Red Hat Summit Red Hat SummitSupportConsoleDevelopersStart a trialContact

Chapter 9. Deployment path for Red Hat Satellite

During installation and initial configuration of Satellite, you can customize your deployment to fit your specific needs and operational environment. By customizing each stage of the deployment process, you can choose deployment options that meet the requirements of your organization.

9.1. Installing a Satellite Server
Copy link

Installing an instance of Satellite Server on a dedicated server is the first step to a working Satellite infrastructure. You can install a Satellite Server in a connected or disconnected setup:

  • Connected deployment is suitable for networked environments where your Satellite Server is connected to the Red Hat CDN.
  • Disconnected deployment is suitable for high-security environments where direct Internet access is restricted or prohibited.

A disconnected Satellite Server is isolated from Red Hat CDN but you can still provision systems with the latest security updates, errata, packages, and other content. You can use the following methods to import content to a disconnected Satellite Server:

Content ISO

In this setup, you download ISO images with content from the Red Hat Customer Portal and extract them to Satellite Server or a local web server. The content on Satellite Server is then synchronized locally.

This allows for complete network isolation of Satellite Server, however, the release frequency of content ISO images is around six weeks and not all product content is included.

Disconnected Satellite with Inter-Satellite Synchronization

In this setup, you install a connected Satellite Server and export content from it to populate a disconnected Satellite using a storage device.

This allows for exporting both Red Hat provided and custom content at the frequency you choose, but requires deploying an additional server with a separate subscription.

Additional resources

Running the satellite-installer command, used to install a Satellite Server, also installs PostgreSQL databases on the server. However, you can configure your Satellite Server to use external databases instead. Moving to external databases distributes the workload and can reduce overall Satellite memory usage.

Note

Red Hat does not provide support or tools for external database maintenance. If you deploy Satellite with external databases, you will need to support and maintain the external databases yourself.

Consider using external databases if you plan to use your Satellite deployment for the following scenarios:

  • Frequent remote execution tasks. This requires a high volume of records in PostgreSQL and generates heavy database workloads.
  • High disk I/O workloads from frequent repository synchronization or content view publishing. This requires Satellite to create a record in PostgreSQL for each job.
  • High volume of hosts.
  • High volume of synchronized content.

Additional resources

Red Hat Satellite includes native support for authentication with a username and password. If you require additional methods of authentication, configure your Satellite Server to use an external authentication source.

Expand
Table 9.1. External authentication sources supported by Satellite and the authentication features they provide
 Username and passwordSingle sign-on (SSO)One-time password (OTP)Time-based one-time password (TOTP)

Active Directory (direct integration)

Yes

Yes

No

No

Identity Management

Yes (Linux and Active Directory users)

Yes (Linux users only)

No

No

Red Hat Single Sign-On

Yes

Yes

Yes

Yes

LDAP

Yes

No

No

No

Additional resources

9.3. Planning organization and location context
Copy link

Context in Satellite consists of organizations and locations. You can associate most resources, for example hosts, subnets, and domains, with at least one organization and location context.

Organizations and locations enable you to arrange Satellite resources into logically structured groups. For example, you can create groups based on ownership, purpose, content, or security level. You can create and manage multiple organizations through Red Hat Satellite, then divide and assign your Red Hat subscriptions to each individual organization.

Organizations

Organizations can represent different business units, departments, or teams, such as Finance, Marketing, or Web Development. Each organization requires a separate Red Hat subscription manifest.

By creating organizations, you can create logical containers to isolate and manage their configurations separately according to their specific requirements.

Locations

Locations can represent physical locations, such as countries or cities.

By creating locations, you can define geographical sites where hosts are located. For example, this is useful in environments with multiple data centers.

You can use locations to map the network infrastructure to prevent incorrect host placement or configuration. While you cannot assign a subnet, domain, or compute resources directly to a Capsule Server, you can assign them to a location.

Unlike organizations, locations can have a hierarchical structure. Resources and users can generally only access resources within their own context, which makes configuring organizations and locations an integral part of access management in Satellite.

Satellite Server defines all locations and organizations. Each Capsule Server synchronizes content and handles configuration of hosts in a different location.

Your Satellite Server retains the management function, while the content and configuration is synchronized between your Satellite Server and Capsule Servers assigned to certain locations.

Important

If you use host groups to bundle provisioning and configuration information, avoid mismatching resources from mutually exclusive contexts. For example, setting a subnet from one organization or location and a compute resource from a different organization or location creates an invalid host group.

Example 9.1. Example of using organizations and locations in Satellite

The structure of a multi-national company includes the Finance, Marketing, and Sales departments. The company operates across United States, United Kingdom, and Japan.

The system administrator creates the following organizations on their Satellite Server:

  • Finance
  • Marketing
  • Sales

Additionally, the administrator creates the following locations on their Satellite Server:

  • United States
  • United Kingdom
  • Japan

The administrator can define a nested location hierarchy to divide the United States location into additional locations based on specific cities:

  • Boston
  • Phoenix
  • San Francisco

Additional resources

9.4. Installing Capsule Servers
Copy link

By installing Capsule Servers, you extend the reach and scalability of your Satellite deployment. Setting up a Capsule Server registers the base operating system on which you are installing to Satellite Server and configures the new Capsule Server to provide the required services within your Satellite deployment.

You can install a Capsule Server in each of your geographic locations. By assigning a Capsule to each location, you decrease the load on Satellite Server, increase redundancy, and reduce bandwidth usage.

Note

The maximum number of Capsule Servers that Satellite Server can support has no fixed limit. It was tested that a Satellite Server can support 17 Capsule Servers with 2 vCPUs.

Decide what services you want to enable on each Capsule Server. You can configure the DNS, DHCP, and TFTP services on one of your Capsule Servers or you can use an external server to provide these services to your Capsule Servers.

Additional resources

  • For information on installing Capsule Servers, including prerequisites and configuring external services, see Installing Capsule Server.
  • For information on tuning performance by using Capsules, see Capsule configuration tuning in Tuning performance of Red Hat Satellite.

9.5. Adding a Red Hat subscription to Satellite
Copy link

A Red Hat subscription manifest is a set of encrypted files that contains your subscription information. Satellite Server uses this information to access the Red Hat CDN and find what repositories are available for the associated subscription.

Warning

Deleting a subscription manifest removes all the subscriptions attached to running hosts and activation keys.

Additional resources

9.6. Defining your content library
Copy link

To ensure that your Satellite Server can manage software and provide it to your hosts, you must create repositories and synchronize them.

Red Hat content

The Red Hat subscription manifest determines what Red Hat repositories your Satellite Server can access. Red Hat content is already organized into products.

For example, Red Hat Enterprise Linux Server is a product in Satellite. The repositories for the Red Hat Enterprise Linux Server product consist of different versions, architectures, and add-ons. When you enable a Red Hat repository, Satellite automatically creates an associated product.

Other sources of content

To distribute content from custom sources, you must create products and repositories manually. You can organize other content into custom products however you want.

For example, you can create an EPEL (Extra Packages for Enterprise Linux) product and add an "EPEL 9 x86_64" repository to it.

Creating repositories allows you to choose the specific software required for your environment. By creating only the necessary repositories, you avoid downloading unnecessary content.

Synchronizing repositories downloads the content from Red Hat CDN or another source to your Satellite Server. The synchronized content is stored on your Satellite Server, eliminating the need for hosts to access the repositories. You can synchronize repositories manually, or you can create a sync plan to ensure synchronization runs on a regular basis.

Additional resources

  • For more information, including procedures for enabling and synchronizing repositories, see Importing content in Managing content.

9.7. Defining content access strategies for hosts
Copy link

When defining your content lifecycle in Satellite, you can use content views and lifecycle environments to define which hosts can access which content and content versions. By default, Satellite includes the Default Organization View content view and the Library lifecycle environment.

Default Organization View
The Default Organization View is the default content view in Satellite that contains all the content that is synchronized to Satellite. After you update your content, such as by adding or removing a repository, the update is immediately reflected in Default Organization View.
Library
The Library lifecycle environment is the default lifecycle environment in Satellite. Every newly published content view version is automatically published to the Library lifecycle environment. You can also promote specific content view versions to the Library lifecycle environment if needed.

In smaller deployments or when you do not require content versioning and environment promotion, you can associate a host to the Library environment under the Default Organization View without configuring additional lifecycle environments.

Additional resources

9.8. Defining role-based access control policies
Copy link

Users in Satellite can have one or more roles assigned. These roles are associated with permissions that enable users to perform specified administrative actions in Satellite. Permission filters define the actions allowed for a certain resource type.

Satellite provides a set of predefined roles with permissions sufficient for standard tasks. You can also configure custom roles.

Note

One of the predefined roles is the Default role. Satellite assigns the Default role to every user in the system. By default, the Default role grants only a limited set of permissions. Be aware that if you add a permission to the Default role, every Satellite users will gain that permission. Assigning a different role to a user does not remove the Default role from the user.

The following types of roles are commonly defined within various Satellite deployments:

Roles related to applications or parts of infrastructure
For example, roles for owners of Red Hat Enterprise Linux as the operating system as opposed to roles for owners of application servers and database servers.
Roles related to a particular stage of the software lifecycle
For example, roles divided among the development, testing, and production phases, where each phase has one or more owners.
Roles related to specific tasks
For example, you can create a role for security managers and a role for license managers, depending on the specific tasks users need to be able to perform within your organization.

Additional resources

  • For more information, including details about creating custom roles and granting permissions to roles, see Managing users and roles in Administering Red Hat Satellite.
  • Define the expected tasks and responsibilities: Define the subset of the Satellite infrastructure that you want the role to access as well as actions permitted on this subset. Think of the responsibilities of the role and how it differs from other roles.
  • Use predefined roles whenever possible: Satellite provides several sample roles that you can use. Copying and editing an existing role can be a good start for creating a custom role.
  • Adopt a granular approach to user role management: Define roles with specific and well-scoped permissions. Note that each user can have multiple roles assigned and that permissions from these roles are cumulative.
  • Add permissions gradually and test the results: When creating a custom role, start with a limited set of permissions and add permissions one by one, while testing continuously. Ensure to test your custom role to verify that it works as intended.
  • Consider areas of interest and granting read-only access: Even though a role has a limited area of responsibility, it might need a wider set of permissions. Therefore, you can grant the role a read-only access to parts of Satellite infrastructure that influence its area of responsibility.

9.9. Configuring provisioning
Copy link

After your basic Satellite infrastructure is in place, you can start configuring provisioning to ensure that Satellite can seamlessly create, configure, and manage hosts.

The process depends on whether you want to provision bare-metal hosts, virtual machines, or cloud instances, but it includes defining installation media, configuring provisioning templates, and other tasks. If you are provisioning virtual machines or cloud instances, you must also integrate your compute provider with Satellite by connecting the provider as a compute resource to Satellite.

The following Satellite features support automating the provisioning of your hosts:

  • Provisioning templates enable you to define the way Satellite installs an operating system on your hosts.
  • The Discovery service enables you to detect unknown hosts and virtual machines on the provisioning network.
  • Host groups enable you to standardize provisioning of host configurations.

Additional resources

9.11. Additional deployment tasks
Copy link

Satellite offers a range of additional capabilities that you can use to further enhance your Satellite deployment. For example:

Remote execution commands on hosts

With remote execution, you can perform various tasks on multiple hosts simultaneously. Satellite supports the following modes of transport for remote execution: pull-based mode (over MQTT/HTTPS) and push-based mode (over SSH).

For more information, see Configuring and setting up remote jobs in Managing hosts.

Automating tasks with a configuration management tool

By integrating Satellite with a configuration management tool, you can automate repetitive tasks and ensure consistent configuration of your hosts.

For more information on using Ansible with Satellite, see Managing configurations by using Ansible integration.

You can use Puppet to configure hosts. For more information on using Puppet with Satellite, see Managing configurations by using Puppet integration.

Security management with OpenSCAP

With OpenSCAP, you can manage compliance policies and run security compliance scans on your hosts. After the scan completes, a compliance report is uploaded to your Satellite Server.

For more information, see Managing security compliance.

Load balancing

With load balancing configured on your Capsule Servers, you can improve performance on Capsule Servers while also improving performance and stability for host connections to Satellite.

For more information, see Configuring Capsules with a load balancer.

Incident management with Red Hat Lightspeed

With Red Hat Lightspeed enabled on your Satellite Server, you can identify key risks to stability, security, and performance.

For more information, see Using Red Hat Insights with Satellite Server in Installing Satellite Server in a connected network environment.

Back to top
Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Theme

© 2025 Red Hat