Azure help needed

[8bit]

The firm I work for have a growing IaaS estate in Azure. Most of this is Linux, deployed from standard Azure marketplace templates. These are then joined to our management and monitoring tools for Linux, specifically SUSE Manager - essentially based on the Spacewalk platform, like Red Hat Satellite used to be.

We're trying to find a way to have the registration to SUSE Manager done automatically. I'm not an Azure expert at all, hence the question - but surely there's some way we can have Azure make a few API calls to the SUSE Manager URL upon successful creation and startup of the new Linux VM? The cloud guy here seemed to think the only way to do this would be write something like a Python script around the API calls, host it on a storage account and use cloud-init to pull that in to the new VM and run it but I'm sure there must be a better way...

[steedy27]

One of my first thoughts was to use a post provisioning action like cloud-init or vm extension to make the call to SUSE Manager, it's a sound option.

Another option that just to mind is do you use a automation tool like Terraform/Ansible to create/build your IaaS VM's (Could be part of a ci/cd pipeline)?, you could use that tool to run some cli commands against SUSE Manager once the VM has been provisioned.

Edited by steedy27 on Tuesday 19th October 17:55

[doolie]

I’d be inclined to any of the dsc tools to do this for you. Ansible/chef/puppet etc. Or azure dsc with a simple module then onboard the vms to it and apply. Or simply through a vm extension command.

Any of these could integrate as a post build item, whether built through pipelines (preferable), portal, cli, powershell etc.

[e-honda]

8bit said:

The firm I work for have a growing IaaS estate in Azure. Most of this is Linux, deployed from standard Azure marketplace templates. These are then joined to our management and monitoring tools for Linux, specifically SUSE Manager - essentially based on the Spacewalk platform, like Red Hat Satellite used to be.

We're trying to find a way to have the registration to SUSE Manager done automatically. I'm not an Azure expert at all, hence the question - but surely there's some way we can have Azure make a few API calls to the SUSE Manager URL upon successful creation and startup of the new Linux VM? The cloud guy here seemed to think the only way to do this would be write something like a Python script around the API calls, host it on a storage account and use cloud-init to pull that in to the new VM and run it but I'm sure there must be a better way...

You should be able to download a boot strapping script from your SUSE manager and run that directly with cloud init and job done
It sounds like you are trying to achieve something beyond just merely registering clients.

[8bit]

e-honda said:

You should be able to download a boot strapping script from your SUSE manager and run that directly with cloud init and job done
It sounds like you are trying to achieve something beyond just merely registering clients.

We can do exactly that, but the problem there is that running the bootstrap script on the client then requires a SUSE Manager admin to log in to the SUSE Manager web UI and accept the key from the client before the bootstrap process will complete. We're looking to automate that entirely and also have the newly built and bootstrapped system run the post-build scripts that SUSE Manager distributes once it has completed the bootstrap process.

To the posters above, many thanks for that. So basically then, in the absence of DSC or DevOps pipelines etc. then cloud-init is about the next best solution for this? Sounds like I'll have to wrap up the API calls in a bit of Python or something and run that via cloud-init if that's the case...?

[e-honda]

8bit said:

We can do exactly that, but the problem there is that running the bootstrap script on the client then requires a SUSE Manager admin to log in to the SUSE Manager web UI and accept the key from the client before the bootstrap process will complete. We're looking to automate that entirely and also have the newly built and bootstrapped system run the post-build scripts that SUSE Manager distributes once it has completed the bootstrap process.

To the posters above, many thanks for that. So basically then, in the absence of DSC or DevOps pipelines etc. then cloud-init is about the next best solution for this? Sounds like I'll have to wrap up the API calls in a bit of Python or something and run that via cloud-init if that's the case...?

You should be able to edit the bootstrap script to include an activation key so clients are automatically accepted.

[8bit]

e-honda said:

You should be able to edit the bootstrap script to include an activation key so clients are automatically accepted.

I take it you have some experience with SUSE Manager, Spacewalk, RH Satellite or Uyuni then? So for a "traditional client" (e.g. one which will use jabber/OSA to talk to SUSE Manager) then yes I think you can do it that way. All our clients use SaltStack which is integrated into SUSE Manager and it's the Salt key that needs to be accepted if the bootstrap was initiated from the script on the client.

If a SUSE Manager admin logs on to the web UI and bootstraps the system from there by giving the client hostname/IP, user account, password or ssh key etc. then the step to accept the Salt key from the client is not required. My understanding is that initiating the bootstrap process by the API call to that function essentially behaves like the latter scenario so no need to manually accept the Salt key.

[Taita]

e-honda said:

8bit said:

We can do exactly that, but the problem there is that running the bootstrap script on the client then requires a SUSE Manager admin to log in to the SUSE Manager web UI and accept the key from the client before the bootstrap process will complete. We're looking to automate that entirely and also have the newly built and bootstrapped system run the post-build scripts that SUSE Manager distributes once it has completed the bootstrap process.

To the posters above, many thanks for that. So basically then, in the absence of DSC or DevOps pipelines etc. then cloud-init is about the next best solution for this? Sounds like I'll have to wrap up the API calls in a bit of Python or something and run that via cloud-init if that's the case...?

You should be able to edit the bootstrap script to include an activation key so clients are automatically accepted.

Yup this, just be aware of hardcoding API keys etc. And have a plan for what to do if you think they have been leaked somehow etc.

[8bit]

Taita said:

Yup this, just be aware of hardcoding API keys etc. And have a plan for what to do if you think they have been leaked somehow etc.

As I said above, I don't think that's possible for Salt clients on SUSE Manager, otherwise we wouldn't need to look at the API to do it. If anyone knows better then I'm happy to be corrected though?

[e-honda]

Doc's say it supports both traditional and salt clients. I don't know what that means for your particular situation.
Sounds like you need to try it and explore it thoroughly and know for sure it can just do it before trying to engineer a solution to a problem you may not have.

[8bit]

e-honda said:

Doc's say it supports both traditional and salt clients. I don't know what that means for your particular situation.
Sounds like you need to try it and explore it thoroughly and know for sure it can just do it before trying to engineer a solution to a problem you may not have.

OK I know SUSE Manager pretty well, been working with it for a year and a half. If you're not sure of the differences between the client types and what that means for onboarding then I think I understand the problem far better than you do.