Uyuni Proxy Deployment on Kubernetes

1. In the Web UI, navigate to Systems  Proxy Configuration and fill the required data:

2. In the Proxy FQDN field type fully qualified domain name for the proxy.

3. In the Parent FQDN field type fully qualified domain name for the Uyuni Server or another Uyuni Proxy.

4. In the Proxy SSH port field type SSH port on which SSH service is listening on Uyuni Proxy. Recommended is to keep default 8022.

5. In the Max Squid cache size [MB] field type maximal allowed size for Squid cache. Recommended is to use at most 80% of available storage for the containers.

   2 GB represents the default proxy squid cache size. This will need to be adjusted for your environment.

6. In the SSL certificate selection list choose if a new server certificate should be generated for Uyuni Proxy, an existing one should be used, or the SSL part should be skipped entirely. You can consider generated certificates as Uyuni builtin (self signed) certificates. If Uyuni server runs on Kubernetes, the generated certificate option is not possible and replaced with no SSL certificate as they are managed outside the containers.

   Depending on the choice then provide either path to signing CA certificate to generate a new certificate or path to an existing certificate and its key to be used as proxy certificate. If the SSL part is skipped, the resulting configuration archive does not carry server_crt, server_key or ca_crt; the deployment is then responsible for providing the proxy certificate and root CA out-of-band (for Kubernetes deployments this means creating proxy-cert and uyuni-ca manually — see the TLS setup section of the Kubernetes proxy deployment page).

   The CA certificates generated by the server are stored in the /var/lib/containers/storage/volumes/root/_data/ssl-build directory.

   For more information about existing or custom certificates and the concept of corporate and intermediate certificates, see Import SSL Certificates.

7. Click Generate to register a new proxy FQDN in the Uyuni Server and generate a configuration archive (config.tar.gz) containing details for the container host.

8. After a few moments you are presented with file to download. Save this file locally.

1. SSH into your container host.

2. Execute the following command replacing the Server and Proxy FQDN:

   mgrctl exec -ti 'spacecmd proxy_container_config_generate_cert -- dev-pxy.example.com dev-srv.example.com 2048 email@example.com -o /tmp/config.tar.gz'

3. Copy the generated configuration from the server container:

   mgrctl cp server:/tmp/config.tar.gz .

1. SSH into your Server container host.

2. Execute the following commands, replacing the Server and Proxy FQDN:

   for f in ca.crt proxy.crt proxy.key; do
     mgrctl cp $f server:/tmp/$f
   done
   mgrctl exec -ti 'spacecmd proxy_container_config -- -p 8022 pxy.example.com srv.example.com 2048 email@example.com /tmp/ca.crt /tmp/proxy.crt /tmp/proxy.key -o /tmp/config.tar.gz'

3. If your setup uses an intermediate CA, copy it as well and include it in the command with the -i option (can be provided multiple times if needed) :

   mgrctl cp intermediateCA.pem server:/tmp/intermediateCA.pem
   mgrctl exec -ti 'spacecmd proxy_container_config -- -p 8022 -i /tmp/intermediateCA.pem pxy.example.com srv.example.com 2048 email@example.com /tmp/ca.crt /tmp/proxy.crt /tmp/proxy.key -o /tmp/config.tar.gz'

4. Copy the generated configuration from the server container:

   mgrctl cp server:/tmp/config.tar.gz .

1. SSH into your Server container host.

2. Execute the following commands, replacing the Server and Proxy FQDN:

   for f in ca.crt proxy.crt proxy.key; do
     mgrctl cp $f server:/tmp/$f
   done
   mgrctl exec -ti 'spacecmd proxy_container_config_nossl -- -p 8022 pxy.example.com srv.example.com 2048 email@example.com -o /tmp/config.tar.gz'

3. Copy the generated configuration from the server container:

   mgrctl cp server:/tmp/config.tar.gz .