Foreman - Configure dhcp-proxy using the remote_isc plugin

I have run my foreman-server up until recently without the dhcp-capsule feature enabled but I decided to change that to have proper integration so here's a quick how-to:

First, generate the omapi_key and get the hash:

 [root@dhcp ~]# dnssec-keygen -r /dev/urandom -a HMAC-MD5 -b 512 -n HOST omapi_key  
 [root@dhcp ~]# grep -iE '^Key' Komapi_key*.private | cut -d ' ' -f 2-  

Now, prepare the dhcp-server config by appending these options:

 [root@dhcp ~]# vim /etc/dhcp/dhcpd.conf  

 omapi-port 7911;  
 key omapi_key {  
   algorithm HMAC-MD5;  
   secret "hash-from-command-gathered-earlier";  
 };  
 omapi-key omapi_key;  

Change the permissions for the dhcp folder and config file:

 [root@dhcp ~]# chmod o+rx /etc/dhcp/  
 [root@dhcp ~]# chmod o+r /etc/dhcp/dhcpd.conf  

According to Red Hat's Documentation, the bindmounts are necessary:

 [root@dhcp ~]# vim /etc/fstab  

 /var/lib/dhcpd /exports/var/lib/dhcpd none bind,auto 0 0  
 /etc/dhcp /exports/etc/dhcp none bind,auto 0 0  

 [root@dhcp ~]# systemctl daemon-reload  
 [root@dhcp ~]# mount -a  

Now, prepare the nfs exports on the dhcp-server:

 [root@dhcp ~]# dnf -4y --refresh install nfs-utils  
 [root@dhcp ~]# mkdir -p /exports/var/lib/dhcpd /exports/etc/dhcp  
 [root@dhcp ~]# vim /etc/exports  

 /exports ${foreman-ip}(rw,async,no_root_squash,fsid=0,no_subtree_check)  
 /exports/etc/dhcp ${foreman-ip}(ro,async,no_root_squash,no_subtree_check,nohide)  
 /exports/var/lib/dhcpd ${foreman-ip}(ro,async,no_root_squash,no_subtree_check,nohide)  

 [root@dhcp ~]# exportfs -rav  

The preparation and configuration for the dhcp-server is now done, last step is to configure the foreman-server. Start by making sure the nfs-utils package is installed:

 [root@katello ~]# dnf -4y --refresh install nfs-utils  

Create the required directory structure and change the owner accordingly:

 [root@katello ~]# mkdir -p /mnt/nfs/etc/dhcp /mnt/nfs/var/lib/dhcpd  
 [root@katello ~]# chown -R foreman-proxy /mnt/nfs  

Create the mounts in /etc/fstab:

 [root@katello ~]# vim /etc/fstab  

 # katello capsule mounts  
 infra01.archyslife.lan:/exports/etc/dhcp /mnt/nfs/etc/dhcp nfs ro,vers=3,auto,nosharecache,context="system_u:object_r:dhcp_etc_t:s0" 0 0  
 infra01.archyslife.lan:/exports/var/lib/dhcpd /mnt/nfs/var/lib/dhcpd nfs ro,vers=3,auto,nosharecache,context="system_u:object_r:dhcpd_state_t:s0" 0 0  

 [root@katello ~]# systemctl daemon-reload  
 [root@katello ~]# mount -a  

Next up, the foreman configuration:

 [root@katello ~]# foreman-installer --scenario katello \  
 --enable-foreman-proxy-plugin-dhcp-remote-isc \  
 --foreman-proxy-dhcp 'true' \  
 --foreman-proxy-dhcp-provider 'remote_isc' \  
 --foreman-proxy-dhcp-server 'infra01.archyslife.lan' \  
 --foreman-proxy-plugin-dhcp-remote-isc-dhcp-config '/mnt/nfs/etc/dhcp/dhcpd.conf' \  
 --foreman-proxy-plugin-dhcp-remote-isc-dhcp-leases '/mnt/nfs/var/lib/dhcpd/dhcpd.leases' \  
 --foreman-proxy-plugin-dhcp-remote-isc-key-name 'omapi_key' \  
 --foreman-proxy-plugin-dhcp-remote-isc-key-secret '${secret-key-hash-gathered-from-dhcp-server}' \  
 --foreman-proxy-plugin-dhcp-remote-isc-omapi-port '7911'  

This task will take a moment to complete. Once it's completed successfully, restart the foreman-services:

 [root@katello ~]# foreman-maintain service stop; sleep 10; foreman-maintain service start  

Once the foreman-instance is back, you can assign the dhcp-proxy in the WebUI under following this menu-structure:

• 'Infrastructure'
• 'Subnets'
• ${subnet}
• 'Proxies'

Also make sure to set

• 'IPAM' option in the WebUI to 'DHCP'
• define the 'Start Of Ip Range' option
• define the 'End Of Ip Range' option

Repeat for each subnet managed by Foreman.

If the IP-Allocation for new hosts doesn't work, make sure you're not including any rndc-keys in your dhcp-server configuration since they won't allow management using the omapi-secrets.

Feel free to comment and / or suggest a topic.