Skip to content

Installing VSatellites on RHEL, Oracle, and Rocky Linux

If you plan to install VSatellites on Red Hat Enterprise Linux (RHEL), Oracle Linux, or Rocky Linux, carefully review the following information.

Special considerations

For all RHEL, Oracle, and Rocky installations, VSatellite requires two additional packages to be installed: container-selinuxand k3s-selinux.

The VSatellite installer installs k3s-selinux for you automatically. For details about k3s, refer to the k3s documentation.

However, you will need to install the container-selinux package, which is detailed below.

Install the RPM

Before installing the RPM on RHEL, see the RHEL prerequisites below.

To install the RPM, run the following:

sudo yum -y install container-selinux

RHEL prerequisites

Before you install the RPM on RHEL, verify the following:

  • You must have a valid RedHat subscription
  • RHEL has the container-selinux package installed: yum list container-selinux
  • Verify the list of your yum repositories: yum repolist all

  • container-selinux is available on RHEL through a separate repo (which must be enabled)

    • RHEL 7.x: subscription-manager repos --enable=rhel-7-server-extras-rpms
    • RHEL 8.x: subscription-manager repos --enable=rhel-8-server-extras-rpms
    • RHEL 9.x: subscription-manager repos --enable=rhel-9-server-extras-rpms

    NOTE

    RHEL 8.x and 9.x cloud-based RHEL VMs commonly utilize a different repository for delivering this package:

    • RHEL 8.x: rhel-8-appstream-rhui-rpms
    • RHEL 9.x: rhel-9-appstream-rhui-rpms

    For additional information, visit RedHat's documentation.

Sudo secure_path settings that prevent running sudo kubectl on RHEL, Oracle and Rocky Linux

By default, you will not be able to run sudo kubectl after installing VSatellite on RHEL, Oracle and Rocky Linux. This is because vsatctl install installs k3s and kubectl in /usr/local/bin, which is not included in the secure_path line of /etc/sudoers.

Generally, you should not need to use kubectl to interact with the VSatellite cluster, but on rare occasions Venafi support engineers may ask you to run a kubectl command. If you installed VSatellite on RHEL, Oracle or Rocky Linux, you can work around the secure_path problem by:

  • Running sudo /usr/local/bin/kubectl.
  • Running sudo -s to get a root shell and then running kubectl.
  • Modifying the secure_path line in /etc/sudoers to include /usr/local/bin.