language. Click the checkbox to accept the license agreement.
Click Next to continue.

Select your registration method. For this example, we will register the server with SUSE Customer Center.

SUSE Manager 5.0 Proxy as an extension

The SUSE Manager 5.0 Proxy is registered as an extension. Therefore, in addition to acquiring an SUSE Customer Center registration key for SLE Micro 5.5, you will also need an SUSE Customer Center registration code for the following extension:

SUSE Manager 5.0 Proxy

Enter your SUSE Customer Center Email address.
Enter your registration code for SLE Micro 5.5.
Click Next to continue.
On the Extension and Module Selection page uncheck the Hide Development Versions checkbox.
Select the SUSE Manager 5.0 Proxy extension Checkbox.
Click Next to continue.
Enter your SUSE Manager 5.0 Proxy extension registration code.
Click Next to continue.
On the NTP Configuration page click Next.
On the Authentication for the System page enter a password for the root user. Click Next.
On the Installation Settings page click Install.

This finalizes installation of SLE Micro 5.5 and SUSE Manager 5.0 Proxy as an extension.

3.1. Update the System

Task: Update the System

Login as root.
Run transactional-update:
```
transactional-update
```
Reboot the system.
Log in as root.
Install the container utilities:

Alternatively you may install mgrpxy-zsh-completion or mgrpxy-fish-completion.
```
transactional-update pkg install mgrpxy mgrpxy-bash-completion
```
Reboot the system.

3.2. Configure Custom Persistent Storage

This step is optional. However, if custom persistent storage is required for your infrastructure, use the mgr-storage-proxy tool.

For more information, see mgr-storage-proxy --help. This tool simplifies creating the container storage and Squid cache volumes.

Use the command in the following manner:
```
mgr-storage-proxy <storage-disk-device>
```
For example:
```
mgr-storage-proxy /dev/nvme1n1
```
This command will create the persistent storage volumes at /var/lib/containers/storage/volumes.

For more information, see List of persistent storage volumes.

4. Create an Activation Key for the Proxy

Task: Create an Activation Key

Select Systems Activation Keys then click Create key.
Create an activation key for the proxy host with SLE Micro 5.5 as the parent channel. This key should include all recommended channels and the proxy as an extension child channel.
Proceed to boostrapping the proxy host as a default client.

5. Bootstrap the Proxy Host as a Client

Task: Bootstrap the Proxy Host

Select Systems Bootstrapping.
Fill in the fields for your proxy host.
Select the activation key created in the previous step from the drop-down.
Click Bootstrap.
Wait for the bootstrap process to complete successfully. Check the Salt menu and confirm the Salt key is listed and accepted.
Reboot the proxy host.
Select the host from the System list and trigger a second reboot after all events are finished to conclude the onboarding.

Task: Update the Proxy Host

Select the host from the Systems list and apply all patches to update it.
Reboot the proxy host.

6. Generate the Proxy Configuration

The configuration archive of the SUSE Manager Proxy is generated by the SUSE Manager Server. Each additional Proxy requires its own configuration archive.

2 GB represents the default proxy squid cache size. This will need to be adjusted for your environment.

For Podman deployment, the container host for the SUSE Manager Proxy must be registered as a client to the SUSE Manager Server prior to generating this proxy configuration.

If a proxy FQDN is used to generate a proxy container configuration that is not a registered client (as in the Kubernetes use case), a new system entry will appear in system list. This new entry will be shown under previously entered Proxy FQDN value and will be of Foreign system type.

6.1. Generate the Proxy Configuration with Web UI

Procedure: Generating a Proxy Container Configuration using Web UI

In the Web UI, navigate to Systems Proxy Configuration and fill the required data:
In the Proxy FQDN field type fully qualified domain name for the proxy.
In the Parent FQDN field type fully qualified domain name for the SUSE Manager Server or another SUSE Manager Proxy.
In the Proxy SSH port field type SSH port on which SSH service is listening on SUSE Manager Proxy. Recommended is to keep default 8022.
In the Max Squid cache size [MB] field type maximal allowed size for Squid cache. Recommended is to use at most 60% of available storage for the containers.

2 GB represents the default proxy squid cache size. This will need to be adjusted for your environment.
In the SSL certificate selection list choose if new server certificate should be generated for SUSE Manager Proxy or an existing one should be used. You can consider generated certificates as SUSE Manager builtin (self signed) certificates.

Depending on the choice then provide either path to signing CA certificate to generate a new certificate or path to an existing certificate and its key to be used as proxy certificate.

The CA certificates generated by the server are stored in the /var/lib/containers/storage/volumes/root/_data/ssl-build directory.

For more information about existing or custom certificates and the concept of corporate and intermediate certificates, see Import SSL Certificates.
Click Generate to register a new proxy FQDN in the SUSE Manager Server and generate a configuration archive (config.tar.gz) containing details for the container host.
After a few moments you are presented with file to download. Save this file locally.

6.2. Generate the Proxy Configuration with spacecmd and Self-Signed Certificate

Procedure: Generating Proxy Configuration with spacecmd and Self-Signed Certificate

You can generate a Proxy configuration using spacecmd.

SSH into your container host.

Execute the following command replacing the Server and Proxy FQDN:

mgrctl exec -ti 'spacecmd proxy_container_config_generate_cert -- dev-pxy.example.com dev-srv.example.com 2048 email@example.com' -o /tmp/config.tar.gz

Copy the generated configuration from the server container:
```
mgrctl cp server:/tmp/config.tar.gz .
```

6.3. Generate the Proxy Configuration with spacecmd and Custom Certificate

You can generate a Proxy configuration using spacecmd for a custom certificates rather than the default self-signed certificates.

Procedure: Generating Proxy Configuration with spacecmd and Custom Certificate

SSH into your Server container host.

Execute the following command replacing the Server and Proxy FQDN:

for f in ca.crt proxy.crt proxy.key; do
  mgrctl cp $f server:/tmp/$f
done
mgrctl exec -ti 'spacecmd proxy_container_config -- -p 8022 pxy.example.com srv.example.com 2048 email@example.com /tmp/ca.crt /tmp/proxy.crt /tmp/proxy.key -o /tmp/config.tar.gz'

Copy the generated configuration from the server container:
```
mgrctl cp server:/tmp/config.tar.gz .
```

7. Transfer the Proxy Configuration

The Web UI generates a configuration archive. This archive needs to be made available on the proxy container host.

Task: Copy the Proxy Configuration

Copy the configuration archive (config.tar.gz) generated in the previous step to the Proxy host:
```
scp config.tar.gz <proxy-FQDN>:/root
```
Install the Proxy with:
```
mgrpxy install podman config.tar.gz
```

8. Start the SUSE Manager 5.0 Proxy

Container can now be started with the mgrpxy command:

Task: Start and Check Proxy Status

Start the Proxy by calling:
```
mgrpxy start
```
Check container status by calling:
```
mgrpxy status
```
Five SUSE Manager Proxy containers should be present:
- proxy-salt-broker
- proxy-httpd
- proxy-tftpd
- proxy-squid
- proxy-ssh

And should be part of the proxy-pod container pod.

8.1. Using a Custom Container Image for a Service

By default, the SUSE Manager Proxy suite is configured to use the same image version and registry path for each of its services. However, it is possible to override the default values for a specific service using the install parameters ending with -tag and -image.

For example, use it like this:

mgrpxy install podman --httpd-tag 0.1.0 --httpd-image registry.opensuse.org/uyuni/proxy-httpd /path/to/config.tar.gz

It adjusts the configuration file for the httpd service, where registry.opensuse.org/uyuni/proxy-httpds is the image to use and 0.1.0 is the version tag, before restarting it.

To reset the values to defaults, run the install command again without those parameters:

mgrpxy install podman /path/to/config.tar.gz

This command first resets the configuration of all services to the global defaults and then reloads it.