RHUG SPECIAL SATELLITE RED HAT OFFICE MONTREAL, FEBRUARY 16, 2017

Transcription

1 RHUG SPECIAL SATELLITE RED HAT OFFICE MONTREAL, FEBRUARY 16, 2017 Presented by: Domtar Shared Services Christophe Paulus James Dubuisson Gueorgui Tcherecharov

2 DOMTAR IN BRIEF 150+ Years Old: From Dominion Tar and Chemical Company, Ltd. To Domtar Corporation From coal tar distillation to NCC (nanocrystalline cellulose) Domtar today is 2 Divisions: Pulp and Paper Personal Care Close to 10,000 employees US $5.3 Billion (83% P&P 17% PC) Stock Symbol UFS (NYSE;TSE) More info at domtar.com STRICTLY PRIVATE AND CONFIDENTIAL 2

3 THE SYSTEMS ADMINISTRATION TEAM Today presenters are part of IT Core Infrastructure Services Shared Services Systems Administration IT Core Infrastructure Services is responsible for the following technology towers: Data Centers Servers SAN Virtualization Backup Operating System Application Delivery Shared Services Systems Administration Windows Linux/Unix F5 Big-IP STRICTLY PRIVATE AND CONFIDENTIAL 3

4 FEW NUMBERS Virtual Machines spread across N.A and E.U, the bulk of them in the 2 Montreal Data Centers. 3 Main OSs in multiple flavors: Windows Linux Unix (hp-ux) 200 RHEL VM (Growing): RHEL5 (25%) RHEL6 (66%) RHEL7 (9%) 50+ Linux Based appliances (Growing Fast!) STRICTLY PRIVATE AND CONFIDENTIAL 4

5 WHY WE SELECTED SATELLITE 2013 Linux VM number is growing Fast The management Start to become painful, There is a need for a patching tool Plus we want a replacement tool for the current configuration engine. Need to automate VM deployment. Evaluation of different products led to the conclusion that Red Hat Satellite is the tool. The key words/phrase was: Greater administration consistency, enhanced security (compliance), increased productivity. With Satellite all the goal could be achieved. December Starting deployment of Satellite 5.6 with external DB (Oracle) STRICTLY PRIVATE AND CONFIDENTIAL 5

6 WHY WE UPGRADED TO SATELLITE Happy Sysadmin who deploy patches Per scheduled According to our standard Then Satellite 6 is presented : The architecture, functionality and the road map were appealing to us. Plus we only have implemented one of the need (patching). Decision is made to switch to Satellite Starting of the Migration Less Happy Sysadmin for a while Happiness gets back with 6.1 and Joy with 6.2 STRICTLY PRIVATE AND CONFIDENTIAL 6

7 DOMTAR PATCHING STANDARD The goal: Patching every quarter Patches that doesn't require a reboot (eg most of the security patch) every quarter Patches that requires a reboot (e.g: Bug Fix and Product Enhancement) at least once with a twice a year target. Application Life Cycle: SandBox, Development, Quality Assurance, Staging (pre-production), Production, Training Four Time a year we draw a line in the sand that contains all the available patches at that specific time. STRICTLY PRIVATE AND CONFIDENTIAL 7

8 DOMTAR PATCHING STANDARD CONT D Each quarter the set of patches is pushed thru the application Life cycle. STRICTLY PRIVATE AND CONFIDENTIAL 8

9 DOMTAR PATCHING STANDARD CONT D A content view is a set of repositories to which we have subscribed. The following Domtar composite content-view are associated with the environments: dt-jboss-rhel6-x86_64 dt-rhel58-x86_64 dt-rhel5-x86_64 dt-rhel6-x86_64 dt-rhel7-x86_64 dt-sap-rhel5-x86_64 dt-sap-rhel6-x86_64 out-of-sequence-rhel6 out-of-sequence-rhel7 Library, jboss-sx, jboss-dv, jboss-qa, jboss-st, jboss-pr, jboss-tr Library, SX, DV, QA, ST, PR, TR Library, SX, DV, QA, ST, PR, TR Library, SX, DV, QA, ST, PR, TR Library, SX, DV, QA, ST, PR, TR Library, sap_sx, sap-qa, sap-st, sap-pr, sap-tr, sap-dv Library, sap_sx, sap-qa, sap-st, sap-pr, sap-tr, sap-dv Library, out-of-sequence-rhel6_upgrade Library, out-of-sequence-rhel7_upgrade Those composite content views are build from based content view to which we have added our own repos. STRICTLY PRIVATE AND CONFIDENTIAL 9

10 RATIONALES FOR UPGRADE TO SATELLITE 6? Centralized method for managing servers Easy way to deploy patches in phases ( Dev, QA, Staging, Prod etc ) Simple way to manage our RedHat Subscriptions RBAC for different teams Configuration Management is integrated Automatic Server deployment Nice dashboard Many more features in roadmap STRICTLY PRIVATE AND CONFIDENTIAL 10

11 SATELLITE 5 TO 6.0 MIGRATION Started March 2015 Fresh Install on RHEL6 Server Import data from Satellite 5 to Satellite 6 Issues when importing content views to new server Virt-who installed on standalone Ended up only importing users and host collections Issues when selecting multiple patches Some servers were losing their subscription during VMotion STRICTLY PRIVATE AND CONFIDENTIAL 11

12 MIGRATION SATELLITE 6.0 TO 6.1 Upgraded started September 2015 Issue with the upgrade Was fixed via Remote session with RedHat Support Lots of bugs were fixed compared to previous version Not losing subscriptions anymore Issue with RBAC Improved speed STRICTLY PRIVATE AND CONFIDENTIAL 12

13 MIGRATION SATELLITE 6.1 TO 6.2 Started August 2016 Fresh Install As per RedHat recommendations, we installed RHEL7 No official tool to export Satellite 6.1 content to 6.2 if you install on new machine at time of migration. A script is now available to do this task. Imported data using Satellite API to new server Much improved User Interface Now using at ; Works like a charm STRICTLY PRIVATE AND CONFIDENTIAL 13

14 HOW DO WE PATCH OUR SERVERS Scheduling is done by our team Operation team then contact server owners to get patching approval When server owner approves patching window, Ops team will then patch them After patches are down, we verify if all patches were completed successfully on our custom dashboard After 2 weeks testing, we promote the same patches to the next environment using Hammer STRICTLY PRIVATE AND CONFIDENTIAL 14

15 HOW WE PATCH OUR SERVERS - SCHEDULING A small shell script generates our patching schedule in a text file STRICTLY PRIVATE AND CONFIDENTIAL 15

16 HOW WE PATCH OUR SERVERS - OWNERS We add the Business owner info in the description field for each server Business owner approves the patches for his/her servers Ops team uses the info in the description field to create a CR before patching Below image shows content of this info : Env Server Application, Owner ; CC(users) STRICTLY PRIVATE AND CONFIDENTIAL 16

17 HOW WE PATCH OUR SERVERS - VERIFICATION Screenshot of our custom Dashboard STRICTLY PRIVATE AND CONFIDENTIAL 17

18 HOW WE PATCH OUR SERVERS CONT D Info we can get on patches that were not installed, or when server owner wants info on patches to install STRICTLY PRIVATE AND CONFIDENTIAL 18

19 NICE FEATURES SCHEDULING STRICTLY PRIVATE AND CONFIDENTIAL 19

20 NICE FEATURES SCHEDULING CONT D STRICTLY PRIVATE AND CONFIDENTIAL 20

21 NICE FEATURES SCHEDULING CONT D STRICTLY PRIVATE AND CONFIDENTIAL 21

22 NICE FEATURES - JOB EXECUTION STRICTLY PRIVATE AND CONFIDENTIAL 22

23 NICE FEATURES - JOB EXECUTION CONT D STRICTLY PRIVATE AND CONFIDENTIAL 23

24 NICE FEATURES - OPENSCAP Upload new SCAP content STRICTLY PRIVATE AND CONFIDENTIAL 24

25 NICE FEATURES OPENSCAP CONT D STRICTLY PRIVATE AND CONFIDENTIAL 25

26 NICE FEATURES OPENSCAP CONT D Assign compliance policy to a host(s) STRICTLY PRIVATE AND CONFIDENTIAL 26

27 NICE FEATURES OPENSCAP CONT D Assign the compliance policy STRICTLY PRIVATE AND CONFIDENTIAL 27

28 NICE FEATURES OPENSCAP CONT D STRICTLY PRIVATE AND CONFIDENTIAL 28

29 HOW WE USE THE SATELLITE API STRICTLY PRIVATE AND CONFIDENTIAL 29

30 HOW WE USE THE SATELLITE API CONT D STRICTLY PRIVATE AND CONFIDENTIAL 30

31 HOW WE USE THE SATELLITE API CONT D STRICTLY PRIVATE AND CONFIDENTIAL 31

32 API SCRIPT Example: Simple Perl API Script STRICTLY PRIVATE AND CONFIDENTIAL 32

33 API SCRIPT Example 2 : The same information but from all hosts STRICTLY PRIVATE AND CONFIDENTIAL 33

34 HOW WE USE THE SATELLITE API CONT D Here are some actions that we do using the APIs Export and import comment data Apply security errata List errata by server details and summary List server name, host collection, activation keys, subscription List unsubscribed servers List servers that changed their subscription STRICTLY PRIVATE AND CONFIDENTIAL 34

35 FUTURE USE OF SATELLITE AT DOMTAR Integrate new features that Michael just talked about Ansible to replace our current Configuration Management tool Deploy OpenScap, now that we have completed the POC Deployment of servers from RedHat Satellite Integrate IDM to Satellite STRICTLY PRIVATE AND CONFIDENTIAL 35

36 RECOMMENDATIONS Use the recommended settings for Redhat Satellite 16 Gigs Ram 4 CPUs Monitor the server to see if these settings fit your needs ( ~ 300 Servers ) Allocate file System size for file systems ( /var/pulp/, /var/pgsql/, etc.. ) Create Capsules Servers for remote locations No need to install virt-who on separate machine. Can now be integrated on Satellite main server STRICTLY PRIVATE AND CONFIDENTIAL 36

37 RECOMMENDATIONS CONT D Snapshot of or disk utilization in Satellite STRICTLY PRIVATE AND CONFIDENTIAL 37

38 ADDITIONAL RESOURCES RedHat Satellite Blog ( Rich Jerrido Technical Product Manager ) STRICTLY PRIVATE AND CONFIDENTIAL 38

39 ADDITIONAL RESOURCES CONT D RedHat Satellite Documentation STRICTLY PRIVATE AND CONFIDENTIAL 39

40 ADDITIONAL RESOURCES CONT D Hammer cheat sheet STRICTLY PRIVATE AND CONFIDENTIAL 40

41 ADDITIONAL RESOURCES CONT D API Description STRICTLY PRIVATE AND CONFIDENTIAL 41

42 ADDITIONAL RESOURCES (SCRIPTS) STRICTLY PRIVATE AND CONFIDENTIAL 42

43 QUESTIONS STRICTLY PRIVATE AND CONFIDENTIAL 43

44 THANK YOU STRICTLY PRIVATE AND CONFIDENTIAL 44

45