Plugins » Katello

Katello 1.13
Foreman 1.23
fqdn : puppet.myexample.example.eu.myorg.cloud

/etc/foreman-installer/scenarios.d/katello-answers.yaml (cert section) :
certs:
params:
node_fqdn: "%{::fqdn}"
cname: ['puppet.myexample.myorgdce.net']
regenerate: false
regenerate_ca: false
generate: true
deploy: true
ca_common_name: "%{::fqdn}"
country: "FR"
state: "confusion"
city: "Puteaux"
org: "MYORG"
org_unit: "BDS"
expiration: "36500"
ca_expiration: "36500"
user: "root"
group: "foreman"

Foreman installer command:
/usr/sbin/foreman-installer -v \
--scenario katello \
--enable-foreman-compute-ec2 \
--foreman-initial-admin-password=$foreman_password \
--enable-foreman-plugin-ansible \
--enable-foreman-plugin-monitoring \
--enable-foreman-plugin-templates \
--enable-foreman-plugin-remote-execution \
--enable-foreman-plugin-openscap \
--foreman-proxy-dhcp=false \
--foreman-proxy-dns=false \
--foreman-initial-organization=$foreman_default_organization \
--foreman-cors-domains=https://puppet.myexample.myorgdce.net

I'm trying to expose only the WEB UI (port 443) to the internet. For this, i set up, on AWS, an ALB with it's own valid certificate (*.myexample.myorgdce.net).
The LB forwards puppet.myexample.myorgdce.net HTTPS requests to my foreman/katello instance (puppet.myexample.example.eu.myorg.cloud) on port 443.

************************************************************************************
The Foreman Web UI displays everything well (puppet hosts and reports...), EXCEPT when i try to hit anything related to Katello:

If i access directly the node, on port 443 , ALL is good.

[root@puppet ~]# curl -vv https://$(hostname)/katello/api -u admin:$foreman_password

• About to connect() to puppet.myexample.myorgdce.eu.MyOrg.cloud port 443 (#0)
• Trying 10.250.43.115...
• Connected to puppet.myexample.myorgdce.eu.MyOrg.cloud (10.250.43.115) port 443 (#0)
• Initializing NSS with certpath: sql:/etc/pki/nssdb
• CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
• NSS: client certificate not found (nickname not specified)
• SSL connection using TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
• Server certificate:
• subject: CN=puppet.myexample.myorgdce.eu.MyOrg.cloud,OU=BDS,O=MyOrg,ST=confusion,C=FR
• start date: Oct 07 09:37:37 2019 GMT
• expire date: Jan 18 09:37:37 2038 GMT
• common name: puppet.myexample.myorgdce.eu.MyOrg.cloud
• issuer: CN=puppet.myexample.myorgdce.eu.MyOrg.cloud,OU=BDS,O=MyOrg,L=Puteaux,ST=confusion,C=FR
• Server auth using Basic with user 'admin'

GET /katello/api HTTP/1.1
Authorization: Basic YWRtaW46Y2hhbmdlbWU=
User-Agent: curl/7.29.0
Host: puppet.myexample.myorgdce.eu.MyOrg.cloud
Accept: */*

• NSS: client certificate not found (nickname not specified)
  < HTTP/1.1 200 OK
  < Date: Mon, 14 Oct 2019 11:14:56 GMT
  < Server: Apache
  < Foreman_version: 1.23.0
  < Foreman_api_version: 2
  < Foreman_current_organization: ; ANY
  < Foreman_current_location: ; ANY
  < Cache-Control: max-age=0, private, must-revalidate
  < X-Request-Id: 65925d80-e9d2-42eb-b55b-29e8cebf2465
  < X-Runtime: 0.026091
  < Vary: Origin,Accept-Encoding
  < Strict-Transport-Security: max-age=631139040; includeSubdomains
  < X-Frame-Options: sameorigin
  < X-Content-Type-Options: nosniff
  < X-XSS-Protection: 1; mode=block
  < X-Download-Options: noopen
  < X-Permitted-Cross-Domain-Policies: none
  < Content-Security-Policy: default-src 'self'; child-src 'self'; connect-src 'self' ws: wss:; img-src 'self' data: *.gravatar.com; script-src 'unsafe-eval' 'unsafe-inline' 'self'; style-src 'unsafe-inline' 'self'
  < X-Powered-By: Phusion Passenger 4.0.53
  < Set-Cookie: _session_id=6d802c02667a07f38de6b19bec7c3cfe; path=/; secure; HttpOnly; SameSite=Lax
  < ETag: W/"664bb5e71fe763682396198fa4a26885"
  < Status: 200 OK
  < Transfer-Encoding: chunked
  < Content-Type: application/json; charset=utf-8
  <
  [{"href":"/katello/api/capsules/","rel":"capsules"},{"href":"/katello/api/activation_keys/","rel":"activation_keys"},{"href":"/katello/api/activation_keys/","rel":"activation_keys"},{"href":"/katello/api/activation_keys/","rel":"activation_keys"},{"href":"/katello/api/activation_keys/","rel":"activation_keys"},[...]{"href":"/katello/api/sync_plans/","rel":"sync_plans"}]

*************************************************************************************
When i try to access through the LB : the request times out. Performing a foreman-tail suggests that foreman is never reached by the request.
Same goes with synch_plans, views, (anything in the content tab) : page is displayed empty. And trying to create an item through the web ui results in a time out, with item not created.

[root@puppet ~]# curl -vv https://puppet.myorgdce.MyOrgdce.net/katello/api -u admin:$foreman_password

• About to connect() to puppet.myorgdce.MyOrgdce.net port 443 (#0)
• Trying 54.71.4.241...
• Connected to puppet.myorgdce.MyOrgdce.net (54.71.4.241) port 443 (#0)
• Initializing NSS with certpath: sql:/etc/pki/nssdb
• CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
• SSL connection using TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
• Server certificate:
• subject: CN=*.myorgdce.MyOrgdce.net
• start date: Oct 14 00:00:00 2019 GMT
• expire date: Nov 14 12:00:00 2020 GMT
• common name: *.myorgdce.MyOrgdce.net
• issuer: CN=Amazon,OU=Server CA 1B,O=Amazon,C=US
• Server auth using Basic with user 'admin'

GET /katello/api HTTP/1.1
Authorization: Basic YWRtaW46Y2hhbmdlbWU=
User-Agent: curl/7.29.0
Host: puppet.myorgdce.MyOrgdce.net
Accept: */*

• Connection state changed (MAX_CONCURRENT_STREAMS == 128)!
  < HTTP/2 504
  < server: awselb/2.0
  < date: Mon, 14 Oct 2019 11:21:20 GMT
  < content-type: text/html
  < content-length: 148
  <
  <html>
  <head><title>504 Gateway Time-out</title></head>
  <body bgcolor="white">
  <center><h1>504 Gateway Time-out</h1></center>
  </body>
  </html>

*************************************************************************
Installed :
Installed Packages
candlepin-2.7.7-1.el7.noarch
candlepin-selinux-2.7.7-1.el7.noarch
foreman-1.23.0-1.el7.noarch
foreman-cli-1.23.0-1.el7.noarch
foreman-debug-1.23.0-1.el7.noarch
foreman-ec2-1.23.0-1.el7.noarch
foreman-installer-1.23.0-1.el7.noarch
foreman-installer-katello-1.23.0-1.el7.noarch
foreman-postgresql-1.23.0-1.el7.noarch
foreman-proxy-1.23.0-1.el7.noarch
foreman-release-1.23.0-1.el7.noarch
foreman-release-scl-7-2.el7.noarch
foreman-selinux-1.23.0-1.el7.noarch
katello-3.13.0-1.el7.noarch
katello-certs-tools-2.5.3-1.el7.noarch
katello-client-bootstrap-1.7.2-2.el7.noarch
katello-common-3.13.0-1.el7.noarch
katello-debug-3.13.0-1.el7.noarch
katello-default-ca-1.0-1.noarch
katello-repos-3.13.0-1.el7.noarch
katello-selinux-3.1.1-1.el7.noarch
katello-server-ca-1.0-1.noarch
katello-service-3.13.0-1.el7.noarch
pulp-client-1.0-1.noarch
pulp-deb-plugins-1.10.0-1.el7.noarch
pulp-docker-plugins-3.2.4-1.el7.noarch
pulp-katello-1.0.3-1.el7.noarch
pulp-puppet-plugins-2.20.1-2.el7.noarch
pulp-puppet-tools-2.20.1-2.el7.noarch
pulp-rpm-plugins-2.20.1-2.el7.noarch
pulp-selinux-2.20.1-2.el7.noarch
pulp-server-2.20.1-2.el7.noarch
puppet.prd.mgmtvpc.eu.axway.cloud-foreman-client-1.0-1.noarch
puppet.prd.mgmtvpc.eu.axway.cloud-foreman-proxy-1.0-1.noarch
puppet.prd.mgmtvpc.eu.axway.cloud-foreman-proxy-client-1.0-1.noarch
puppet.prd.mgmtvpc.eu.axway.cloud-qpid-broker-1.0-1.noarch
puppet.prd.mgmtvpc.eu.axway.cloud-qpid-client-cert-1.0-1.noarch
puppet.prd.mgmtvpc.eu.axway.cloud-qpid-router-client-1.0-1.noarch
puppet.prd.mgmtvpc.eu.axway.cloud-qpid-router-server-1.0-1.noarch
python-gofer-qpid-2.12.5-3.el7.noarch
python-pulp-common-2.20.1-2.el7.noarch
python-pulp-deb-common-1.10.0-1.el7.noarch
python-pulp-docker-common-3.2.4-1.el7.noarch
python-pulp-oid_validation-2.20.1-2.el7.noarch
python-pulp-puppet-common-2.20.1-2.el7.noarch
python-pulp-repoauth-2.20.1-2.el7.noarch
python-pulp-rpm-common-2.20.1-2.el7.noarch
python-pulp-streamer-2.20.1-2.el7.noarch
python2-qpid-1.37.0-4.el7.noarch
python2-qpid-proton-0.28.0-1.el7.x86_64
python2-qpid-qmf-1.39.0-1.el7.x86_64
qpid-cpp-client-1.39.0-1.el7.x86_64
qpid-cpp-client-devel-1.39.0-1.el7.x86_64
qpid-cpp-server-1.39.0-1.el7.x86_64
qpid-cpp-server-linearstore-1.39.0-1.el7.x86_64
qpid-dispatch-router-1.8.0-1.el7.x86_64
qpid-proton-c-0.28.0-1.el7.x86_64
qpid-qmf-1.39.0-1.el7.x86_64
qpid-tools-1.39.0-1.el7.noarch
rubygem-foreman_maintain-0.4.5-1.el7.noarch
rubygem-smart_proxy_pulp-1.4.1-1.el7.noarch
tfm-ror52-rubygem-actioncable-5.2.1-1.el7.noarch
tfm-ror52-rubygem-actionmailer-5.2.1-1.el7.noarch
tfm-ror52-rubygem-actionpack-5.2.1-1.el7.noarch
tfm-ror52-rubygem-actionview-5.2.1-1.el7.noarch
tfm-ror52-rubygem-activejob-5.2.1-1.el7.noarch
tfm-ror52-rubygem-activemodel-5.2.1-1.el7.noarch
tfm-ror52-rubygem-activerecord-5.2.1-1.el7.noarch
tfm-ror52-rubygem-activestorage-5.2.1-1.el7.noarch
tfm-ror52-rubygem-activesupport-5.2.1-1.el7.noarch
tfm-ror52-rubygem-arel-9.0.0-1.el7.noarch
tfm-ror52-rubygem-builder-3.2.3-1.el7.noarch
tfm-ror52-rubygem-coffee-rails-4.2.2-1.el7.noarch
tfm-ror52-rubygem-coffee-script-2.4.1-1.el7.noarch
tfm-ror52-rubygem-coffee-script-source-1.12.2-1.el7.noarch
tfm-ror52-rubygem-concurrent-ruby-1.1.4-1.el7.noarch
tfm-ror52-rubygem-crass-1.0.4-1.el7.noarch
tfm-ror52-rubygem-erubi-1.7.1-1.el7.noarch
tfm-ror52-rubygem-execjs-2.7.0-1.el7.noarch
tfm-ror52-rubygem-globalid-0.4.1-3.el7.noarch
tfm-ror52-rubygem-i18n-1.4.0-1.el7.noarch
tfm-ror52-rubygem-loofah-2.2.2-2.el7.noarch
tfm-ror52-rubygem-mail-2.7.0-1.el7.noarch
tfm-ror52-rubygem-marcel-0.3.2-1.el7.noarch
tfm-ror52-rubygem-method_source-0.9.0-1.el7.noarch
tfm-ror52-rubygem-mime-types-3.2.2-1.el7.noarch
tfm-ror52-rubygem-mime-types-data-3.2018.0812-1.el7.noarch
tfm-ror52-rubygem-mimemagic-0.3.2-1.el7.noarch
tfm-ror52-rubygem-mini_mime-1.0.0-1.el7.noarch
tfm-ror52-rubygem-mini_portile2-2.3.0-1.el7.noarch
tfm-ror52-rubygem-multi_json-1.13.1-1.el7.noarch
tfm-ror52-rubygem-mustermann-1.0.2-1.el7.noarch
tfm-ror52-rubygem-nio4r-2.3.1-1.el7.x86_64
tfm-ror52-rubygem-nokogiri-1.8.4-2.el7.x86_64
tfm-ror52-rubygem-rack-2.0.6-1.el7.noarch
tfm-ror52-rubygem-rack-protection-2.0.3-1.el7.noarch
tfm-ror52-rubygem-rack-test-1.1.0-1.el7.noarch
tfm-ror52-rubygem-rails-5.2.1-1.el7.noarch
tfm-ror52-rubygem-rails-dom-testing-2.0.3-3.el7.noarch
tfm-ror52-rubygem-rails-html-sanitizer-1.0.4-2.el7.noarch
tfm-ror52-rubygem-railties-5.2.1-1.el7.noarch
tfm-ror52-rubygem-sinatra-2.0.3-1.el7.noarch
tfm-ror52-rubygem-sprockets-3.7.2-3.el7.noarch
tfm-ror52-rubygem-sprockets-rails-3.2.1-1.el7.noarch
tfm-ror52-rubygem-thor-0.20.0-3.el7.noarch
tfm-ror52-rubygem-thread_safe-0.3.6-1.el7.noarch
tfm-ror52-rubygem-tilt-2.0.8-1.el7.noarch
tfm-ror52-rubygem-turbolinks-2.5.4-1.el7.noarch
tfm-ror52-rubygem-tzinfo-1.2.5-1.el7.noarch
tfm-ror52-rubygem-websocket-driver-0.7.0-1.el7.x86_64
tfm-ror52-rubygem-websocket-extensions-0.1.3-1.el7.noarch
tfm-ror52-runtime-1.0-4.el7.x86_64
tfm-rubygem-activerecord-import-1.0.0-1.el7.noarch
tfm-rubygem-activerecord-session_store-1.1.1-2.el7.noarch
tfm-rubygem-addressable-2.6.0-1.el7.noarch
tfm-rubygem-algebrick-0.7.3-6.el7.noarch
tfm-rubygem-ancestry-3.0.0-3.el7.noarch
tfm-rubygem-anemone-0.7.2-16.el7.noarch
tfm-rubygem-angular-rails-templates-1.0.2-4.el7.noarch
tfm-rubygem-apipie-bindings-0.2.2-2.el7.noarch
tfm-rubygem-apipie-params-0.0.5-3.el7.noarch
tfm-rubygem-apipie-rails-0.5.14-1.el7.noarch
tfm-rubygem-audited-4.7.1-2.el7.noarch
tfm-rubygem-awesome_print-1.8.0-3.el7.noarch
tfm-rubygem-bcrypt-3.1.12-1.el7.x86_64
tfm-rubygem-bundler_ext-0.4.1-3.el7.noarch
tfm-rubygem-clamp-1.1.2-4.el7.noarch
tfm-rubygem-concurrent-ruby-edge-0.4.1-1.fm1_23.el7.noarch
tfm-rubygem-css_parser-1.4.7-3.el7.noarch
tfm-rubygem-daemons-1.2.3-5.el7.noarch
tfm-rubygem-deacon-1.0.0-3.el7.noarch
tfm-rubygem-deep_cloneable-2.3.2-2.el7.noarch
tfm-rubygem-deface-1.3.2-1.el7.noarch
tfm-rubygem-diffy-3.0.1-5.el7.noarch
tfm-rubygem-domain_name-0.5.20160310-3.el7.noarch
tfm-rubygem-dynflow-1.2.3-1.fm1_23.el7.noarch
tfm-rubygem-ethon-0.12.0-1.el7.noarch
tfm-rubygem-excon-0.58.0-3.el7.noarch
tfm-rubygem-facter-2.4.0-6.el7.x86_64
tfm-rubygem-fast_gettext-1.4.1-3.el7.noarch
tfm-rubygem-ffi-1.4.0-8.el7.x86_64
tfm-rubygem-fog-aws-3.5.0-1.el7.noarch
tfm-rubygem-fog-core-2.1.0-1.el7.noarch
tfm-rubygem-fog-json-1.2.0-1.el7.noarch
tfm-rubygem-fog-xml-0.1.2-6.el7.noarch
tfm-rubygem-foreman-tasks-0.16.2-1.fm1_23.el7.noarch
tfm-rubygem-foreman-tasks-core-0.3.2-1.fm1_23.el7.noarch
tfm-rubygem-foreman_ansible-3.0.5-1.fm1_23.el7.noarch
tfm-rubygem-foreman_monitoring-1.0.1-3.fm1_23.el7.noarch
tfm-rubygem-foreman_openscap-1.0.4-1.fm1_23.el7.noarch
tfm-rubygem-foreman_remote_execution-1.8.2-1.fm1_23.el7.noarch
tfm-rubygem-foreman_remote_execution_core-1.2.0-1.el7.noarch
tfm-rubygem-foreman_templates-6.0.3-2.fm1_23.el7.noarch
tfm-rubygem-formatador-0.2.1-11.el7.noarch
tfm-rubygem-friendly_id-5.2.4-2.el7.noarch
tfm-rubygem-get_process_mem-0.2.1-3.el7.noarch
tfm-rubygem-gettext_i18n_rails-1.8.0-1.el7.noarch
tfm-rubygem-git-1.5.0-1.el7.noarch
tfm-rubygem-graphql-1.8.14-1.el7.noarch
tfm-rubygem-graphql-batch-0.3.10-1.el7.noarch
tfm-rubygem-hammer_cli-0.18.0-1.el7.noarch
tfm-rubygem-hammer_cli_foreman-0.18.0-1.el7.noarch
tfm-rubygem-hammer_cli_foreman_bootdisk-0.3.0-1.el7.noarch
tfm-rubygem-hammer_cli_foreman_docker-0.0.4-4.el7.noarch
tfm-rubygem-hammer_cli_foreman_tasks-0.0.13-1.fm1_23.el7.noarch
tfm-rubygem-hammer_cli_katello-0.19.1-1.el7.noarch
tfm-rubygem-hashie-3.6.0-1.el7.noarch
tfm-rubygem-highline-1.7.8-4.el7.noarch
tfm-rubygem-http-cookie-1.0.2-3.el7.noarch
tfm-rubygem-ipaddress-0.8.0-11.el7.noarch
tfm-rubygem-jwt-2.1.0-1.el7.noarch
tfm-rubygem-katello-3.13.0-1.el7.noarch
tfm-rubygem-ldap_fluff-0.4.7-3.el7.noarch
tfm-rubygem-little-plugger-1.1.4-1.el7.noarch
tfm-rubygem-locale-2.0.9-13.el7.noarch
tfm-rubygem-logging-2.2.2-3.el7.noarch
tfm-rubygem-net-ldap-0.16.1-1.el7.noarch
tfm-rubygem-net-ping-2.0.1-3.el7.noarch
tfm-rubygem-net-scp-1.2.1-3.el7.noarch
tfm-rubygem-net-ssh-4.2.0-1.el7.noarch
tfm-rubygem-netrc-0.11.0-4.el7.noarch
tfm-rubygem-oauth-0.5.4-3.el7.noarch
tfm-rubygem-parse-cron-0.1.4-4.fm1_23.el7.noarch
tfm-rubygem-passenger-4.0.18-10.12.el7.x86_64
tfm-rubygem-passenger-native-4.0.18-10.12.el7.x86_64
tfm-rubygem-passenger-native-libs-4.0.18-10.12.el7.x86_64
tfm-rubygem-pg-0.21.0-3.el7.x86_64
tfm-rubygem-polyglot-0.3.5-2.el7.noarch
tfm-rubygem-powerbar-2.0.1-1.el7.noarch
tfm-rubygem-promise.rb-0.7.4-1.el7.noarch
tfm-rubygem-public_suffix-3.0.3-1.el7.noarch
tfm-rubygem-pulp_ansible_client-0.2.0b1.dev0.1560866833-1.el7.noarch
tfm-rubygem-pulp_docker_client-4.0.0b6.dev01562331743-1.el7.noarch
tfm-rubygem-pulp_file_client-0.0.1b10.dev.1557779852-1.el7.noarch
tfm-rubygem-pulpcore_client-3.0.0rc2.dev.1557772471-1.el7.noarch
tfm-rubygem-qpid_messaging-1.38.0-1.el7.x86_64
tfm-rubygem-rabl-0.13.1-2.el7.noarch
tfm-rubygem-rack-cors-1.0.2-1.el7.noarch
tfm-rubygem-rack-jsonp-1.3.1-7.el7.noarch
tfm-rubygem-rails-i18n-5.1.1-2.el7.noarch
tfm-rubygem-rainbow-2.2.1-3.el7.noarch
tfm-rubygem-record_tag_helper-1.0.0-2.el7.noarch
tfm-rubygem-responders-2.4.0-2.el7.noarch
tfm-rubygem-rest-client-2.0.2-1.el7.noarch
tfm-rubygem-roadie-3.4.0-1.el7.noarch
tfm-rubygem-roadie-rails-2.0.0-1.el7.noarch
tfm-rubygem-robotex-1.0.0-21.el7.noarch
tfm-rubygem-ruby2ruby-2.4.2-1.el7.noarch
tfm-rubygem-ruby_parser-3.10.1-2.el7.noarch
tfm-rubygem-runcible-2.11.1-1.el7.noarch
tfm-rubygem-safemode-1.3.5-2.el7.noarch
tfm-rubygem-scoped_search-4.1.7-1.el7.noarch
tfm-rubygem-secure_headers-6.0.0-1.el7.noarch
tfm-rubygem-sequel-5.7.1-2.el7.noarch
tfm-rubygem-sexp_processor-4.10.0-5.el7.noarch
tfm-rubygem-sshkey-1.9.0-3.el7.noarch
tfm-rubygem-statsd-instrument-2.1.4-2.el7.noarch
tfm-rubygem-typhoeus-1.3.1-1.el7.noarch
tfm-rubygem-unf-0.1.3-7.el7.noarch
tfm-rubygem-unf_ext-0.0.6-8.el7.x86_64
tfm-rubygem-unicode-0.4.4.1-5.el7.x86_64
tfm-rubygem-unicode-display_width-1.0.5-3.el7.noarch
tfm-rubygem-validates_lengths_from_database-0.5.0-5.el7.noarch
tfm-rubygem-webpack-rails-0.9.8-3.el7.noarch
tfm-rubygem-will_paginate-3.1.7-1.el7.noarch
tfm-rubygem-x-editable-rails-1.5.5-3.el7.noarch
tfm-runtime-5.0-6.el7.x86_64

Backend System Status : Stays empty when hit through the LB, but hammer ping on the host is OK
root@puppet ~]# hammer ping
candlepin:
Status: ok
Server Response: Duration: 34ms
candlepin_auth:
Status: ok
Server Response: Duration: 13ms
pulp:
Status: ok
Server Response: Duration: 33ms
pulp_auth:
Status: ok
Server Response: Duration: 27ms
foreman_tasks:
Status: ok
Server Response: Duration: 3ms

What would be the points i need to check in order to cover my bases?
Any prerequisites i need to check to have katello work behind a Loadbalancer?