Chapter 14. Provisioning Cloud Instances in Amazon EC2 Amazon Elastic Compute Cloud (Amazon EC2) is a web service that provides public cloud compute resources. Using Satellite, you can interact with Amazon EC2's public API to create cloud instances and control their power management states. Use the procedures in this chapter to add a connection to an Amazon EC2 account and provision a cloud instance. 14.1. Prerequisites for Amazon EC2 Provisioning The requirements for Amazon EC2 provisioning include: A Capsule Server managing a network in your EC2 environment. Use a Virtual Private Cloud (VPC) to ensure a secure network between the hosts and Capsule Server. An Amazon Machine Image (AMI) for image-based provisioning. You can use synchronized content repositories for Red Hat Enterprise Linux. For more information, see Syncing Repositories in the Content Management Guide . Provide an activation key for host registration. For more information, see Creating An Activation Key in the Content Management guide. 14.2. Installing Amazon EC2 Plugin Install the Amazon EC2 plugin to attach an EC2 compute resource provider to Satellite. This allows you to manage and deploy hosts to EC2. Procedure Install the EC2 compute resource provider on your Satellite Server: Optional: In the Satellite web UI, navigate to Administer > About and select the compute resources tab to verify the installation of the Amazon EC2 plugin. 14.3. Adding an Amazon EC2 Connection to the Satellite Server Use this procedure to add the Amazon EC2 connection in Satellite Server's compute resources. To use the CLI instead of the Satellite web UI, see the CLI procedure . Prerequisite An AWS EC2 user performing this procedure needs the AmazonEC2FullAccess permissions. You can attach these permissions from AWS. Time Settings and Amazon Web Services Amazon Web Services uses time settings as part of the authentication process. Ensure that Satellite Server's time is correctly synchronized. Ensure that an NTP service, such as ntpd or chronyd , is running properly on Satellite Server. Failure to provide the correct time to Amazon Web Services can lead to authentication failures. For more information about synchronizing time in Satellite, see Synchronizing Time in Installing Satellite Server in a Connected Network Environment . Procedure In the Satellite web UI, navigate to Infrastructure > Compute Resources and in the Compute Resources window, click Create Compute Resource . In the Name field, enter a name to identify the Amazon EC2 compute resource. From the Provider list, select EC2 . In the Description field, enter information that helps distinguish the resource for future use. Optional: From the HTTP proxy list, select an HTTP proxy to connect to external API services. You must add HTTP proxies to Satellite before you can select a proxy from this list. For more information, see Section 14.4, "Using an HTTP Proxy with Compute Resources" . In the Access Key and Secret Key fields, enter the access keys for your Amazon EC2 account. For more information, see Managing Access Keys for your AWS Account on the Amazon documentation website. Optional: Click the Load Regions button to populate the Regions list. From the Region list, select the Amazon EC2 region or data center to use. Click the Locations tab and ensure that the location you want to use is selected, or add a different location. Click the Organizations tab and ensure that the organization you want to use is selected, or add a different organization. Click Submit to save the Amazon EC2 connection. Select the new compute resource and then click the SSH keys tab, and click Download to save a copy of the SSH keys to use for SSH authentication. Until BZ1793138 is resolved, you can download a copy of the SSH keys only immediately after creating the Amazon EC2 compute resource. If you require SSH keys at a later stage, follow the procedure in Section 14.9, "Connecting to an Amazon EC2 instance using SSH" . CLI procedure Create the connection with the hammer compute-resource create command. Use --user and --password options to add the access key and secret key respectively. 14.4. Using an HTTP Proxy with Compute Resources In some cases, the EC2 compute resource that you use might require a specific HTTP proxy to communicate with Satellite. In Satellite, you can create an HTTP proxy and then assign the HTTP proxy to your EC2 compute resource. However, if you configure an HTTP proxy for Satellite in Administer > Settings , and then add another HTTP proxy for your compute resource, the HTTP proxy that you define in Administer > Settings takes precedence. Procedure In the Satellite web UI, navigate to Infrastructure > HTTP Proxies , and select New HTTP Proxy . In the Name field, enter a name for the HTTP proxy. In the URL field, enter the URL for the HTTP proxy, including the port number. Optional: Enter a username and password to authenticate to the HTTP proxy, if your HTTP proxy requires authentication. Click Test Connection to ensure that you can connect to the HTTP proxy from Satellite. Click the Locations tab and add a location. Click the Organization tab and add an organization. Click Submit . 14.5. Creating an Image for Amazon EC2 You can create images for Amazon EC2 from within Satellite. Procedure In the Satellite web UI, navigate to Infrastructure > Compute Resources . Select your Amazon EC2 provider. Click Create Image . In the Name field, enter a meaningful and unique name for your EC2 image. From the Operating System list, select an operating system to associate with the image. From the Architecture list, select an architecture to associate with the image. In the Username field, enter the username needed to SSH into the machine. In the Image ID field, enter the image ID provided by Amazon or an operating system vendor. Optional: Select the User Data check box to enable support for user data input. Optional: Set an Iam Role for Fog to use when creating this image. Click Submit to save your changes to Satellite. 14.6. Adding Amazon EC2 Images to Satellite Server Amazon EC2 uses image-based provisioning to create hosts. You must add image details to your Satellite Server. This includes access details and image location. To use the CLI instead of the Satellite web UI, see the CLI procedure . Procedure In the Satellite web UI, navigate to Infrastructure > Compute Resources and select an Amazon EC2 connection. Click the Images tab, and then click Create Image . In the Name field, enter a name to identify the image for future use. From the Operating System list, select the operating system that corresponds with the image you want to add. From the Architecture list, select the operating system's architecture. In the Username field, enter the SSH user name for image access. This is normally the root user. In the Password field, enter the SSH password for image access. In the Image ID field, enter the Amazon Machine Image (AMI) ID for the image. This is usually in the following format: ami-xxxxxxxx . Optional: Select the User Data checkbox if the images support user data input, such as cloud-init data. If you enable user data, the Finish scripts are automatically disabled. This also applies in reverse: if you enable the Finish scripts, this disables user data. Optional: In the IAM role field, enter the Amazon security role used for creating the image. Click Submit to save the image details. CLI procedure Create the image with the hammer compute-resource image create command. Use the --uuid field to store the full path of the image location on the Amazon EC2 server. 14.7. Adding Amazon EC2 Details to a Compute Profile You can add hardware settings for instances on Amazon EC2 to a compute profile. Procedure In the Satellite web UI, navigate to Infrastructure > Compute Profiles and click the name of your profile, then click an EC2 connection. From the Flavor list, select the hardware profile on EC2 to use for the host. From the Image list, select the image to use for image-based provisioning. From the Availability zone list, select the target cluster to use within the chosen EC2 region. From the Subnet list, add the subnet for the EC2 instance. If you have a VPC for provisioning new hosts, use its subnet. From the Security Groups list, select the cloud-based access rules for ports and IP addresses to apply to the host. From the Managed IP list, select either a Public IP or a Private IP. Click Submit to save the compute profile. CLI procedure The compute profile CLI commands are not yet implemented in Red Hat Satellite. As an alternative, you can include the same settings directly during the host creation process. 14.8. Creating Image-Based Hosts on Amazon EC2 The Amazon EC2 provisioning process creates hosts from existing images on the Amazon EC2 server. To use the CLI instead of the Satellite web UI, see the CLI procedure . Procedure In the Satellite web UI, navigate to Hosts > Create Host . In the Name field, enter a name for the host. From the Host Group list, you can select a host group to populate most of the new host's fields. From the Deploy on list, select the EC2 connection. From the Compute Profile list, select a profile to use to automatically populate virtual machine-based settings. Click the Interface tab, and then click Edit on the host's interface, and verify that the fields are populated with values. Leave the Mac Address field blank. Satellite Server automatically selects and IP address and the Managed , Primary , and Provision options for the first interface on the host. Click the Operating System tab and confirm that all fields are populated with values. Click the Virtual Machine tab and confirm that all fields are populated with values. Click the Parameters tab, and ensure that a parameter exists that provides an activation key. If not, add an activation key. Click Submit to save your changes. This new host entry triggers the Amazon EC2 server to create the instance, using the pre-existing image as a basis for the new volume. CLI procedure Create the host with the hammer host create command and include --provision-method image to use image-based provisioning. For more information about additional host creation parameters for this compute resource, enter the hammer host create --help command. 14.9. Connecting to an Amazon EC2 instance using SSH You can connect remotely to an Amazon EC2 instance from Satellite Server using SSH. However, to connect to any Amazon Web Services EC2 instance that you provision through Red Hat Satellite, you must first access the private key that is associated with the compute resource in the Foreman database, and use this key for authentication. Procedure To locate the compute resource list, on your Satellite Server base system, enter the following command, and note the ID of the compute resource that you want to use: Switch user to the postgres user: Initiate the postgres shell: Connect to the Foreman database as the user postgres : Select the secret from key_pairs where compute_resource_id = 3 : Copy the key from after -----BEGIN RSA PRIVATE KEY----- until -----END RSA PRIVATE KEY----- . Create a .pem file and paste your key into the file: Ensure that you restrict access to the .pem file: To connect to the Amazon EC2 instance, enter the following command: 14.10. Configuring a Finish Template for an Amazon Web Service EC2 Environment You can use Red Hat Satellite finish templates during the provisioning of Red Hat Enterprise Linux instances in an Amazon EC2 environment. If you want to use a Finish template with SSH, Satellite must reside within the EC2 environment and in the correct security group. Satellite currently performs SSH finish provisioning directly, not using Capsule Server. If Satellite Server does not reside within EC2, the EC2 virtual machine reports an internal IP rather than the necessary external IP with which it can be reached. Procedure In the Satellite web UI, navigate to Hosts > Provisioning Templates . In the Provisioning Templates page, enter Kickstart default finish into the search field and click Search . On the Kickstart default finish template, select Clone . In the Name field, enter a unique name for the template. In the template, prefix each command that requires root privileges with sudo , except for subscription-manager register and yum commands, or add the following line to run the entire template as the sudo user: Click the Association tab, and associate the template with a Red Hat Enterprise Linux operating system that you want to use. Click the Locations tab, and add the the location where the host resides. Click the Organizations tab, and add the organization that the host belongs to. Make any additional customizations or changes that you require, then click Submit to save your template. In the Satellite web UI, navigate to Hosts > Operating systems and select the operating system that you want for your host. Click the Templates tab, and from the Finish Template list, select your finish template. In the Satellite web UI, navigate to Hosts > Create Host and enter the information about the host that you want to create. Click the Parameters tab and navigate to Host parameters . In Host parameters , click the Add Parameter button three times to add three new parameter fields. Add the following three parameters: In the Name field, enter remote_execution_ssh_keys . In the corresponding Value field, enter the output of cat /usr/share/foreman-proxy/.ssh/id_rsa_foreman_proxy.pub . In the Name field, enter remote_execution_ssh_user . In the corresponding Value field, enter ec2-user . In the Name field, enter activation_keys . In the corresponding Value field, enter your activation key. Click Submit to save the changes. 14.11. Deleting a Virtual Machine on Amazon EC2 You can delete virtual machines running on Amazon EC2 from within Satellite. Procedure In the Satellite web UI, navigate to Infrastructure > Compute Resources . Select your Amazon EC2 provider. On the Virtual Machines tab, click Delete from the Actions menu. This deletes the virtual machine from the Amazon EC2 compute resource while retaining any associated hosts within Satellite. If you want to delete an orphaned host, navigate to Hosts > All Hosts and delete the host manually. 14.12. Uninstalling Amazon EC2 Plugin If you have previously installed the Amazon EC2 plugin but do not use it anymore to manage and deploy hosts to EC2, you can uninstall it from your Satellite Server. Procedure Uninstall the EC2 compute resource provider from your Satellite Server: Optional: In the Satellite web UI, navigate to Administer > About and select the Available Providers tab to verify the removal of the Amazon EC2 plugin. 14.13. More Information About Amazon Web Services and Satellite For information about how to locate Red Hat Gold Images on Amazon Web Services EC2, see How to Locate Red Hat Cloud Access Gold Images on AWS EC2 . For information about how to install and use the Amazon Web Service Client on Linux, see Install the AWS Command Line Interface on Linux in the Amazon Web Services documentation. For information about importing and exporting virtual machines in Amazon Web Services, see VM Import/Export in the Amazon Web Services documentation.

Commands:
satellite-installer --enable-foreman-compute-ec2
hammer compute-resource create --description "Amazon EC2 Public Cloud` --locations " My_Location " --name " My_EC2_Compute_Resource " --organizations " My_Organization " --password " My_Secret_Key " --provider "EC2" --region " My_Region " --user " My_User_Name "
hammer compute-resource image create --architecture " My_Architecture " --compute-resource " My_EC2_Compute_Resource " --name " My_Amazon_EC2_Image " --operatingsystem " My_Operating_System " --user-data true --username root --uuid "ami- My_AMI_ID "
hammer host create --compute-attributes="flavor_id=m1.small,image_id=TestImage,availability_zones=us-east-1a,security_group_ids=Default,managed_ip=Public" --compute-resource " My_EC2_Compute_Resource " --enabled true --hostgroup " My_Host_Group " --image " My_Amazon_EC2_Image " --interface "managed=true,primary=true,provision=true,subnet_id=EC2" --location " My_Location " --managed true --name "My_Amazon_EC2_Host_" --organization " My_Organization " --provision-method image
hammer compute-resource list
su - postgres
psql
postgres=# \c foreman
select secret from key_pairs where compute_resource_id = 3; secret
vim Keyname .pem
chmod 600 Keyname .pem
ssh -i Keyname .pem ec2-user@ example.aws.com
sudo -s << EOS _Template_ _Body_ EOS
yum remove -y foreman-ec2 satellite-installer --no-enable-foreman-compute-ec2