Registering Red Hat Enterprise Linux clients with RHUI

Table of Contents

1. Import entitlements and certificates
2. Connecting to Red Hat update infrastructure
3. Add software channels
4. Prepare custom channels
5. Check synchronization status
6. Manage GPG keys
7. Register clients

This section contains information about using Red Hat update infrastructure (RHUI) to register clients running Red Hat Enterprise Linux operating systems.

If you are running clients in a public cloud, such as Amazon EC2, use this method.

It is possible to use RHUI in conjunction with the Red Hat content delivery network (CDN) to manage your Red Hat Enterprise Linux subscriptions. For information about using Red Hat CDN, see Registering Red Hat Enterprise Linux Clients with CDN.

You are responsible for connecting Uyuni Server to the Red Hat update infrastructure. All clients that get updates using this RHUI certificate need to be correctly licensed, please check with your cloud provider and the Red Hat terms of service for more information.

When Red Hat Enterprise Linux clients registered with RHUI are switched off, Red Hat might declare the certificate invalid. In this case, you need to turn the client on again, or get a new RHUI certificate.

1. Import entitlements and certificates

In the past it was required to import the certificates and entitlement data manual into Uyuni Server. This task has been automated by using the same mechanism as for SUSE PAYG instances. Fir more information, see Connect PAYG Instance.

This guide covers clients registered to Red Hat update infrastructure (RHUI). You must have at least one system registered to RHUI, with an authorized subscription for repository content.

For information about using Red Hat content delivery network (CDN) instead, see Registering Red Hat Enterprise Linux Clients with CDN.

Satellite certificates for client systems require a Satellite server and subscription. Clients using Satellite certificates are not supported with Uyuni Server.

The PAYG connection regular checks with the client to get the latest authentication data. It is important that the client stays running and is regular updated. If this does not happen, repository synchronization will fail with authentication errors at some point in time.

Update any Red Hat 7 instance before connecting it.

A Red Hat 9 instance needs to be configured with the crypto policy LEGACY to be able to connect it. Execute sudo update-crypto-policies --set LEGACY to configure it accordingly.

2. Connecting to Red Hat update infrastructure

Procedure: Connecting new Red Hat instance

In the Uyuni Web UI, navigate to Admin Setup Wizard PAYG, and click Add PAYG.
Start with the page section PAYG connection Description.
In the Description field, add the description.
Move to the page section Instance SSH connection data.
In the Host field, enter the instance DNS or IP address to connect from Uyuni.
In the SSH Port field, enter the port number or use default value 22.
In the User field, enter the username as specified in the cloud.
In the Password field, enter the password.
In the SSH Private Key field, enter the instance key.
In the SSH Private Key Passphrase field, enter the key passphrase.

Authentication keys must always be in PEM format.

If you are not connecting directly to the instance, but via SSH bastion, proceed with Procedure: Adding SSH bastion connection data.

Otherwise, continue with Procedure: Finishing Red Hat connecting.

Procedure: Adding SSH bastion connection data

Navigate to the page section Bastion SSH connection data.
In the Host field, enter the bastion hostname.
In the SSH Port field, enter the bastion port number.
In the User field, enter the bastion username.
In the Password field, enter the bastion password.
In the SSH Private Key field, enter the bastion key.
In the SSH Private Key Passphrase field, enter the bastion key passphrase.

Complete the setup with Procedure: Finishing Red Hat connecting.

Procedure: Finishing Red Hat connecting

To complete adding new Red Hat connection data, click Create.
Return to PAYG connection data Details page. The updated connection status is displayed on the top section named Information.
Connection status is shown in Admin > Setup Wizard > Pay-as-you-go screen, too.
If the authentication data for the instance is correct, the column Status shows Credentials successfully updated.

If invalid data is entered at any point, the newly created instance is shown in Admin > Setup Wizard > PAYG, with column Status displaying an error message.

As soon as the authentication data is available on the server, repositories were added for all available repositories on the connected instance. The repositories can be seen in Software > Manage > Repositories

A Red Hat connection will create custom repositories which are owned by organization 1 by default. If a different organization should own the autogenerated repositories, configure java.rhui_default_org_id in /etc/rhn/rhn.conf.

This only defines and updates the repositories. If you want to use a repository for a managed client, you need to specify a Software Channel and connect the repositories to it.

3. Add software channels

Before you register Red Hat clients to your Uyuni Server, you need to add the required software channels, and synchronize them.

In the following section, descriptions often default to the x86_64 architecture. Replace it with other architectures if appropriate.

The channels you need for this procedure are:

Table 1. Red Hat Channels - CLI
OS Version	Base Channel	Client Channel	Tools Channel
Red Hat 7	rhel7-pool-uyuni	-	rhel7-uyuni-client
Red Hat 8	rhel8-pool-uyuni	-	rhel8-uyuni-client
Red Hat 9	rhel9-pool-uyuni	-	rhel9-uyuni-client

Procedure: Adding Software Channels at the Command Prompt

At the command prompt on the Uyuni Server, as root, use the spacewalk-common-channels command to add the appropriate channels. Ensure you specify the correct architecture:
```
spacewalk-common-channels \
-a <architecture> \
<base_channel_name> \
<child_channel_name_1> \
<child_channel_name_2> \
... <child_channel_name_n>
```
If automatic synchronization is turned off, synchronize the channels:
```
spacewalk-repo-sync -p <base_channel_label>-<architecture>
```
Ensure the synchronization is complete before continuing.

The client tools channel provided by spacewalk-common-channels is sourced from Uyuni and not from SUSE.

The AppStream repository provides modular packages. This results in the Uyuni Web UI showing incorrect package information. You cannot perform package operations such as installing or upgrading directly from modular repositories using the Web UI or API.

Alternatively, you can use Salt states to manage modular packages, or use the dnf command on the client. For more information about CLM, see Content Lifecycle Management.

4. Prepare custom channels

To mirror the software from RHUI, you need to create custom channels in Uyuni that are linked to autogenerated repositories.

The channels you need for this procedure are:

Table 2. Red Hat Custom Channels
OS Version	Base Channel
Red Hat 7	rhel7-pool-uyuni
Red Hat 8	rhel8-pool-uyuni
Red Hat 9	rhel9-pool-uyuni

Procedure: Creating Custom Channels

On the Uyuni Server Web UI, navigate to Software Manage Channels.
Click Create Channel and set the appropriate parameters for the channels.
In the Parent Channel field, select the appropriate base channel.
Click Create Channel.
Repeat for all channels you need to create. There should be one custom channel for each custom repository.

You can check that you have created all the appropriate channels and repositories, by navigating to Software Channel List All.

For Red Hat 8 clients, add both the Base and AppStream channels. You require packages from both channels. If you do not add both channels, you cannot create the bootstrap repository, due to missing packages.

When you have created all the channels, you can associate them with the repositories you created:

Procedure: Associating Channels with Repositories

On the Uyuni Server Web UI, navigate to Software Manage Channels, and click the channel to associate.
Navigate to the Repositories tab, and check the repository to associate with this channel.
Click Update Repositories to associate the channel and the repository.
Repeat for all channels and repositories you need to associate.
OPTIONAL: Navigate to the Sync tab to set a recurring schedule for synchronization of this repository.
Click Sync Now to begin synchronization immediately.

5. Check synchronization status

Procedure: Checking Synchronization Progress from the Web UI

In the Uyuni Web UI, navigate to Software Manage Channels, then click the channel associated to the repository.
Navigate to the Repositories tab, then click Sync and check Sync Status.

Procedure: Checking Synchronization Progress from the Command Prompt

At the command prompt on the Uyuni Server, as root, use the tail command to check the synchronization log file:
```
tail -f /var/log/rhn/reposync/<channel-label>.log
```
Each child channel generates its own log during the synchronization progress. You need to check all the base and child channel log files to be sure that the synchronization is complete.

Red Hat Enterprise Linux channels can be very large. Synchronization can sometimes take several hours.

6. Manage GPG keys

Clients use GPG keys to check the authenticity of software packages before they are installed. Only trusted software can be installed on clients.

Trusting a GPG key is important for security on clients. It is the task of the administrator to decide which keys are needed and can be trusted. Because a software channel cannot be used when the GPG key is not trusted, the decision of assigning a channel to a client depends on the decision of trusting the key.

For more information about GPG keys, see GPG Keys.

7. Register clients

To register your clients, you need a bootstrap repository. By default, bootstrap repositories are automatically created, and regenerated daily for all synchronized products. You can manually create the bootstrap repository from the command prompt, using this command:

mgr-create-bootstrap-repo

For more information on registering your clients, see Client Registration.