Red Hat SummitChapter 5. Known issues
This section describes known issues in Red Hat Satellite 6.18.
5.1. Web UI
All Hosts page always links to the new host details UI
The links on the Hosts > All Hosts page always point to the new host details UI, even if the setting New host details UI is set to No.
To work around this problem, display the old host details UI by clicking the vertical ellipsis in the upper right and selecting Legacy UI.
5.2. Installation and upgrade
red-hat-lightspeed-in-satellite not enabled on disconnected Satellite when the Podman Host.NetworkBackend is set as CNI
When the Host.NetworkBackend for Podman is set to CNI on a Satellite Server, satellite-installer fails to enable red-hat-lightspeed-in-satellite. The issue occurs because the Red Hat Enterprise Linux 9.6 ISO provides a version of the container-selinux policy that is earlier than 2.237.0. Later versions are provided with Red Hat Enterprise Linux 9.6.z, which fixes the issue, and is provided with the 9.7 ISO.
To work around this problem, reset the NetworkBackend to netavark by entering the following command:
podman system reset
# podman system reset
This clears the container images, reruns the /media/sat6/setup_containers script and executes the satellite-installer again.
5.3. Red Hat Lightspeed
Red Hat Lightspeed vulnerability CVE map download fails with an HTTP proxy to https://security.access.redhat.com
Satellite servers configured for the Red Hat Lightspeed vulnerability service in Satellite, which is a Technology Preview, fail CVE map downloads if the Satellite server uses an HTTP proxy to reach https://security.access.redhat.com. This issue is caused by the iop-cvemap-download.service service lacking HTTP proxy configuration.
To work around this problem, manually set the HTTPS_PROXY and NO_PROXY environment variables for the iop-cvemap-download service. For more information, see Installing Red Hat Lightspeed in Satellite on a connected Satellite Server.
hammer ping does not list services of Red Hat Lightspeed in Satellite
When Red Hat Lightspeed in Satellite is enabled, the hammer ping command does not display advisor and vulnerability services.
To work around this problem, restart all Satellite services by entering the satellite-maintain service restart command.
”Any location” produces error in Remediations and Vulnerabilities
When the location is set to “Any location”, accessing the Remediations or Vulnerabilities menu produces an error message. As a consequence, you cannot see a global view of all systems in Remediations or Vulnerabilities.
To work around this problem, filter systems by location before accessing Remediations or Vulnerabilities.
Satellite with Red Hat Lightspeed enabled produces errors in Inventory Upload
The Inventory Upload page was moved to the Administer menu for Red Hat Lightspeed, mainly for troubleshooting. As a consequence, some operations are invalid and may produce an error.
To work around this problem, do not use the Sync all inventory status operation.
Jira:SAT-36556[1]
5.4. Security and authentication
Unable to upload an OpenSCAP report from hosts that run RHEL 9.3 or earlier with FIPS mode enabled
On hosts that run RHEL 9.3 or earlier versions with FIPS mode enabled, uploading an OpenSCAP report fails with the following error:
Unable to load certs Neither PUB key nor PRIV key
Unable to load certs
Neither PUB key nor PRIV keyFor more details, see a related Knowledgebase solution. Note that the problem is fixed for hosts that run RHEL 9.4 or later versions.
No known workaround exists.
Some endpoints bypass user authentication and fail to terminate user sessions
API endpoints that call the add_smart_proxy_filters function bypass user authentication. This is due to improper session termination logic introduced in Satellite 6.18. In addition, user sessions remain active beyond the period specified in the idle_timeout setting. This affects the API endpoints related to the following resources:
- Organizations
- Repositories
- Config reports
- Hosts
As a consequence, removed and nonexistent users fail due to missing required permissions and not due to failed authentication. In addition, user sessions are not terminated and can access endpoints without re-authentication.
No known workaround exists.
5.5. Backup and restore
Restoring from backup fails due to inconsistencies in the data
If the backup is generated from a database with inconsistencies, the restore fails. The satellite-maintain tool uses the PostgreSQL amcheck extension to detect inconsistencies in the data before backup to prevent issues during restore.
To work around this problem, reach out to Red Hat support to fix any detected inconsistencies before proceeding with the backup. For more information, see Restoring Red Hat Satellite 6.16+ fails complaining about db duplicates on CREATE UNIQUE INDEX in the Red Hat Knowledgebase.
5.6. Users and roles
Newly created filters do not inherit organizations and locations associated with the role
When an organization and location are defined for a role, these organizations and locations are not propagated to the filters created within the role. Consequently, users with a role assigned can access resources in any other organization or location that they have sufficient permissions to view instead of only organizations and locations defined for the role.
To work around the problem:
- Create your filter.
- Start editing the filter.
- Save the filter without making any changes. This ensures that organizations and locations defined on the role level are propagated to filters correctly.
This known issue does not affect cloned roles. If you clone an existing role and assign organizations and locations to the cloned role, the organizations and locations are propagated to filters correctly.
Note that defining organizations and locations on the filter level is deprecated. See Overriding organizations and locations on the filter level is deprecated.
5.7. IPv6
virt-who is not supported on IPv6-only networks in Satellite
Satellite does not support the virt-who agent in an IPv6-only network.
No known workaround exists.
Additional configuration is required in IPv6-only networks when using kinit for IdM and AD users
If your Satellite Server runs in an IPv6-only network and also runs on RHEL 9.6 and earlier versions, Kerberos authentication for external users from Identity Management (IdM) and Active Directory (AD) fails. This known issue is caused by a bug in the System Security Services Daemon (SSSD) and occurs when the DNS name of the IdM or AD server can be translated to both an IPv4 and IPv6 address but the IPv4 address is not accessible, for example because it is blocked by a firewall.
To work around this problem, configure the lookup_family_order option in the [domain/<domain_name>] in the /etc/sssd/sssd.conf file:
[domain/example.com] lookup_family_order = ipv6_only
[domain/example.com]
lookup_family_order = ipv6_onlyJira:SAT-32530, Jira:SSSD-2511
Mismatch of the IPv6 address entry in Satellite when using a DHCPv6 server
When you use a DHCPv6 server to assign an IP address dynamically and you provision a host in an IPv6 network, Satellite contains an IPv6 address that does not match the actual IPv6 address of the host. This mismatch impairs host management capabilities, such as remote execution.
To work around this problem, perform one of the following steps:
-
Execute
subscription-manager facts --uploadon the host. -
Wait for the next facts upload to resolve the issue. Note that the Ignore interfaces facts for provisioning (
ignore_puppet_facts_for_provisioning) setting can disable updating the interfaces from facts.
Host Discovery fails in an IPv6 network
When you attempt to discover an unknown host in an IPv6 network, the discovery fails with Error: 1001: Failed to open TCP connection to satellite.example.com:443.
No known workaround exists.
Failure to provision hosts in PXE-less Discovery over IPv6
After PXE-less host discovery on an IPv6 Satellite, when the host starts provisioning, it fails to resolve Satellite. As a result, the host fails to fetch Kickstart and the required files.
No known workaround exists.
5.8. Localization and internationalization
Incomplete translation of Satellite UI and CLI
If you are using a supported translation, that is French, Japanese, Korean, or Simplified Chinese, you might see some messages in English.
No known workaround exists.
'%20d='M201.5%20305.5c-13.8%200-24.9-11.1-24.9-24.6%200-13.8%2011.1-24.9%2024.9-24.9%2013.6%200%2024.6%2011.1%2024.6%2024.9%200%2013.6-11.1%2024.6-24.6%2024.6zM504%20256c0%20137-111%20248-248%20248S8%20393%208%20256%20119%208%20256%208s248%20111%20248%20248zm-132.3-41.2c-9.4%200-17.7%203.9-23.8%2010-22.4-15.5-52.6-25.5-86.1-26.6l17.4-78.3%2055.4%2012.5c0%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.3%2024.9-24.9s-11.1-24.9-24.9-24.9c-9.7%200-18%205.8-22.1%2013.8l-61.2-13.6c-3-.8-6.1%201.4-6.9%204.4l-19.1%2086.4c-33.2%201.4-63.1%2011.3-85.5%2026.8-6.1-6.4-14.7-10.2-24.1-10.2-34.9%200-46.3%2046.9-14.4%2062.8-1.1%205-1.7%2010.2-1.7%2015.5%200%2052.6%2059.2%2095.2%20132%2095.2%2073.1%200%20132.3-42.6%20132.3-95.2%200-5.3-.6-10.8-1.9-15.8%2031.3-16%2019.8-62.5-14.9-62.5zM302.8%20331c-18.2%2018.2-76.1%2017.9-93.6%200-2.2-2.2-6.1-2.2-8.3%200-2.5%202.5-2.5%206.4%200%208.6%2022.8%2022.8%2087.3%2022.8%20110.2%200%202.5-2.2%202.5-6.1%200-8.6-2.2-2.2-6.1-2.2-8.3%200zm7.7-75c-13.6%200-24.6%2011.1-24.6%2024.9%200%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.1%2024.9-24.6%200-13.8-11-24.9-24.9-24.9z'/%3e%3c/svg%3e){kind=small}