1. Headline Features

1.1. Removed installer duplicate parameters

Both --foreman-logging-layout and --puppet-server-foreman-url are no longer needed. The logging layout is now derived from the logging type (--foreman-logging-type). The Foreman URL for puppetserver is now read from the Foreman Proxy setting (--foreman-proxy-foreman-base-url). The parameters still exist and can be specified, but the average user shouldn’t need it.

2. Upgrade Warnings

2.1. Foreman Redis caching DB changed to 4

Since Foreman 3.6 Foreman can be easily configured to use Redis for caching (using --foreman-rails-cache-store type:redis). Starting Foreman 3.8 this uses DB 4, instead of DB 0, to avoid potential conflicts with other software.

3. Foreman 3.8.0

A full list of changes is available on Redmine

3.1. Headline Features

3.1.1. Show failed resources in failed installation report

A failed foreman-installer run will capture Puppet reports making it much easier to troubleshoot failures. Users will not have to rely on the installer log anymore, as the failure output should be sufficient.

3.1.2. Removed installer duplicate parameters

Both --foreman-logging-layout and --puppet-server-foreman-url are no longer needed. The logging layout is now derived from the logging type (--foreman-logging-type). The Foreman URL for puppetserver is now read from the Foreman Proxy setting (--foreman-proxy-foreman-base-url). The parameters still exist and can be specified, but the average user shouldn’t need it.

3.2. Foreman

  • Some events are not visible even being triggered - #36796

  • CVE-2022-4130: Blind SSRF via Referer header - #36768

  • Add "last_checkin" attribute to Entitlements Template - #30690

3.2.1. API

  • GraphQL: Incorrect totalCount when querying with first parameter - #36509

  • Unable to access API using non-admin users. - #36449

3.2.2. Audit Log

  • Audit shows N/A for host owner changes - #36522

3.2.3. Development tools

  • Update ansible dev setup guide - #36475

  • Remove storybook - #36439

3.2.4. Host groups

  • 500 error when loading Hostgroups page for Ansible Roles Manager user - #36703

  • Changing OS in hostgroup edit form reset pxe loader even when it is not necessary - #36560

3.2.5. Host registration

  • global registration should not create hosts as "managed" or "to be built" - #36393

3.2.6. Inventory

  • Add PermissionDenied to reports tab in host - #36550

  • show new,delete button for params on host details only if user has permissions - #36549

  • Show disk and partition info of vsphere host - #36518

  • Legacy Hosts UI loaded when you navigate from the Host's VMRC Console button - #36450

  • The Reports link from new host detail page in the kebab menu should be dropped - #36067

3.2.7. JavaScript stack

  • Refactor PermissionDenied component - #36551

  • Update ConfigReports to pf4 - #36400

  • "Scrollbar test exception: TypeError" when loading any page - #36093

3.2.8. Notifications

  • Cache reads from redis raise "incompatible marshal file format" exception - #36329

3.2.9. Parameters

  • Add LookupValue permissions - #36663

  • The parameter value vanishes when clicking on the hide value checkbox on the new host page paramater tab - #36591

3.2.10. Plugin integration

  • As a user, I want to be able to trigger webhooks only on explicit host updates - #36104

3.2.11. Puppet integration

  • Move puppet rake task to plugin - #36222

3.2.12. Rails

  • Drop power_manager models from autoload paths - #36583

  • Load Rails 6.1 defaults - #35432

3.2.13. Rake tasks

  • count db:abort_if_pending_migrations as a setup rake task - #36774

3.2.14. Reporting

  • "Applicable errata" and "registered content hosts" reports syntax highlighting broken + applicable errata name needs changing - #36587

  • "Host - compare content hosts packages" report template should restrict or notify if Host 1* and Host 2* name are same - #36244

3.2.15. Security

  • Open Redirect weakness in links_controller.rb - #36644

  • use YAML.safe_load instead of YAML.load - #36219

3.2.16. Settings

  • CVE-2022-3874: OS command injection via ct_command and fcct_command - #36759

  • instance_id setting is not presistent. - #36395

3.2.17. Statistics

  • Report Template output generation can take hours to complete if the template is only about printing different host facts - #36715

3.2.18. Templates

  • Safemode doesn't allow to access 'katello_agent_enabled?' - #36717

  • Introduce human readable form for Host - Statuses report template - #36426

  • kickstart_kernel_options snippet breaks UEFI VLAN tagged provisioning - #36361

  • Template load_resource - explain :joins, :preload and includes - #36239

  • "snippet" keyword causes error in search bar - #35805

3.2.19. Tests

  • Pin @adobe/css-tools package to 4.2.0 to build on NodeJS 12 - #36656

  • Support Minitest 5.19+ - #36651

  • Pin minitest < 5.19 to resolve test failures - #36617

  • "Add parameter" button's data-ouia-component-id is changing - #36481

  • Add eslint rule to alert about missing ouia-ids - #36471

  • Add missing ouia-ids to all pf4 components - #36470

3.2.20. Unattended installations

  • Include BOOTIF-parameter in kernel_options for Ubuntu autoinstall - #36677

  • Installation medium "CentOS 8 mirror" no longer exists - #36659

  • Template proxy is not used for IPv6 subnets - #36639

  • AutoYaST provisioning template needs update for SLES 15 SP5 - #36536

  • Debian 12 bookworm uses python3 - #36519

  • Virtual nic conf in preseed is outdated - #36508

  • Provisioning template for CoreOS has a typo - #36490

  • Invalid netplan config with shortened IPv6-addresses - #36441

  • Awk/grep should be more strict - #36293

  • AlmaLinux UEFI Grub2 chainloading is broken - #36189

  • Windows default user data template - #36161

  • root_pass from settings not detected as unencrypted - #35942

  • Fix preseed_kernel_options to work with full-host-bootdisk deployments - #35124

3.2.21. Users, Roles and Permissions

  • Personal access tokens don't handle invalid expire_at dates gracefully - #36699

  • Make new pf4 modal for adding personal access token - #36001

3.2.22. Web Interface

  • Typo in variable name in form for taxonomies - #36791

  • Remove dividers between navigation items - #36571

  • Navigation items don't open in a new tab on ctrl+click - #36543

  • Add line breaks to bookmarks if the name is too long - #36350

  • Use pf4 in vertical navigation - #30344

3.3. Installer

  • Reuse foreman_proxy::foreman_base_url value for puppet::server_foreman_url - #36573

3.3.1. Foreman modules

  • allow setting (fc)ct_location - #36812

  • CVE-2023-4886: World readable tomcat server.xml contains passwords - #36760

  • Set ANSIBLE_PERMISSION_CLASSES as empty list to allow syncing collection repos on capsule without RBAC access to Galaxy endpoints - #36709

  • Expose candlepin logging parameter in the installer - #36697

  • Change the default Foreman Redis cache DB to 4 - #36645

  • Puppet module for Puppet should use "allowlist" instead of "whitelist" - #36620

  • Automatically detect Foreman logging layout based on logging type - #36582

  • Switch to puppetlabs vcsrepo for gitrepo tracking - #35943

3.3.2. foreman-installer script

  • Drop Apache mpm_event MaxRequestPerChild values from tuning profiles - #36784

  • Show failed resources in failed installation report - #36694

  • katello-certs-check does not cause the installer to halt execution on failure - #36567

  • Allow enabling mod_status for better Apache monitoring - #36311

3.4. Packaging

3.4.1. RPMs

  • Remove Katello Agent from katello-debug - #36676

Appendix A: Foreman Contributors

We’d like to thank the following people who contributed to the Foreman 3.8 release:

Adam Ruzicka, Alexey Masolov, Archana Kumari, Ashish Humbe, Bernhard Suttner, Daniel Alley, Eric D. Helms, Et7f3, Evgeni Golov, Ewoud Kohl van Wijngaarden, Girija Soni, Gordon Bleux, Griffin Sullivan, Ian Ballou, Jeremy Lenz, Jonas Trüstedt, Kamil Szubrycht, Karolina Malyjurkova, Leos Stejskal, Lior Keren, Lucy Fu, Marcel Kühlhorn, Maria Agaphontzev, Markus Bucher, Maximilian Kolb, Mike Rochefort, Nadja Heitmann, Nofar Alfassi, Oleh Fedorenko, Pat Riehecky, Romain Tartière, Ron Lavi, Samir Jha, Shimon Shtein, Tim Meusel, Trey Dockendorf, Vitaly Pyslar, William Clark, archanaserver, chr1s692, wlma

As well as all users who helped test releases, report bugs and provide feedback on the project.