Skip to content

Correct Foreman related services#1093

Open
ekohl wants to merge 1 commit intofirewalld:mainfrom
ekohl:correct-foreman-profile
Open

Correct Foreman related services#1093
ekohl wants to merge 1 commit intofirewalld:mainfrom
ekohl:correct-foreman-profile

Conversation

@ekohl
Copy link
Copy Markdown

@ekohl ekohl commented Mar 10, 2023

This a draft, since I'm not sure what should be the end state. Recently we investigated using the firewalld services and recommending it to users (theforeman/foreman-documentation#1943), but came to the conclusion that we shouldn't because they're wrong.

Foreman itself only runs on HTTP and HTTPS. It is the Foreman Proxy which can talk to additional services such as DNS, DHCP, TFTP and Puppet. However, all those services are optional. If anything, they should be included in the foreman-proxy service.

Architecturally speaking we have:

  • Foreman running on HTTP + HTTPS
  • Foreman Proxy running on port 8443 for our regular deployments, on port 9090 if it's a Katello installation (something we hope to unify some day)
  • On a Foreman Proxy service it is optional to deploy services such as DNS, DHCP, TFTP, Puppetserver and recently MQTT
  • On a Katello installation it's possible to deploy QPID (5646 + 5647 mentioned in the Satellite services), but deprecated
  • On a Foreman Proxy with content (RH Satellite terminology: Capsule) we run Pulp on HTTP + HTTPS

Now I struggle with opening optional ports by default: it leads to a less secure system.

Satellite also wants to drop the version number, so we can move to Satellite 7 at some point. This has been proposed multiple times, but so far there have been too many issues holding us back.

With this PR I hope to start the discussion on what should be the profile.

@erig0
Copy link
Copy Markdown
Collaborator

erig0 commented Mar 10, 2023

Hrm, the question is "will removing these ports break users?". The foreman team is best suited to answer that. Assuming the answer is "no" I suggest the following:

  • remove ports from foreman service, as you've already done
  • add a foreman-proxy service, includes ports 8443 and 9090
  • add a foreman-proxy-optional service, includes dns, dhcp, etc.

IF the answer is "yes", i.e. you want to retain the existing behavior of the foreman service, then you could use the include element in the XML to include services foreman-proxy and foreman-proxy-optional. Maybe you also add foreman-base and include that. Then the foreman service is just a list of includes.

As for versioning the services.. you could always keep the version number, e.g. satellite-6, but include it from an unversioned service satellite. Then in the future you could always change the include to point to say satellite-7. Changing the include could also be a trivial downstream change.

@ekohl
Copy link
Copy Markdown
Author

ekohl commented Mar 10, 2023

Hrm, the question is "will removing these ports break users?". The foreman team is best suited to answer that.

It depends on the user's setup.

add a foreman-proxy service, includes ports 8443 and 9090

There already is a foreman-proxy service, but it only has port 8443 now.

The user can also choose to enable plain text HTTP support, which runs on port 8000. Is there a precedent in firewalld for those "it depends" options?

add a foreman-proxy-optional service, includes dns, dhcp, etc.

So the tricky bit is that each component is opt-in by itself. So it's perfectly valid to run a Foreman Proxy with only DNS. It really depends on the setup. Even enabling the Foreman Proxy DNS module does not imply a DNS server runs on the same machine: it can talk to a remote DNS server using nsupdate or REST API, depending on the provider. More concrete: if you enable the route53 DNS provider then it talks to AWS Route53 and Amazon hosts the actual DNS zones.

As such I'm leaning to recommending users in the manual for specific scenarios to open the service explicitly.

@erig0
Copy link
Copy Markdown
Collaborator

erig0 commented Mar 10, 2023

Is there a precedent in firewalld for those "it depends" options?

I think a fair example is services that have TCP and UDP support. They can be split into foobar-tcp and foobar-udp. Then the foobar service includes both. This is because TCP is the norm, but sometimes UDP is also used.

As such I'm leaning to recommending users in the manual for specific scenarios to open the service explicitly.

Alternatively, you could suggest that users modify the foreman service instead of opening a port, e.g. --zone <zone> --add-port 9090/tcp.

# firewall-cmd --permanent --service foreman --add-port 9090/tcp`

Modifying the service has the downside that users won't get updates to the stock service shipped by firewalld. Once the service is modified it gets copied to /etc/firewalld/services and overrides the one in /usr/lib/firewalld/services.

@ekohl
Copy link
Copy Markdown
Author

ekohl commented Mar 10, 2023

Thanks for the input. I'll raise this in our next platform team meeting.

@ekohl ekohl force-pushed the correct-foreman-profile branch from 0baa50f to d6a929a Compare January 19, 2024 14:57
@ekohl ekohl marked this pull request as ready for review January 19, 2024 14:57
@ekohl ekohl force-pushed the correct-foreman-profile branch from d6a929a to a613647 Compare January 19, 2024 14:58
@ekohl
Copy link
Copy Markdown
Author

ekohl commented Jan 19, 2024

I've updated this to incorporate the feedback. See the commit message for all the details.

I don't know about backporting to older versions. We're hoping to soon start introduce support for EL9 and this could be a candidate. Then we'll leave EL8 as it is.

Copy link
Copy Markdown
Collaborator

@erig0 erig0 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A previous user of the foreman service may now need to enable foreman-proxy and foreman-proxy-optional. Usually we don't "break" users in this way.

Is this acceptable for foreman users? Foreman team is the best to answer that, IMO.

Comment thread config/services/foreman.xml
@ekohl
Copy link
Copy Markdown
Author

ekohl commented Jan 19, 2024

Is this acceptable for foreman users? Foreman team is the best to answer that, IMO.

Hard to say. In the documentation we have never pointed to firewalld. It was added in #645 by you.

The thing that got this whole ball rolling was that we were looking at using these definitions and realized they're not really correct.

I still struggle to think about the whole migration, because as long as we support EL8 (which I doubt will be updated) our instructions won't really be any easier.

@erig0
Copy link
Copy Markdown
Collaborator

erig0 commented Jan 19, 2024

Is this acceptable for foreman users? Foreman team is the best to answer that, IMO.

Hard to say. In the documentation we have never pointed to firewalld. It was added in #645 by you.

lol. That's embarrassing.

AFAICS, I added it trying to consolidate services as part of https://bugzilla.redhat.com/show_bug.cgi?id=1839781.

@jcpunk
Copy link
Copy Markdown
Contributor

jcpunk commented Jan 19, 2024

I think 68 came in along with the dhcp definitions.

@erig0
Copy link
Copy Markdown
Collaborator

erig0 commented Jan 24, 2024

The thing that got this whole ball rolling was that we were looking at using these definitions and realized they're not really correct.

In that case, lets fix them. I will merge.

erig0
erig0 previously approved these changes Jan 24, 2024
@ekohl
Copy link
Copy Markdown
Author

ekohl commented Jan 24, 2024

I'll discuss this in our team again and try to come up with a plan

@erig0
Copy link
Copy Markdown
Collaborator

erig0 commented Jan 24, 2024

I'll discuss this in our team again and try to come up with a plan

ACK. I'll wait on your response then.

Foreman itself only runs on HTTP and HTTPS. It is the Foreman Proxy
which can talk to additional services such as DNS, DHCP, TFTP and
Puppet. However, all those services are optional.

This changes the services to describe just foreman and foreman-proxy. A
new foreman-proxy-optional service is created to list all optional
services that can be integrated. The optional aspect doesn't include the
foreman-proxy service itself since the port can differ between vanilla
Foreman (8443) and Foreman with Katello (9090).

At the same time it rewrites new RH-Satellite-6 and
RH-Satellite-6-capsule.

For RH-Satellite-6 port 5000 hasn't been in use since the switch to Pulp
3 in Satellite 6.10 (when crane was integrated in Pulp itself). Port
8080 hasn't been in use since candlepin listens on localhost on port
8443 instead. The Smart Proxy doesn't listen on port 8000 anymore, since
the Foreman Proxy templates feature was disabled by default. The other
listed ports (5646, 5647, 5671) are for qpid which was needed for
katello-agent. That has become optional and dropped with Satellite 6.14.

The RH-Satellite-6-capsule no longer includes RH-Satellite-6 because the
relation isn't there. Instead it lists the services it runs explicitly.
@erig0 erig0 force-pushed the correct-foreman-profile branch from a613647 to 4801e13 Compare January 24, 2024 20:08
@ekohl
Copy link
Copy Markdown
Author

ekohl commented Jan 31, 2024

@ehelms and @evgeni I'd appreciate your thoughts on this.

@ehelms
Copy link
Copy Markdown

ehelms commented Feb 1, 2024

This is mostly my not understanding how it works. What does a user do if the policy includes a port that is no longer used by Satellite / Foreman, such as when we drop 8443?

@ekohl
Copy link
Copy Markdown
Author

ekohl commented Feb 2, 2024

That is the downside of incuding it in firewalld: we can't modify it easily. I'd argue that shipping it ourselves would be more flexible and allows us to keep it correcy for multiple versions

@ehelms
Copy link
Copy Markdown

ehelms commented Feb 2, 2024

I'd argue that shipping it ourselves would be more flexible and allows us to keep it correcy for multiple versions

I lean that way as well, given the set of ports can vary not only by Foreman / Satellite version, but also based upon the enabled feature set. If we had a policy in firewalld I think it would need to default the minimal setup based on the ports that we anticipate to be consistent.

@erig0
Copy link
Copy Markdown
Collaborator

erig0 commented Feb 12, 2024

ourselves would be more flexible and allows us to keep it correcy for multiple versions

That's cool. So what do we want to do with existing foreman/satellite/etc services that are included with firewalld?

@erig0
Copy link
Copy Markdown
Collaborator

erig0 commented Jun 3, 2024

ourselves would be more flexible and allows us to keep it correcy for multiple versions

That's cool. So what do we want to do with existing foreman/satellite/etc services that are included with firewalld?

bump

@ehelms
Copy link
Copy Markdown

ehelms commented Oct 14, 2024

I believe where we have landed is to remove Satellite/Foreman from being included in firewalld. @erig0 is that a change we should open a PR for?

@erig0
Copy link
Copy Markdown
Collaborator

erig0 commented Oct 15, 2024

I believe where we have landed is to remove Satellite/Foreman from being included in firewalld. @erig0 is that a change we should open a PR for?

Yeah. It's technically a breaking change.

As such, decide how to propagate that change to distros, e.g. RHEL, is the difficult part.

On the RPM side you can deal with it via Conflicts, etc. It just takes coordination.

@ehelms
Copy link
Copy Markdown

ehelms commented Oct 15, 2024

I think that's OK if we can't propagate this backwards -- it's had ups and downs where it was accurate and where it was not. I'm more keen on fixing this with a forward looking approach.

@erig0
Copy link
Copy Markdown
Collaborator

erig0 commented Oct 17, 2024

Then open a PR dropping them. I will merge it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants