Subscribe to the feed

We released Red Hat Satellite 6.12 last month. The release includes several new features designed to help you manage your Red Hat Enterprise Linux (RHEL) environment more effectively, including remote execution pull mode. In this blog entry, I’ll write about the differences between remote execution pull mode and push mode and provide a step-by-step guide on configuring it.

What is remote execution?

Remote execution (or REX) enables you to run shell scripts, Ansible tasks, and Ansible Playbooks on remote hosts managed by Satellite. Brian Smith wrote an extensive introduction to remote execution in Satellite. The official Satellite 6.12 documentation also describes remote execution in great depth.

REX jobs are dispatched to hosts by the Capsule server (or Capsule service running on a Satellite server) using the Secure Shell (SSH) service. Port 22 must be open on hosts to enable REX.  

What is remote execution pull mode?

Remote execution pull mode uses Message Queuing Telemetry Transport (MQTT) to publish jobs on Capsule servers (or Capsule service running on a Satellite server). Managed hosts subscribe to the MQTT broker to receive REX job notifications.

Here’s how REX Pull mode works:

  1. A managed host receives MQTT notification that there is a new REX job.
  2. The managed host downloads the job “payload” via HTTPS from the Capsule server.  
  3. The job “payload” is run on the host. As the job executes, the progress of the job is reported back to the Capsule server.

Here are the configuration considerations:

  • Port 1883 (MQTT) must be opened on the Capsule server to allow incoming traffic, and the host must be allowed to connect to the Capsule server on port 443 (HTTPS) to enable REX pull mode.
  • Capsule servers (and Capsule services) must be configured to support either REX push mode or REX pull mode. You cannot configure a Capsule to support both REX modes.
  • For existing hosts running the katello agent, you can migrate to REX pull mode by installing the katello-pull-transport-migrate package. Documentation is provided at the bottom of this post. The katello agent has been deprecated as of Satellite 6.7.

For customers with security policies that forbid the opening of port 22, REX pull mode provides some respite. Satellite 6.12 provides the first iteration of the implementation of REX pull mode. Expect to see additional features in Satellite 6.13.

When do I use Red Hat Ansible Automation Platform?

REX and the capability of running Ansible tasks and playbooks within Satellite are intended to automate the configuration of hosts. For example, after provisioning several hosts, one might apply a firewall system role (from the RHEL System Roles Collection) to configure the hosts’ firewall or install Microsoft SQL Server.

Ansible Automation Platform should be considered when configuration and Day 2 operations require automation, such as the following:

  • Orchestration of fleets of VMs across the open hybrid cloud
  • Managing the configuration of networking devices across data centers
  • Enabling application deployment to integrate load balancer changes and CMDB configuration
  • Enabling developers to provision their storage objects in an automated fashion when needed
  • Embedding the automated configuration of external services into the CI/CD pipeline
  • Integrating firewalls with intrusion detection systems into streamlined security remediation workflows
  • Managing the life cycle of existing applications and infrastructure, updating applications and hardware in streamlined processes

Go here for more information on Ansible Automation Platform.

Configuring remote execution pull mode

Assumptions

My environment consists of the following:

  • Red Hat Satellite 6.12 Satellite server running on RHEL 8.7
  • Red Hat Satellite 6.12 Capsule server running on RHEL 8.7

REX pull mode will be configured on the Capsule server.

Satellite Capsule configuration

On the Capsule server, enable pull-based transport.

satellite-installer --foreman-proxy-plugin-remote-execution-script-mode pull-mqtt

Open port 1883 to allow MQTT through the firewall.

firewall-cmd --add-port="1883/tcp"
firewall-cmd --runtime-to-permanent

Here’s a list of all the ports you should have open.

Satellite REX pull mode: screenshot of a terminal window displaying a list of the ports that should be open.

Finally, configure your Satellite server so that hosts registered to this Capsule server will continue to receive remote execution jobs from it. 

In Satellite, click on “Administer” and “Settings”.

Satellite REX pull mode: screenshot of the Administer > Settings menu with Settings highlighted with a red box

Click on the “Content” tab.

Satellite REX pull mode: screenshot of the Satellite Settings UI with the Content tab highlighted with a red box

Finally, set the attribute “Prefer registered through Capsule for remote execution” to Yes.

Screenshot of the UI with Yes highlighted with a red box

Capsule content

At this point, the new Capsule server may or may not have any content. In this example, the capsule has no content and needs to be synchronized. 

First, check that a lifecycle environment has been assigned to the Capsule. Click on Infrastructure and then the edit button of the Capsule server.

Screenshot showing the Edit button for the Capsule server highlighted with a red box

Click on the Lifecycle Environments tab.

Screenshot with the Lifecycle Environments tab highlighted with a red box

Select the desired Lifecycle Environment and click on Submit.

Screenshot showing the blue Submit button

Click on Infrastructure and then the name of the Capsule server. Click on Synchronize and select Optimized Sync.

Screenshot showing Optimized Sync selected and highlighted with a red box

Host registration

Let’s register a new host. In my Satellite server, I associated the desired Content Views and Activation Keys with a Host group to streamline the registration process.

Screenshot showing the Satellite Host Group options

In the Register Host menu, I will select my host group and the new capsule server configured with remote execution pull mode.

Screenshot showing one Capsule server selected in a drop down menu

Clicking the Generate button generates the registration command.

Screenshot showing a dark blue Generate button and the curl command it created

SSH into your new host and run the registration command. Here’s the resulting output.

Screenshot of a large terminal window with three sections highlighted, showing Running registration, Installing packages, and Installing Insights client
  1. Shows the registration of the new host.
  2. Shows the REX Pull agent, yggdrasild being installed. 
  3. The insights client is installed (since I like having Red Hat Insights analyze my hosts for vulnerabilities and being able to remediate them with a button click).

Checking operation

REX pull mode is now configured. You can check that it is working by the following methods:

  1. Check the yggdrasild service is running with systemctl status yggdrasild.
Screenshot of a terminal window showing that the yggdrasild service is running
  1. Run netstat to check port 1883 is connected. 
Screenshot of a slice of a terminal window showing that port 1883 is connected

Let’s test it out by installing a package.

Screenshot of a Satellite window where a package has been installed

Conclusion

Remote execution pull mode provides a different method of transport for remote execution jobs run by Satellite. Customers unable to open port 22 between hosts and Satellite infrastructure servers can now use alternative ports (MQTT - 1883, HTTPS - 443). For more information, please see the official documentation below.

Official documentation


About the author

As a Senior Principal Technical Marketing Manager in the Red Hat Enterprise Linux business unit, Matthew Yee is here to help everyone understand what our products do. He joined Red Hat in 2021 and is based in Vancouver, Canada.

Read full bio
UI_Icon-Red_Hat-Close-A-Black-RGB

Browse by channel

automation icon

Automation

The latest on IT automation for tech, teams, and environments

AI icon

Artificial intelligence

Updates on the platforms that free customers to run AI workloads anywhere

open hybrid cloud icon

Open hybrid cloud

Explore how we build a more flexible future with hybrid cloud

security icon

Security

The latest on how we reduce risks across environments and technologies

edge icon

Edge computing

Updates on the platforms that simplify operations at the edge

Infrastructure icon

Infrastructure

The latest on the world’s leading enterprise Linux platform

application development icon

Applications

Inside our solutions to the toughest application challenges

Original series icon

Original shows

Entertaining stories from the makers and leaders in enterprise tech