Smart Proxy - Omaha

This plug-in adds support for the Omaha Procotol to Foreman's Smart Proxy. It is used when updating CoreOS clusters. The Smart Proxy Omaha plugin acts as a mirror for Omaha releases and sends reports to Foreman about the update activity of the managed hosts. It needs the Foreman Omaha plugin installed to work properly.

The operatingsystem packages install a cronjob, that runs the binary smart-proxy-omaha-sync nightly to sync omaha content from the upstream mirror servers. Your CoreOS hosts can then be configured to update against the smart proxy. The proxy then uploads facts and reports to Foreman. Omaha content is served directly from the proxy.

To be able to use Foreman for your Omaha updates, you need to install the Foreman Omaha plugin, install this smart-proxy plugin and configure your CoreOS hosts.

For the Smart Proxy plugin, follow the smart-proxy plugin installation instructions. You usually just need to install the rubygem-smart_proxy_omaha package and restart the foreman-proxy service.

For the initial sync of releases you need to run the binary smart-proxy-omaha-sync as foreman-proxy user.

Do not forget to register the smart proxy in Foreman via the user interface.

You need to configure your CoreOS hosts to connect to the Omaha smart-proxy for updates. You can either configure your servers manually or use cloud-config. If your smart-proxy uses a self-signed ssl certificate, you have to add the CA certificate to the CoreOS truststore. By default, the smart-proxys uses a PuppetCA certificate. To print the PuppetCA certificate, issue cat $(puppet config print localcacert) on any puppet enabled node.

To add a custom CA certificate to CoreOS's truststore:

vim /etc/ssl/certs/customCA_root.pem
sudo /usr/sbin/update-ca-certificates

To configure CoreOS to connect to the Omaha smart-proxy for updates, edit /etc/coreos/update.conf, to configure Flatcar to connect to the Omaha smart-proxy for updates, edit /etc/flatcar/update.conf:

GROUP=stable
SERVER=https://omahaproxy.example.com:8443/omaha/v1/update

Restart update engine:

sudo systemctl restart update-engine

Configure CoreOS to connect to the Omaha smart-proxy for updates:

#cloud-config
coreos:
  update:
    group: "stable"
    server: "https://omahaproxy.example.com:8443/omaha/v1/update"

Add a custom CA certificate to CoreOS's truststore:

#cloud-config
write-files:
  - path: /etc/ssl/certs/customCA_root.pem
    permissions: 0644
    content: |
      -----BEGIN CERTIFICATE-----
      YOUR-BASE64-ENCODED-CERTIFICATE
      -----END CERTIFICATE-----
units:
  - name: update-ca-certificates.service
    command: start
    content: |
      [Unit]
      Description=Force Update CA bundle at /etc/ssl/certs/ca-certificates.crt
      # Since other services depend on the certificate store run this early
      DefaultDependencies=no
      Wants=systemd-tmpfiles-setup.service clean-ca-certificates.service
      After=systemd-tmpfiles-setup.service clean-ca-certificates.service
      Before=sysinit.target
      ConditionPathIsReadWrite=/etc/ssl/certs

      [Service]
      Type=oneshot
      ExecStart=/usr/sbin/update-ca-certificates

All three default release channels (alpha, beta, stable) are supported. You cannot define custom channels right now.

To test if a client can successfully check for updates, these commands may help:

$ update_engine_client -check_for_update
$ journalctl -u update-engine.service

In the settings file you can specify a http proxy that is used to download Omaha content. You need to allow https access to these servers:

For CoreOS:

• alpha.release.core-os.net
• beta.release.core-os.net
• stable.release.core-os.net
• update.release.core-os.net

For Flatcar:

• www.flatcar-linux.org
• alpha.release.flatcar-linux.net
• beta.release.flatcar-linux.net
• stable.release.flatcar-linux.net
• update.release.flatcar-linux.net

In order to make the Omaha Smart Proxy high available or add additional capacity, just scale out and put a loadbalancer in front of the proxies.

Copyright (c) 2016 The Foreman developers

This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program. If not, see http://www.gnu.org/licenses/.