Release notes

Discovery image updated with RHEL 9.6.0

With this update, the Discovery image is based on Red Hat Enterprise Linux 9.6.0.

Ansible check mode in Ansible job templates

With this update, you can enable Ansible check mode per job, instead of per host, in Ansible job templates. This streamlines workflows, improves flexibility, and reduces manual configuration, allowing validation of changes before application.

Satellite validates snippets in provisioning templates

With this update, a validation check validates all provisioning templates, including all snippets during host build submission. As a result, Satellite validates templates before submission, preventing errors during provisioning.

Satellite server accepts additional key algorithms for ISC DHCP

Satellite uses the Object Management Application Programming Interface (OMAPI) protocol when connecting to ISC DHCP. With this update, you can configure the hash-based message authentication code (HMAC) algorithm used in the connection. As a result, you can use more secure algorithms than before this update, including algorithms that are compatible with the Federal Information Processing Standards (FIPS) if your Satellite server connects to ISC DHCP.

http_proxy encrypts URL credentials

With this update, URL-embedded credentials, for example, https://user:password@proxy.example.com, are automatically encrypted in the http_proxy setting. By preventing the exposure of sensitive authentication information in plain text, this update enhances security and prevents credential exposure while maintaining functionality.

Support for remote execution of package and errata installation on image mode hosts

With this update, you can run existing package and errata installation remote execution jobs on image mode hosts by using the dnf install --transient command instead of running the bootc usr-overlay command manually. In earlier versions, these operations failed because image mode systems restricted write access to certain directories by default.

Red Hat Lightspeed advisor in Satellite is fully supported

Red Hat Lightspeed advisor in Satellite, introduced in Satellite 6.17 as a Technology Preview, is fully supported with this release.

Insights rebranded as Red Hat Lightspeed in the Satellite UI

In the Satellite UI, Red Hat Insights is rebranded to Red Hat Lightspeed in menus, tabs, and action links. This update ensures the UI reflects the current service name.

Minimal data collection for Red Hat Lightspeed

With this update, you can configure Satellite to use minimal data collection when you upload host data to Red Hat Lightspeed.

Obfuscating host names and IP addresses during Red Hat Lightspeed data upload

You can configure Red Hat Satellite to obfuscate host names and IP addresses to prevent sensitive information from being exposed when you upload host data to Red Hat Lightspeed.

Enhanced Red Hat subscription usage tracking and reporting

With this update, you can manage Red Hat subscription manifests more effectively in Satellite. Each organization requires its own subscription allocation, which enables multiple organizations to maintain separate subscriptions. Satellite also supports future-dated subscriptions in a manifest, ensuring uninterrupted access to repositories.

Patternfly designs in the Satellite web UI are modernized

Satellite upgraded its Patternfly 4 designs to Patternfly 5. Additionally, some Patternfly 3 designs are upgraded to Patternfly 5.

Job details page is redesigned

The Job details page is enhanced for improved usability and performance. The web UI displays the new design by default. You can switch to the previous design by clicking Legacy UI on the Job details page.

New Hosts overview page is fully supported

The new Hosts overview page, introduced in Satellite 6.16 as a Technology Preview, is fully supported with this release. The new Hosts overview UI is the default. You can still disable it in Settings or switch to the legacy UI from the local menu.

Dual-stack networks partially supported

With this update, Satellite deployment and operation in dual-stack (IPv4 and IPv6) networks is partially supported. You can register hosts, manage content, and patch your hosts in dual-stack networks. Other features are not yet tested and are not supported with this release.

Satellite web UI links to Red Hat Satellite Upgrade Helper

The new Administer > Satellite Upgrade item in the vertical navigation contains a link to the Red Hat Satellite Upgrade Helper application. You can use Red Hat Satellite Upgrade Helper to obtain upgrade instructions customized for your current version number of Red Hat Satellite. As a result, you receive instructions that are specific to your upgrade path, as well as steps to prevent known issues. For more information, see Red Hat Satellite Upgrade Helper on the Red Hat Customer Portal.

Mosquitto follows the system-wide cryptographic policy

Mosquitto, the service used by the remote execution (REX) pull mode, follows the system-wide cryptographic policy. As a result, you can configure the supported Transport Layer Security (TLS) protocols and ciphers in the system-wide policy and Mosquitto uses them.

Default mirroring policy settings for repositories

With this update, you can set the default mirroring policy for custom repositories in Settings:

Increased efficiency in publication tasks of Yum repositories

This release improves the pulp-rpm plugin to increase the performance of publication tasks of Yum repositories. As a result, you might see a modest speed increase in publication tasks, such as repository synchronization, publication, and promotion.

Rolling content views

With this update, you can create rolling content views in Satellite to provide hosts with a continuous stream of the latest synchronized content from a defined subset of repositories.

Support for consuming Capsule container content from a load-balanced Capsule

With this update, you can consume container content from Capsules that are behind a load balancer. Before this update, this capability was not supported, which created a gap in load-balanced container workflows.

Support for managing Flatpak remotes in Satellite

You can manage Flatpak remotes directly in Satellite. You can create Flatpak remotes to access and manage repositories, scan them to fetch metadata and discover available content, mirror repositories into existing products for synchronization and content management, and view remote details, including the list of provided repositories.

Configure Capsule to distribute Flatpak repositories

With this update, you can configure Capsule Servers to synchronize and distribute Flatpak repositories to managed hosts by using certificate authentication. You can add Capsule as a container registry or a Flatpak remote to a host, authenticate with the registry by using certificates, and install applications such as Mozilla Firefox directly from the synchronized repositories. Lifecycle management of Flatpak and container content is supported only when using certificate authentication.

satellite-usage-metrics-condense.timer to collect usage metrics

This release adds a systemd timer named satellite-usage-metrics-condense.timer that collects condensed usage metrics from Satellite deployments. The resulting report is stored in the /etc/rhsm/facts/foreman.facts file and uploaded as custom Red Hat Subscription Manager facts. You can use the satellite-maintain report condense command to review the list of condensed usage metrics.

Modules from Satellite Ansible Collection support Kerberos authentication

When using Ansible modules from the Satellite Ansible Collection, you can use a Kerberos ticket to connect to the Satellite API. Using a Kerberos ticket is supported for deployments where the Satellite Server is configured to use Identity Management as an external authentication source.

Provisioning hosts improved

The Provisioning hosts guide is reorganized. Major changes include the following:

Improved upgrading and updating documentation

The Upgrading connected Red Hat Satellite to 6.18, Upgrading disconnected Red Hat Satellite to 6.18, and Updating Red Hat Satellite guides are updated. Major changes include removing out-of-date steps and eliminating duplication. These improvements help make the guides shorter and easier to follow during upgrading and updating.

Improved Integrating provisioning infrastructure services

The Integrating provisioning infrastructure services guide is updated. Major changes include optimizing the procedures to make the instructions clearer and up-to-date. These improvements help make the guide better organized and easier to follow.

Improved documentation on using Satellite Ansible Collection

Documentation on using modules from the Satellite Ansible Collection is updated and expanded. Satellite Ansible Collection is a set of Ansible modules that interact with the Satellite API. You can use the modules to automate many aspects of Satellite administration. See the new Using the Satellite Ansible Collection guide.

Red Hat Virtualization compute resource

The Red Hat Virtualization (RHV) compute resource is removed in Satellite 6.18.

All Hosts page always links to the new host details UI

The links on the Hosts > All Hosts page always point to the new host details UI, even if the setting New host details UI is set to No.

red-hat-lightspeed-in-satellite not enabled on disconnected Satellite when the Podman Host.NetworkBackend is set as CNI

When the Host.NetworkBackend for Podman is set to CNI on a Satellite Server, satellite-installer fails to enable red-hat-lightspeed-in-satellite. The issue occurs because the Red Hat Enterprise Linux 9.6 ISO provides a version of the container-selinux policy that is earlier than 2.237.0. Later versions are provided with Red Hat Enterprise Linux 9.6.z, which fixes the issue, and is provided with the 9.7 ISO.

Red Hat Lightspeed vulnerability CVE map download fails with an HTTP proxy to https://security.access.redhat.com

Satellite servers configured for the Red Hat Lightspeed vulnerability service in Satellite, which is a Technology Preview, fail CVE map downloads if the Satellite server uses an HTTP proxy to reach https://security.access.redhat.com. This issue is caused by the iop-cvemap-download.service service lacking HTTP proxy configuration.

hammer ping does not list services of Red Hat Lightspeed in Satellite

When Red Hat Lightspeed in Satellite is enabled, the hammer ping command does not display advisor and vulnerability services.

”Any location” produces error in Remediations and Vulnerabilities

When the location is set to “Any location”, accessing the Remediations or Vulnerabilities menu produces an error message. As a consequence, you cannot see a global view of all systems in Remediations or Vulnerabilities.

Satellite with Red Hat Lightspeed enabled produces errors in Inventory Upload

The Inventory Upload page was moved to the Administer menu for Red Hat Lightspeed, mainly for troubleshooting. As a consequence, some operations are invalid and may produce an error.

Unable to upload an OpenSCAP report from hosts that run RHEL 9.3 or earlier with FIPS mode enabled

On hosts that run RHEL 9.3 or earlier versions with FIPS mode enabled, uploading an OpenSCAP report fails with the following error:

Some endpoints bypass user authentication and fail to terminate user sessions

API endpoints that call the add_smart_proxy_filters function bypass user authentication. This is due to improper session termination logic introduced in Satellite 6.18. In addition, user sessions remain active beyond the period specified in the idle_timeout setting. This affects the API endpoints related to the following resources:

Restoring from backup fails due to inconsistencies in the data

If the backup is generated from a database with inconsistencies, the restore fails. The satellite-maintain tool uses the PostgreSQL amcheck extension to detect inconsistencies in the data before backup to prevent issues during restore.

Newly created filters do not inherit organizations and locations associated with the role

When an organization and location are defined for a role, these organizations and locations are not propagated to the filters created within the role. Consequently, users with a role assigned can access resources in any other organization or location that they have sufficient permissions to view instead of only organizations and locations defined for the role.

virt-who is not supported on IPv6-only networks in Satellite

Satellite does not support the virt-who agent in an IPv6-only network.

Additional configuration is required in IPv6-only networks when using kinit for IdM and AD users

If your Satellite Server runs in an IPv6-only network and also runs on RHEL 9.6 and earlier versions, Kerberos authentication for external users from Identity Management (IdM) and Active Directory (AD) fails. This known issue is caused by a bug in the System Security Services Daemon (SSSD) and occurs when the DNS name of the IdM or AD server can be translated to both an IPv4 and IPv6 address but the IPv4 address is not accessible, for example because it is blocked by a firewall.

Mismatch of the IPv6 address entry in Satellite when using a DHCPv6 server

When you use a DHCPv6 server to assign an IP address dynamically and you provision a host in an IPv6 network, Satellite contains an IPv6 address that does not match the actual IPv6 address of the host. This mismatch impairs host management capabilities, such as remote execution.

Host Discovery fails in an IPv6 network

When you attempt to discover an unknown host in an IPv6 network, the discovery fails with Error: 1001: Failed to open TCP connection to satellite.example.com:443.

Failure to provision hosts in PXE-less Discovery over IPv6

After PXE-less host discovery on an IPv6 Satellite, when the host starts provisioning, it fails to resolve Satellite. As a result, the host fails to fetch Kickstart and the required files.

Incomplete translation of Satellite UI and CLI

If you are using a supported translation, that is French, Japanese, Korean, or Simplified Chinese, you might see some messages in English.

Satellite follows the --foreman-foreman-url option

Before this update, if you executed the satellite-installer command with the --foreman-foreman-url option, the Foreman URL setting was not set. With this fix, the Foreman URL setting is set correctly when passed with the --foreman-foreman-url option. If you configured the Foreman URL setting before this update by using the WebUI, API, or Hammer, you must use the --foreman-foreman-url option when you run satellite-installer to preserve it. Otherwise, it is overwritten by the Foreman URL value from the answers file.

Idle Redis connections are closed after timeout

Before this update, idle Redis connections persisted because the timeout was not set for the Redis service on the Satellite Server. This led to the Pulp content workers not accepting any new connections as the open file limit was reached. Pulp content workers would fail with the Too many open files error resulting in DNF connection timeouts on the client systems. With this release, the default timeout for idle Redis connections is set to 60 seconds, after which the idle connections are closed. This prevents DNF timeouts on client systems due to Pulp reaching the open file limit.

Satellite installer no longer uses local plugins

Before this update, Puppet loaded plugins from the /opt/puppetlabs/puppet/cache/lib/ directory. As a consequence, the Satellite installer used plugins that did not match the rest of the installer modules. This update changes how the installer uses Puppet and no longer loads plugins from /opt/puppetlabs/puppet/cache/lib/. As a result, the installer only uses plugins provided by the installer, and no other plugins that could be present on the system.

Satellite preserves group membership when groupOfUniqueNames is used

Before this update, Satellite did not properly handle the groupOfUniqueNames LDAP attribute. As a consequence, user accounts from groups that were based on the groupOfUniqueNames attribute were removed from these groups upon login. This release adds support for the groupOfUniqueNames attribute. As a result, these users no longer lose group membership when logging in.

Long WebUI footer messages render correctly

Before this update, long footer messages resulted in a white block on the webUI login page. With this release, the footer message length limit is removed, which allows dynamic display. As a result, long footer messages are rendered correctly.

Alternate Content Sources with Capsule refresh content smoothly

Before this update, excessive memory consumption during Alternate Content Source (ACS) usage with Capsule led to Out of memory errors preventing ACS refresh of larger content. With this release, the ACS memory consumption issue is resolved, which allows smooth ACS refreshing of larger content.

Capsule sync does not get stuck

Before this update, wrong aiohttp session timeouts caused Capsule sync failures and incomplete downloads. With this release, the default aiohttp session timeouts are applied in Pulp when user-defined ones are not provided, preventing sync issues and enhancing user experience.

Job Template imports include all assigned organizations and locations

Before this update, some organizations and locations were missing after users imported a Job Template. With this release, when users import a Job Template, all organizations and locations that were assigned to the Job Template are imported correctly.

Lookup of images in Azure Image Gallery

Before this update, a change in the Azure Image Gallery URL format led Satellite to use a wrong URL format for image lookup. Because of this, users could not find images in the Gallery by using the gallery:// schema. Instead, they had to use the full resource URL. With this release, the Azure Image Gallery URL format is updated, and the code is changed to find images by using the new format. As a result, end users can efficiently find images in Azure Image Gallery by using the gallery:// URL schema.

Satellite removes old host keys properly when re-registering hosts

Before this update, Satellite failed to remove old host keys for re-registered hosts. As a consequence, after host re-registration, users were unable to run remote execution jobs due to host key inconsistency. With this release, host key cleanup occurs as expected in this situation. As a result, re-registered hosts no longer fail to connect during remote execution jobs due to old host keys.

Full host boot disks include mmx64.efi

Before this update, full host boot disks did not include the mmx64.efi file, leading to boot failures in specific scenarios. With this release, the boot disks include the mmx64.efi file for certain hardware boot scenarios, ensuring successful booting for users.

Consistent firmware type in compute profiles

Before this update, the Hammer command to display compute profile information failed after a Satellite upgrade. The failure occurred because the firmware type changed from EFI (Extensible Firmware Interface) to UEFI (Unified Extensible Firmware Interface), impacting VMware users. With this release, a fix ensures the consistency of the firmware type in compute profiles after Satellite upgrade. As a result, compute profile information is displayed correctly, which prevents errors in VMware environments.

Virtual TPM no longer fails in image-based provisioning on VMware

Before this update, image-based provisioning conflicted with the Virtual TPM option, causing firmware reset to BIOS and Virtual TPM disabling on hosts. As a consequence, Virtual TPM functionality failed during image-based provisioning on VMware. With this release, Virtual TPM works with image-based provisioning and firmware remains set to UEFI on the host. As a result, users can successfully enable Virtual TPM with image-based provisioning on VMware.

CloudInit default generates valid YAML output when Realm is in use

This update corrects improper indentation in the freeipa_register snippet to ensure valid YAML output. This fix ensures proper cloud-init processing, thereby resolving issues with provisioning.

Error message when discovered hosts are filtered with invalid filter fields

Before this update, when users filtered discovered hosts by using an invalid field, such as hostgroup, the browser produced infinite redirects and failed. This release fixes the infinite redirect issue in discovered hosts for invalid filter fields. As a result, discovered hosts display no hosts and log an error message with a reason.

Deprecated dict replaced with list in Cloudinit default template

Before this update, a cloud-init provisioning failure occurred due to the deprecated dict type in the Cloudinit default template. As a consequence, cloud-init provisioning failed in RHEL 9.6 due to deprecation warnings. With this release, the deprecated dict type in users configuration is replaced with the list type, and this resolves the deprecation warning. As a result, cloud-init provisioning for RHEL 9.6 and later versions is functional.

UEFI hosts redeployed automatically in PXE-boot provisioning

Before this update, redeployment of provisioned hosts could not chainload the boot loader from the hard disk correctly after subsequent PXE reboot. As a consequence, you had to modify UEFI configuration manually to redeploy the system. This release fixes the pxegrub2_chainload snippet so that the GRUB2 configuration includes paths to shimx64.efi files. As a result, you can redeploy hosts automatically.

redhat.satellite.host can update content view and lifecycle environment separately

Before this update, using the redhat.satellite.host Ansible module to update the content view or the lifecycle environment of a host resulted in an error when only one of the two parameters was changed because only changed parameters were sent to the API. With this fix, the content view and lifecycle environment are always provided together to the API. As a result, you can update the content view and lifecycle environment of the host separately.

Satellite validates the Hostname prefix Discovery setting

Before this update, the Hostname prefix (discovery_prefix) input in Satellite settings was insufficiently validated and allowed non-conforming characters. As a consequence, invalid hostnames could cause unexpected system behavior. With this release, Satellite enforces the following format for the Hostname prefix:

Red Hat Lightspeed vulnerability in Satellite (Technology Preview)

You can view and examine Common Vulnerabilities and Exposures (CVE) of hosts provided by Red Hat Lightspeed in Satellite from multiple places in the Satellite web UI:

OpenShift Virtualization plugin (Technology Preview)

You can provision virtual machines by using the OpenShift Virtualization plugin. For more information, see Provisioning hosts.

Kernel execution template (Technology Preview)

You can use the kernel execution (kexec) provisioning template for PXE-less boot methods. For more information, see Discovery in PXE-less mode.

MCP server is available for Satellite (Technology Preview)

Satellite provides a container image that you can use to run a Model Context Protocol (MPC) server locally. The MCP server for Satellite is designed for advanced reporting and data analysis that leverages AI capabilities. You can use it to generate dynamic and comprehensive reports from your Satellite inventory.

Support for Multiple Content View Environments in Hosts and Activation Keys in Hammer CLI (Technology Preview)

Hosts and activation keys support multiple content view environments instead of being limited to a single content view and lifecycle environment. This is done in the Hammer CLI.

New satellite-installer parameters

This release adds the following satellite-installer parameters:

Removed satellite-installer parameters

This release removes the following satellite-installer parameters:

New Hammer commands and subcommands

This release adds the following Hammer commands and subcommands:

New Hammer options

This release adds the following Hammer options:

Removed Hammer commands and subcommands

This release removes the following Hammer commands and subcommands:

Removed Hammer options

This release removes the following Hammer options:

Additional resources

For more information, see Using the Hammer CLI tool or enter the commands with the --help option.

New API endpoints

This release adds the following API endpoints:

Removed API endpoints

This release remoes the following API endpoints:

New Ansible modules

This release adds yhe following Ansible modules:

Removed Ansible modules

This release does not remove any Ansible modules.

New usage metrics

Satellite collects these additional usage metrics:

Additional resources

For more information, see Usage metrics collection in Satellite in Administering Red Hat Satellite.