Red Hat Summit Red Hat SummitSupportConsoleDevelopersStart a trialContact

Managing system content and patch updates on RHEL systems

Red Hat Lightspeed 1-latest

How to review applicable advisories and affected systems, manage system content, and remediate issues

Red Hat Customer Content Services

Abstract

This document demonstrates how to review applicable advisories and affected systems in your environment, manage system content and updates, and perform remediation using Ansible playbooks.

Chapter 1. Content patching overview
Copy link

Patching leverages Red Hat software and management automation expertise to enable consistent patch workflows for Red Hat Enterprise Linux (RHEL) systems across the open hybrid cloud. It provides a single canonical view of applicable advisories across all of your deployments, whether they be Red Hat Satellite, hosted Red Hat Subscription Management (RHSM), or the public cloud.

Use content patching in Red Hat Lightspeed to

  • see all of the applicable Red Hat and Extra Packages for Enterprise Linux (EPEL) advisories for your RHEL systems checking into Red Hat Lightspeed.
  • patch any system with one or more advisories by using remediation plans.
  • see package updates available for Red Hat and non-Red Hat repositories as of the last system checkin. Your host must be running Red Hat Enterprise Linux (RHEL) 7, RHEL 8.6+ or RHEL 9 and it must maintain a fresh yum/dnf cache.
Note

1.1. Criteria for patch and vulnerability errata
Copy link

The content patching function collects a variety of data to create meaningful and actionable errata for your systems. The insights-client collects the following data on each checkin:

  • List of installed packages, including name, epoch, version, release, and architecture (NEVRA)
  • List of enabled modules (RHEL 8 and later)
  • List of enabled repositories
  • Output of yum updateinfo -C or dnf updateinfo -C
  • Release version from systems with a version lock
  • System architecture (eg. x86_64)

Additionally, Red Hat Lightspeed collects metadata from the following data sources:

  • Product repositories delivered by the Red Hat Content Delivery Network (CDN)
  • Extra Packages for Enterprise Linux (EPEL) repositories
  • Common Security Advisory Framework (CSAF)
  • Vulnerability Exploitability eXchange (VEX)

Red Hat Lightspeed compares the set of system data to the collected errata and vulnerability metadata in order to generate a set of available updates for each system. These updates include package updates, Red Hat errata, and Common Vulnerabilities and Exposures (CVEs).

Important

Unlike the patch service, the vulnerability service supports only official Red Hat source repositories and does not support custom repositories. Red Hat Lightspeed vulnerability can find CVEs in local mirrors of official Red Hat repositories, but only if the original Red Hat designated name is preserved. If your infrastructure uses custom or renamed Red Hat local mirror repositories, CVEs or errata from those sources will not appear in the Red Hat Lightspeed vulnerability results.

Additional resources

For more information about Common Vulnerabilities and Exposures (CVEs), refer to the following resources:

You can see all of the applicable advisories and installed packages for systems checking into Red Hat Lightspeed.

Procedure

  1. On Red Hat Hybrid Cloud Console, navigate to Content > Advisories.

  2. You can also search for advisories by name using the search box, and filter advisories by:

    1. Type - Security, Bugfix, Enhancement, Unknown
    2. Publish date - Last 7 days, 30 days, 90 days, Last year, or More than 1 year ago
  3. Navigate to Content > Systems to see a list of affected systems you can patch with applicable advisories. You can also search for specific systems using the search box.
  4. Navigate to Content > Packages to see a list of packages with updates available in your environment. You can also search for specific packages using the search box.

The following steps demonstrate the patching workflow from the Content > Advisories page in Red Hat Lightspeed:

Procedure

  1. On Red Hat Hybrid Cloud Console, navigate to Content > Advisories.
  2. Click the advisory you want to apply to affected systems. You will see a description of the advisory, a link to view packages and errata at access.redhat.com, and a list of affected systems. The total number of applicable advisories of each type (Security, Bugfix, Enhancement) against each system are also displayed. As a bulk operation, you can click the options menu located next to a system, then click Apply all applicable advisories to patch the system with all applicable advisories at once.
  3. Alternatively, select the system(s) you want to patch with this particular advisory, then click Plan remediation.
  4. On the Remediate with Ansible page, you can choose to modify an existing Playbook or create a new one to remediate with Ansible. Accordingly, select Existing Playbook and the playbook name from the drop-down list, then click Next. Or, select Create new Playbook and enter a name for your playbook, then click Next.
  5. You will then see a summary of the action and resolution. If a reboot is required to fix the issue or risk, each system will be automatically rebooted. To disable automatic reboot, toggle the Auto-reboot button on the review summary panel.
  6. Click Submit.
  7. On the left navigation, click on Remediations.
  8. Click on the playbook name to see the playbook details, or simply select and click Download playbook.

The following steps demonstrate the patching workflow from the Content > Systems page:

  1. Click the Systems tab to see a list of affected systems. As a bulk operation, you can click the options menu located next to a system, then click Apply all applicable advisories to patch the system with all applicable advisories at once.
  2. Alternatively, click the system you want to patch. You will see the system details and a list of applicable advisories for remediation, along with additional details such as the advisory publish date, type, and synopsis. Select the advisories you want to apply to the system, then click Plan remediation.
  3. On the Remediate with Ansible page, you can either modify an existing Playbook or create a new one to remediate with Ansible. Accordingly, click Existing Playbook and select the playbook name from the drop-down list, then click Next. Or, click Create new Playbook, enter a name for your playbook, then click Next.

  4. You will then see a summary of the action and resolution.

    Note

    If a reboot is required to fix the issue or risk, all systems in the remediation plan will be automatically rebooted. If you prefer to reboot manually after the plan has been executed, toggle the Auto-reboot button accordingly.

  5. On the left navigation, click Automation Toolkit > Remediation Plans.

  6. Click on the playbook name to see the playbook details, or simply select and click Download playbook.

    Important

    Review and test the recommended actions and playbooks that are available before you deploy on your Red Hat Enterprise Linux systems. Red Hat is not responsible for any adverse outcomes related to Red Hat Lightspeed recommendations or remediation plans.

Red Hat Lightspeed calculates applicable updates based on the packages, repositories, and modules that a system reports when it checks in. Red Hat Lightspeed combines these results with a client-side evaluation, and stores the resulting superset of updates as applicable updates.

A system check-in to Red Hat Lightspeed includes the following content-related data:

  • Installed packages
  • Enabled repositories
  • Enabled modules
  • List of updates, which the client determines using the dnf updateinfo -C command. This command primarily captures package updates for non-Red Hat repositories

Red Hat Lightspeed uses this collection of data to calculate applicable updates for the system.

Sometimes Red Hat Lightspeed calculates applicable updates for systems managed by Red Hat Satellite and reports inaccurate results. This issue can manifest in two ways:

  • Red Hat Lightspeed shows installable updates that cannot be installed on the Satellite-managed system.
  • Red Hat Lightspeed shows applicable updates that match what can be installed on the system immediately after patching, but shows outdated or missing updates a day or two later. This can occur when the system is subscribed to RHEL repositories that have been renamed.

Red Hat Lightspeed now provides an optional check-in command to provide accurate reporting for applicable updates on Satellite-managed systems. This option rebuilds the yum/dnf package caches and creates a refreshed list of applicable updates for the system.

Note

Satellite-managed systems are not eligible to have Red Hat Lightspeed content templates applied.

Prerequisites

  • Admin-level access to the system

Procedure

  • To rebuild the package caches from the command line, enter the following command: 

    # insights-client --build-packagecache

The command regenerates the dnf/yum caches and collects the relevant installable errata from Satellite. The insights-client then generates a refreshed list of updates and sends it to Red Hat Lightspeed.

Note

The generated list of updates is equivalent to the output from the command dnf updateinfo list.

You can edit the insights-client configuration file on your system (/etc/insights-client/insights-client.conf) to rebuild the package caches automatically each time the system checks in to Red Hat Lightspeed.

Procedure

  1. Open the /etc/insights-client/insights-client.conf file in a text editor.

  2. Look in the file for the following comment: 

    #Set build_packagecache=True to refresh the yum/dnf cache during the insights-client check-in

  3. Add the following line after the comment: 

    build_packagecache=True
  4. Save your edits and exit the editor.

When the system next checks in to Satellite, insights-client executes a yum/dnf cache refresh before collecting the output of the client-side evaluation. Red Hat Lightspeed then reports the client-side evaluation output as installable updates. The evaluation output, based on what has been published to the CDN, is reported as applicable updates.

Additional resources

1.5. Enabling notifications and integrations
Copy link

You can enable the notifications service on Red Hat Hybrid Cloud Console to send notifications whenever the patch service detects an issue and generates an advisory. Using the notifications service frees you from having to continually check the Red Hat Lightspeed dashboard for advisories.

For example, you can configure the notifications service to automatically send an email message whenever the patch service generates an advisory.

Notifications for Red Hat Lightspeed services are triggered based on service-specific criteria.

Important

For the patch service, the notification service generates notifications only about updates for the registered Red Hat Enterprise Linux systems. To receive notifications about all updates for every subscription that you have, configure the notifications service for errata events.

Enabling the notifications service requires three main steps:

  • First, an Organization Administrator creates a User Access group that includes at least the Notifications administrator or the RHEL administrator role, and then adds account members to the group.
  • Next, a user with the correct notifications administrator role permissions sets up behavior groups for events in the notifications service. Behavior groups specify the delivery method for each notification. For example, a behavior group can specify whether email notifications are sent to all users or just to Organization Administrators.
  • Finally, users who receive email notifications from events must set their user preferences to receive individual emails for each event.

In addition to sending email messages, you can configure the notifications service to send event data in other ways:

  • Using an authenticated client to query Red Hat Lightspeed APIs for event data
  • Using webhooks to send events to third-party applications that accept inbound requests
  • Integrating notifications with applications such as Splunk to route patch advisories to the application dashboard

In addition to sending email messages, you can configure the notifications service to send event data using an authenticated client to query Red Hat Lightspeed APIs.

Manage user permissions to control access to Red Hat Lightspeed applications. Use the User Access feature to apply role-based access control (RBAC). Red Hat provides predefined groups and a set of predefined roles to make it easier for Organization Administrators to assign, restrict, and remove user permissions to Red Hat Lightspeed.

1.6.1. User Access overview
Copy link

Understand how the role-based access control (RBAC) User Access feature of the Red Hat Hybrid Cloud Console manages user permissions through roles instead of individual user assignments. User Access simplifies permission management by assigning specific permissions to roles, which can then be assigned to user groups.

You can also create custom groups and roles to provide more fine-tuned control over specific features of Red Hat Lightspeed to suit the needs of your organization.

If you are an Organization Administrator, you can use the User Access feature under Identity & Access Management in the Hybrid Cloud Console to:

  • Control user permissions and organize roles.
  • Create groups that include roles and their corresponding permissions.
  • Assign users to these groups, allowing them to inherit the permissions associated with their group’s roles.

1.6.2. Predefined groups in User Access
Copy link

Understand the two predefined groups available in User Access: Default access and Default admin access. Create custom groups to align permissions with specific personas, job functions, or teams in your organization.

The Default access group
By default, the Default access group is assigned many granular predefined roles, such as Remediations viewer and Inventory Hosts viewer, so that group members have basic visibility. Because all users in your organization are members of the Default access group, they inherit all permissions assigned to that group. The Default access group is automatically updated by Red Hat.
Important

If your Organization Administrator modifies the Default access group, for example, by removing roles to restrict access to specific applications or to use the consolidated roles, the group is automatically renamed to Custom default access. Once converted, this group is no longer automatically updated by Red Hat.

The Default admin access group
The Default admin access group contains only users who have Organization Administrator permissions. This group is automatically maintained, and users and roles in this group cannot be changed.

The Default admin access group includes many (but not all) predefined roles that provide update and delete permissions. The roles in this group usually include administrator in their names.

1.6.3. Predefined roles assigned to groups
Copy link

Understand how predefined roles in Red Hat Hybrid Cloud Console bundle permissions across multiple Red Hat Lightspeed applications to align with common user personas. Use predefined roles to reduce administrative effort, or create custom roles for more fine-tuned control over specific features.

The predefined roles are a starting point to help you to control and manage user permissions. You can then use these roles to create custom roles that are tailored to your specific use cases and organization. For example, you can use the predefined granular roles to create custom roles that provide more fine-tuned control over specific features of Red Hat Lightspeed.

By default, Red Hat provides a set of consolidated roles and a set of granular roles in the Red Hat Hybrid Cloud Console User Access UI. The consolidated roles significantly reduce the administrative effort required to manage user permissions, while the granular roles provide more fine-tuned control over specific features of Red Hat Lightspeed.

You can use the predefined consolidated and granular roles in User Access simultaneously, but using consolidated roles can significantly reduce the administrative effort.

Select from the predefined consolidated roles library

The Red Hat Hybrid Cloud Console provides three predefined, consolidated User Access roles to help you manage user permissions to Red Hat Lightspeed applications and services that run on registered Red Hat Enterprise Linux systems. These roles help simplify how the Organization Administrator creates groups and permissions for various levels of access to the Red Hat Lightspeed services. If you want to reduce the administrative effort required to manage user permissions and your use case aligns with the permissions included in these roles, select from the consolidated roles library.

The consolidated roles are as follows:

RHEL viewer: The RHEL viewer role provides users visibility without the ability to make changes. It allows read-only access to Red Hat Lightspeed. You can view system configurations, compliance reports, inventory data, patch information, vulnerabilities, and overall resource states and activities. The only action permitted with this role is to generate activation keys.

RHEL operator: The RHEL operator role allows active management of your Red Hat Lightspeed environment. With this role, you can edit system configurations, inventory details, policies, and notification/integration settings. The RHEL operator role allows many of the RHEL administrator role functions, but it is restricted from editing compliance policies, content source templates, policies, or tasks. In addition, the RHEL operator role cannot execute remediation plans.

RHEL administrator: The RHEL administrator role provides comprehensive administrative privileges across your RHEL systems and Red Hat Lightspeed. With this role, you can manage system configurations, inventory, compliance policies, notifications, patch management, remediations, malware detection, and advisor recommendations. The role can also view and modify all vulnerability settings.

Important

To use the consolidated roles effectively, you might need to remove the granular RHEL roles from the Default access group to prevent permission conflicts. This action automatically changes the name of the predefined Default access group to Custom default access group, after which, it is no longer automatically updated by Red Hat.

See Predefined User Access roles for a list of the roles included in the Default admin access group and a reference table that lists most of the predefined groups and roles that are available in the Red Hat Hybrid Cloud Console and the permissions included in each role.

Granular roles
The granular roles are specific roles for individual services that allow for fine-tuned control over specific features of Red Hat Lightspeed, for example, Inventory Hosts administrator or Compliance viewer. If you want to have more control over specific features of Red Hat Lightspeed and your use case does not align with the permissions included in the consolidated roles, use the granular predefined roles.
Tip

Across the Red Hat Lightspeed product documentation, the Prerequisites section for each procedure lists which predefined roles provide the permissions needed to use the features in that procedure. For example, if a procedure requires permissions to view and manage remediations, the Prerequisites section for that procedure lists the Remediations administrator or other valid role as a recommended predefined role to use for that procedure.

1.6.4. Check your permissions
Copy link

Verify your current permissions and the roles or groups assigned to you in the Red Hat Hybrid Cloud Console. Check your permissions to troubleshoot access issues or understand your level of access to Red Hat Lightspeed applications.

Note

Only users with the Organization Administrator role can view the permissions of other users in the User Access settings and manage user permissions to Red Hat Lightspeed services. For more information, see the Configure user permissions section.

Prerequisites

  • You are logged in to the Red Hat Hybrid Cloud Console.

Procedure

  1. In the Hybrid Cloud Console, click the Settings icon (⚙), then navigate to My User Access.
  2. Optional: If you require additional permissions, use the Red Hat Hybrid Cloud Console Virtual Assistant to ask "Contact my Organization Administrator". The assistant sends an email to the Organization Administrator on your behalf.

Results

All of the applications that you have permissions to access are listed on this page and are grouped by product, for example, RHEL, OpenShift Container Platform, and Ansible Automation Platform.

You can also filter your permissions by application, for example, by advisor, cost management, inventory, and remediations.

1.6.5. Configure user permissions
Copy link

If you are an Organization Administrator, you can view and manage user permissions for all users in your organization. Control access to Red Hat Lightspeed and other Red Hat Hybrid Cloud Console services through the User Access interface.

Important

If you are not an Organization Administrator, you will be unable to complete this task. However, you can check your own permissions for different applications by navigating to My User Access. Contact your Organization Administrator to request more permissions.

Prerequisites

  • You have logged in to the Red Hat Hybrid Cloud Console as an Organization Administrator, or you have the required administrator User Access role permissions.

Procedure

Results

From here, you can create and manage:

  • Roles to determine permissions to Red Hat Lightspeed services and features
  • Groups to include one or more roles to align with a specific persona, job function, or team in your organization
  • Users and their assignment to groups to inherit permissions from the roles assigned to those groups

Understand the predefined roles that control access to content templates and patch features in Red Hat Lightspeed. Use these role definitions to assign appropriate permissions to users based on their responsibilities.

The following roles enable standard or enhanced access to the content template and patch features:

Expand
Table 1.1. Permissions provided by the User Access roles
User Access roleGrants permissions to …​Included in the Default access group

Content Template administrator

  • Do any available Do any available operations on any content template or patch resource.
 

Content Template viewer

  • Read any content template or patch resource.

X

RHEL administrator

  • Do everything that a RHEL operator can do.
  • Administer RHEL system configs, inventory, compliance, notifications, patch management, execute remediation plans, malware detection, and advisor.
  • View and modify vulnerability settings.
 

RHEL operator

  • Do everything that a RHEL viewer can do.
  • Edit system configs, inventory, policies, notifications, and integrations.
  • View compliance reports, patch info, malware detections, and recommendations.
  • Create remediation plans, manage stale data, and change vulnerability settings.
Note

The RHEL operator role is restricted from editing compliance policies, content source templates, policies, or tasks. Also, the RHEL operator role cannot execute remediation plans.

 

RHEL viewer

  • Read all available data across Red Hat Lightspeed services and features.

    • View system configs, compliance reports, inventory data, patch info, vulnerabilities, and more to observe the state of resources or activities.
Note

Cannot perform actions other than generating activation keys.

 

Content templates filter the errata that can be applied to registered systems in the Hybrid Cloud Console. They also provide filtering and control on the systems themselves. In addition, you can use the same set of content to build custom images in Red Hat Lightspeed.

Content templates include product and architecture attributes. These attributes, plus a date that you select, create a defined set of packages and errata that you can use to build images, report on patching status, and control the content delivered to your registered systems. All content templates include base RHEL repositories, and you can choose to include additional Red Hat and custom repositories.

2.1. About repository snapshots
Copy link

Repository snapshots capture the state of your repository at a point in time. Repositories are collections of Red Hat Package Manager files (RPMs) and metadata.

A content template consists of a set of repository snapshots that have the same version of Red Hat Enterprise Linux and the same system architecture. You select the snapshots to ensure that your systems have access only to specific package versions. Using the content templates, you can establish date-based patch baselines for your systems, and then use yum or dnf to perform updates to the systems.

2.2. About snapshots
Copy link

Snapshots are daily reference copies of the state of your repository at specified points in time. Red Hat Lightspeed takes snapshots of the common RHEL repositories as well as your custom repositories.

You can view the list of snapshots for the repositories that you select, as well as the changes that occur in time between one snapshot and the next. For example, you can see when new packages have been added between snapshots.

2.3. About content templates
Copy link

A content template consists of an explicit set of packages and errata that can be installed or updated on any associated system. It contains a set of repository snapshots that have the same RHEL product/version, system architecture, and template creation date.

When you associate a system with a content template, Red Hat Lightspeed overwrites the repository definitions on the system to point to the repository snapshots in the template. These are the same repository snapshots that appear on the Repositories page in the Hybrid Cloud Console. Once you associate a system with a content template, any yum or dnf commands that you run on that system are constrained to the updates included in those repository snapshots. For more information about the Repositories page, see Managing repositories to build your customized operating systems.

For example, you can create or edit a content template to contain only snapshots of Red Hat Enterprise Linux 9 for x86_64 repositories. You can use that content template to apply consistent patches to other systems in your inventory that match the product/version and architecture. Once you associate a content template with a set of systems, you can run dnf at the command line to easily perform consistent updates to all systems associated with that template.

Systems in your inventory that are not associated with that template do not receive the update packages and errata.

Systems that you can associate with a content template must meet the following criteria:

  • Must run RHEL 8 or later. The RHEL version must match the version specified in the template.
  • Registered with Red Hat Lightspeed, but not managed by Red Hat Satellite or Red Hat Update Infrastructure (RHUI).
  • Must have a system architecture that matches that specified in the template.

  • Must not have a release version set. To ensure that the release version is not set, run the following command as root: 

    subscription-manager release --unset

2.4. Patching RHEL systems with content templates
Copy link

Content templates help you to apply consistent updates to all the Red Hat Enterprise Linux systems assigned to the same template. This approach separates content management from remediation and allows for more flexibility in patching. You can even use automation tools, such as Red Hat Ansible Automation Platform, to perform patching operations for you.

To use content templates, you must be logged in to the Red Hat Hybrid Cloud Console as the Organization Administrator or a member of a User Access group with at least one of the following role assignments: * RHEL administrator * Repositories administrator (read, write, upload) and Content Template administrator (read repositories, read and write templates)

To view your permissions, navigate to your profile > My User Access > Users. Click your account name. The list of groups for which you have permission displays.

To see the permissions you have within a group, click the group name. The group page displays and shows the types of permissions available (for example, read and write).

For more information about administrator permissions, refer to Predefined User Access roles in the User Access configuration guide for role-based access control (RBAC)

2.4.1. How patching works with content templates
Copy link

The workflow for patching with content templates follows these steps:

  1. You create the content template in Red Hat Lightspeed. The template includes the RHEL version, system architecture, template creation date, and other criteria. Systems that use the content template must match these criteria.
  2. You associate systems with the template. The template points the repositories to snapshots for system updates. Note that the systems can only receive updates through the content template after you associate them.
  3. When a system checks in to Red Hat Lightspeed, it can discover installable updates. The updates match the criteria in the content template. All systems that are associated with the template discover the same updates. This ensures that all the systems using the template receive consistent updates.
Note

A system can be associated to only one content template at a time.

2.5. Managing content templates
Copy link

A content template is a set of repository snapshots you have selected to ensure your systems only have access to specific package versions. Using the content templates, you can establish date-based patch baselines for your systems and perform updates of your systems using yum or dnf.

2.5.1. Creating a content template
Copy link

You can create a content template to ensure your system retains access to specific package versions.

Important

Content templates currently support only major RHEL versions (RHEL 8, 9, or 10). When you create or edit a content template, select a major RHEL version from the drop-down menu for OS Version. Extended support (EUS) subscriptions can show minor RHEL versions in the drop-down menu. However, content templates do not support minor RHEL versions at this time.

Prerequisites

  • You are logged in to the Red Hat Hybrid Cloud Console as the Organization Administrator or a user who is a member of a User Access group with at least one of the following role assignments:

    • RHEL administrator
    • Repositories administrator (read, write, upload) and Content Template administrator (read repositories, read and write templates)
  • The custom repositories that you want to include in the template have snapshots.

Procedure

  1. On the Red Hat Hybrid Cloud Console, navigate to Content → Templates.
  2. Click Create template. The Create content template wizard opens.

  3. In the Content section complete the following:

    1. On the Define content page, select the architecture and the major OS version of your system. Click Next.
    2. On the Red Hat repositories page, select repositories you want to include in the template. Click Next.

    3. On the Custom Repositories page, select repositories you want to include in the template. Click Next.

      Note

      Only repositories with enabled snapshot functionality are displayed in the list of repositories.

  4. On the Set snapshot date page, select:

    Use latest content
    To use the latest content from the repository during image building. Click Next.
    Use a snapshot

    To use a repository snapshot. Select the date and then click Next.

    Note

    If your repository does not have the required snapshot, it chooses the earliest possible snapshot to the date of your choice.

  5. On the Detail page, provide a name for your template. Optionally, provide a description of your template. Click Next.

  6. On the Review page, verify the details about the template and click Create template and add to systems. The Assign template to systems wizard opens.

    Optional: Click Create template only if you want to assign this template to systems later.

  7. In the Assignment method, select Via system list, and select all the systems you want to assign the template to. Click Save.

    This change updates the /etc/yum.repos.d/redhat.repo file on the selected systems. All changes affect your systems every four hours. If you want this change to affect your systems immediately, you must manually refresh subscription-manager on the selected system: 

    # subscription-manager refresh

    If you choose a different assigning method, follow the commands that each method provides on the systems you want to assign the template to.

Verification

  1. Go to Services → Red Hat Enterprise Linux → Content → Templates and verify your template is added to the list of templates.
  2. On your system, check that the /etc/yum.repos.d/redhat.repo file contains https://cert.console.redhat.com.

2.5.2. Editing a content template
Copy link

You can modify the snapshot date for your content template, assign your content template to more systems, and delete your content template.

Important

Content templates currently support only major RHEL versions (RHEL 8, 9, or 10). When you create or edit a content template, select a major RHEL version from the drop-down menu for OS Version. Extended support (EUS) subscriptions can show minor RHEL versions in the drop-down menu. However, content templates do not support minor RHEL versions at this time.

Prerequisites

  • You are logged in to the Red Hat Hybrid Cloud Console as the Organization Administrator or a user who is a member of a User Access group with at least one of the following role assignments:

    • RHEL administrator
    • Repositories administrator (read, write, upload) and Content Template administrator (read repositories, read and write templates)
  • The custom repositories that you want to include in the template have snapshots.

Procedure

  1. On the Red Hat Hybrid Cloud Console, navigate to Content → Templates.

  2. Select the content template you want to edit and choose an action from the following options:

    • To edit repositories, snapshot date, and the name of your content template, go to Actions → Edit and follow the Edit content template wizard.

      Note

      If you edit a snapshot date for the template, it sets a new baseline for patching, and the systems start using the new snapshot.

    • To assign this template to more systems, go to Services → Red Hat Enterprise Linux → Content → Templates, open the template you want to assign to more systems, click Assign template to systems, and select the systems you want to assign this template to. Click Save.

      Note

      If you do not have systems to which you can apply your template, you can click Register and assign via API, and follow the commands the console provides.

    • To delete the content template, go to Actions → Delete.

Procedure

  1. Navigate to Content > Templates and select a content template from the list. The information page for the template displays.
  2. Select Advisories under the Content tab. The list contains all advisories that apply to systems associated with that content template.
  3. Optional: To filter advisories, select the criterion you want to use from the drop-down menu (Name/Synopsis, Type, or Severity), and then use the second drop-down to select the filter. For example, you can view advisories by severity, and then filter the list to show only the Critical and Important advisories.

2.7. Installing updates
Copy link

Content templates help you to apply consistent updates to all the systems assigned to the same template. This approach separates content management from remediation, and allows for more flexibility in patching. You can even use automation tools, such as Ansible Automation Platform, to perform patching operations for you.

Note

RHEL 8 supports both the dnf and yum update commands. RHEL 9 and later support only dnf for updates.

Prerequisites

  • You have root access to the system (or systems) that you want to update.
  • You have set up your repositories and snapshots.
  • You have created content templates and assigned systems to them.
  • Updates are available for systems associated with the content template.

Procedure

  1. At the command line, type dnf update. 

    # dnf update

    This installs the updates to the system. The system receives only the updates associated with the content template. For example, if your content template has systems running RHEL 9, then the updates install only on RHEL 9 systems. Systems in your inventory that have different operating system versions or system architectures remain unaffected.

  2. Repeat the update on each of the other systems associated with the same content template.

Providing feedback on Red Hat documentation
Copy link

Provide feedback on Red Hat documentation to report issues or request enhancements. Submit detailed feedback through the Red Hat Customer Portal to help improve documentation quality.

Prerequisites

  • You are logged in to the Red Hat Customer Portal.

Procedure

  1. Click the following link: Create Issue
  2. Describe the issue or enhancement in the Summary text box.
  3. Provide details about the issue or requested enhancement in the Description text box.
  4. Type your name in the Reporter text box.
  5. Click the Create button.

Results

This action creates a documentation ticket and routes it to the appropriate documentation team. Thank you for taking the time to give feedback.

Legal Notice
Copy link

Copyright © Red Hat.
Except as otherwise noted below, the text of and illustrations in this documentation are licensed by Red Hat under the Creative Commons Attribution–Share Alike 3.0 Unported license . If you distribute this document or an adaptation of it, you must provide the URL for the original version.
Red Hat, as the licensor of this document, waives the right to enforce, and agrees not to assert, Section 4d of CC-BY-SA to the fullest extent permitted by applicable law.
Red Hat, the Red Hat logo, JBoss, Hibernate, and RHCE are trademarks or registered trademarks of Red Hat, LLC. or its subsidiaries in the United States and other countries.
Linux® is the registered trademark of Linus Torvalds in the United States and other countries.
XFS is a trademark or registered trademark of Hewlett Packard Enterprise Development LP or its subsidiaries in the United States and other countries.
The OpenStack® Word Mark and OpenStack logo are trademarks or registered trademarks of the Linux Foundation, used under license.
All other trademarks are the property of their respective owners.
Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Theme

© 2026 Red HatBack to top