1. Foreman 3.8 Release Notes

1.1. Headline Features

1.1.1. Removed installer duplicate parameters

Both --foreman-logging-layout and --puppet-server-foreman-url are no longer needed. The logging layout is now derived from the logging type (--foreman-logging-type). The Foreman URL for puppetserver is now read from the Foreman Proxy setting (--foreman-proxy-foreman-base-url). The parameters still exist and can be specified, but the average user shouldn’t need it.

1.2. Upgrade Warnings

1.2.1. Foreman Redis caching DB changed to 4

Since Foreman 3.6 Foreman can be easily configured to use Redis for caching (using --foreman-rails-cache-store type:redis). Starting Foreman 3.8 this uses DB 4, instead of DB 0, to avoid potential conflicts with other software.

2. Katello 4.10 Release Notes

2.1. Headline Features

2.1.1. Verify Content Checksum on container repositories using Hammer

Option '--validate-contents' now supports all repository types, using "hammer repository synchronize" command. Previously container repositories and some others were not supported.

2.1.2. Add ACS bulk refresh option

Added option '--all' to "hammer alternate-content-source refresh" command.

2.1.3. Experimental activation key details page

When the setting 'Show Experimental Labs' is enabled, the Activation Key details page will be replaced by the beginnings of a redesigned page.

2.1.4. Content Views and CVV enhancements to filters and refresh

Content View filter creation/edit UI: 'Edit Rule' button is now 'Save'. If dependency solving is enabled or disabled for a content view, it will now be marked as needing a new publish.

2.1.5. Pulpcore and plugins updated from Pulpcore 3.22 to 3.28

Contains both fixes and features that Katello can use in the future to better manage content, such as:

2.2. Deprecations

There are no deprecations with Katello 4.10.

2.3. Upgrade Warnings

2.3.1. Katello-Agent removal

Katello-Agent has been removed from Katello and is no longer available via web UI, API, or CLI. Katello-Agent will be removed by upgrading. For patching hosts going forward, use remote execution. Remote execution will not be automatically enabled as part of the upgrade. To ensure uninterrupted host patching, migrate to remote execution before upgrading. To migrate hosts, see Migrating from Katello Agent to Remote Execution in Managing Hosts.

2.3.2. Removed various settings

As part of the removal of Katello-Agent, the following related settings have been removed: 'Use remote execution by default', 'Accept action timeout', and 'Finish action timeout'.

3. Katello 4.10.0

A full list of changes is available on Redmine

3.1. Katello

  • Incorrect aria-label and component ID in the alternate content source modal for editing credentials certificates - #36512

  • ID for activation keys on register host page is incorrect - #36489

3.1.1. API

  • Remove deprecated docker_tags_whitelist - #36695

  • Remove katello-agent API endpoints - #36665

3.1.2. Activation Key

  • Add activation key details top bar - #36576

  • Environment and Content View info is not visible on the Associations Content Host page for Activation keys - #36501

3.1.3. Alternate Content Sources

  • ACS bulk refresh through API silently sanitizes input IDs - #36634

  • Custom ACS path help text is missing file:// - #36631

  • ACS error message contains duplicate words - #36590

  • Add option --all to "hammer alternate-content-source refresh" command to refresh all ACS’s - #36589

  • Incorrect aria-label and component ID in the alternate content source modal for editing Products - #36514

  • Incorrect aria-label and component ID in the alternate content source modal for editing smart proxies - #36513

  • Incorrect aria-label in the alternate content source drawer - #36511

  • Incorrect aria-label and component ID in the alternate content source modal for editing credentials - #36510

  • 'Remove orphans' task fails on DeleteOrphanAlternateContentSources step - #36461

  • Simplified ACS update fails to remove products if product has any empty URL repos - #36221

3.1.4. Content Views

  • Content View filter creation/edit button should say "Save" instead of "Edit rule" - #36687

  • undefined method '#single_content_view' for Katello::Host::ContentFacet::Jail (Katello::Host::ContentFacet) (Safemode::NoMethodError) - #36684

  • Adding a CV to a CCV lists CV versions disorderly - #36679

  • Solve dependencies in settings is a dead setting - #36654

  • "Add content view" window and "Update version" window should display content view version, description and publishing date - #36648

  • update event is not created after updating CV name - #36628

  • Re-synchronizing the repository whose sync had failed earlier, the Content View does not display new upgradable packages that are available - #36622

  • Content View API lists same Environment Name and Label despite name changes - #36598

  • Hammer should treat indeterminate needs_publish as publish_needed - #36581

  • Content view dependency solving should be tracked for needs_publish - #36580

  • Filter gets applied to all the repositories upon removal of the repository for which the filter was created - #36577

  • CV page needs refresh to get the current filters state - #36529

  • Content View comparison - RPM packages search missing auto-completion - #36516

  • Content view Promote always warns for 'Force promotion' even if the correct path is followed - #36515

  • Link for container count on CV page redirects to an invalid page - #36474

  • Unable to disable import_only flag in Satellite UI when set on Content Views - #36459

  • Content view publish with filters is getting failed with the error "Could not find the following content units:" - #36334

  • Wrong listing of Content Views which contain Files - #36288

3.1.5. Errata Management

  • Allow installable errata count methods - #36506

3.1.6. Foreman Proxy Content

  • Restore n-1 smart proxy sync support for pulpcore 3.28 / 3.22 - #36686

  • Capsule Content view’s 'Last published' field is confusing - #36629

  • The "POST /katello/api/capsules/:id/reclaim_space" endpoint is wrong - #36545

  • Optimized capsule sync doesn’t sync recently published/promoted docker repositories - #36523

  • syncing a capsule fails with ActiveRecord::RecordNotFound Couldn’t find SmartProxy with 'id'=2 - #36520

  • External capsule is auto-synced on CV promotion regardless foreman_proxy_content_auto_sync settings - #36442

  • Capsule redundantly syncs *-Export-Library repos - #36436

  • Orphan cleanup runs fine but does not clear anything from /var/lib/pulp/media/artifact of Red Hat Capsule 6.10 - #36390

3.1.7. Hammer

  • hammer host info no longer shows content view and lifecycle environment - #36401

3.1.8. Hosts

  • Discovery Provisioning fails as the sync media is getting diminished from the host page even though it’s synced - #36721

  • Can not re-register with --force after deleting consumer certs against satellite614 - #36674

  • Hammer accepts non-existent LCE in host update - #36667

  • New host details UI - Remove katello-agent code - #36664

  • Change host content source warning implies overall failure when it should instead tell you that step 1 of 2 is complete - #36623

  • Change content source page never shows job invocation link - #36621

  • Errors due to lack of safe navigation when you try to customize a discovered host - #36608

  • Error when auto-provision/provision for a discovered host - #36601

  • Rename 'Change content source' job template so it’s less confusing - #36597

  • undefined method 'each' for #<Katello::ContentViewEnvironment when running hammer host subscription register - #36524

  • undefined method 'content_view=' for #<Katello::Host::ContentFacet:0x00007fc530855ac8> - #36504

  • Editing a host results in an error "content_view_id and lifecycle_environment_id must be provided together" - #36498

  • User with "Register Hosts" role ignores all the setup options - #36484

  • Can’t add hostgroup to new host - #36462

  • Host details UI, Repository sets table contains empty column header - #36445

  • hammer host update fails with "unknown attribute ‘content_view_id’ for Katello::Host::ContentFacet" when you pass a content view / LCE - #36440

  • Arch restriction label missing from Repository sets for repos without URL - #36430

  • Installable update links on the host page still link to the old content host detail page - #36254

  • Remove the setting 'Use remote execution by default' - #36083

3.1.9. Inter Server Sync

  • hammer content import fails with undefined method 'substitutor' for nil:NilClass during import content if product being imported is not covered by subscriptions on the manifest - #36521

  • Unable to enable any repository in network sync - #36482

  • Exporting repositories that have architecture restrictions results in bogus data that can’t be properly imported - #36477

  • Can’t update the redhat_repository_url without changing the cdn_configuration to custom_cdn - #36463

3.1.10. Localization

  • split out mo file and po file adding to git - #36444

3.1.11. Organizations and Locations

  • edit_organization permissions needed on upstream satellite - #36503

3.1.12. Repositories

  • Use pulp_deb 3.0.0 - #36728

  • hammer- allow user to run Verify Content Checksum, on container repositories - #36625

  • Repository details page shouldn’t say 'enabled by default' - #36593

  • Repository export fails with Error "Validation failed: Relative path is too long - #36584

  • 4.9 is slow to sync and index repositories - #36563

  • Upgrade to Katello 4.5 can fail if some on_demand repositories have checksum_type set - #36562

  • Hide option to delete content from Redhat repos - #36554

  • Remove deprecated & not working API endpoints from APIdoc - #36530

  • Optimize DockerMetaTag query and CV version deletion to run a single invocation of the method - #36500

  • Bump recommended Red Hat repos for 6.14 - #36485

  • Prevent regenerating metadata for repositories that use complete mirroring - #36453

  • Updating ignorable_content should not trigger pulp updates cause there is nothing to update in pulp - #36428

3.1.13. Subscriptions

  • Reasons for not deleting the manifest don’t apply with SCA enabled - #36604

  • A failed "Actions::Katello::Host::Hypervisors" task lacks identifying information - #36599

  • Fix the Documentation link in the Manifest history tab - #36272

3.1.14. Tests

  • Pin ostree binding on nightly for tests to pass - #36586

3.1.15. Tooling

  • Upgrade to Pulpcore 3.28 - #36637

3.1.16. Upgrades

  • Upgrade rake task will create bad content overrides on post-4.9 Katello upgrades - #36540

3.1.17. Web UI

  • about page broken after katello-agent removal - #36722

  • Legacy Content Host UI - Remove katello-agent code - #36649

  • Content tab subtabs disappear from host details page when you click them - #36613

  • Fix lint errors - #36609

  • Update PermissionDenied snapshots - #36552

  • Add ouia-id to Tab - #36478

  • Incorrect aria-label in the alternate content source details - #36420

  • Fix sticky pagination in rh repos - #36367

4. Foreman 3.8.0

A full list of changes is available on Redmine

4.1. Headline Features

4.1.1. Show failed resources in failed installation report

A failed foreman-installer run will capture Puppet reports making it much easier to troubleshoot failures. Users will not have to rely on the installer log anymore, as the failure output should be sufficient.

4.1.2. Removed installer duplicate parameters

Both --foreman-logging-layout and --puppet-server-foreman-url are no longer needed. The logging layout is now derived from the logging type (--foreman-logging-type). The Foreman URL for puppetserver is now read from the Foreman Proxy setting (--foreman-proxy-foreman-base-url). The parameters still exist and can be specified, but the average user shouldn’t need it.

4.2. Foreman

  • Some events are not visible even being triggered - #36796

  • CVE-2022-4130: Blind SSRF via Referer header - #36768

  • Add "last_checkin" attribute to Entitlements Template - #30690

4.2.1. API

  • GraphQL: Incorrect totalCount when querying with first parameter - #36509

  • Unable to access API using non-admin users. - #36449

4.2.2. Audit Log

  • Audit shows N/A for host owner changes - #36522

4.2.3. Development tools

  • Update ansible dev setup guide - #36475

  • Remove storybook - #36439

4.2.4. Host groups

  • 500 error when loading Hostgroups page for Ansible Roles Manager user - #36703

  • Changing OS in hostgroup edit form reset pxe loader even when it is not necessary - #36560

4.2.5. Host registration

  • global registration should not create hosts as "managed" or "to be built" - #36393

4.2.6. Inventory

  • Add PermissionDenied to reports tab in host - #36550

  • show new,delete button for params on host details only if user has permissions - #36549

  • Show disk and partition info of vsphere host - #36518

  • Legacy Hosts UI loaded when you navigate from the Host's VMRC Console button - #36450

  • The Reports link from new host detail page in the kebab menu should be dropped - #36067

4.2.7. JavaScript stack

  • Refactor PermissionDenied component - #36551

  • Update ConfigReports to pf4 - #36400

  • "Scrollbar test exception: TypeError" when loading any page - #36093

4.2.8. Notifications

  • Cache reads from redis raise "incompatible marshal file format" exception - #36329

4.2.9. Parameters

  • Add LookupValue permissions - #36663

  • The parameter value vanishes when clicking on the hide value checkbox on the new host page paramater tab - #36591

4.2.10. Plugin integration

  • As a user, I want to be able to trigger webhooks only on explicit host updates - #36104

4.2.11. Puppet integration

  • Move puppet rake task to plugin - #36222

4.2.12. Rails

  • Drop power_manager models from autoload paths - #36583

  • Load Rails 6.1 defaults - #35432

4.2.13. Rake tasks

  • count db:abort_if_pending_migrations as a setup rake task - #36774

4.2.14. Reporting

  • "Applicable errata" and "registered content hosts" reports syntax highlighting broken + applicable errata name needs changing - #36587

  • "Host - compare content hosts packages" report template should restrict or notify if Host 1* and Host 2* name are same - #36244

4.2.15. Security

  • Open Redirect weakness in links_controller.rb - #36644

  • use YAML.safe_load instead of YAML.load - #36219

4.2.16. Settings

  • CVE-2022-3874: OS command injection via ct_command and fcct_command - #36759

  • instance_id setting is not presistent. - #36395

4.2.17. Statistics

  • Report Template output generation can take hours to complete if the template is only about printing different host facts - #36715

4.2.18. Templates

  • Safemode doesn't allow to access 'katello_agent_enabled?' - #36717

  • Introduce human readable form for Host - Statuses report template - #36426

  • kickstart_kernel_options snippet breaks UEFI VLAN tagged provisioning - #36361

  • Template load_resource - explain :joins, :preload and includes - #36239

  • "snippet" keyword causes error in search bar - #35805

4.2.19. Tests

  • Pin @adobe/css-tools package to 4.2.0 to build on NodeJS 12 - #36656

  • Support Minitest 5.19+ - #36651

  • Pin minitest < 5.19 to resolve test failures - #36617

  • "Add parameter" button's data-ouia-component-id is changing - #36481

  • Add eslint rule to alert about missing ouia-ids - #36471

  • Add missing ouia-ids to all pf4 components - #36470

4.2.20. Unattended installations

  • Include BOOTIF-parameter in kernel_options for Ubuntu autoinstall - #36677

  • Installation medium "CentOS 8 mirror" no longer exists - #36659

  • Template proxy is not used for IPv6 subnets - #36639

  • AutoYaST provisioning template needs update for SLES 15 SP5 - #36536

  • Debian 12 bookworm uses python3 - #36519

  • Virtual nic conf in preseed is outdated - #36508

  • Provisioning template for CoreOS has a typo - #36490

  • Invalid netplan config with shortened IPv6-addresses - #36441

  • Awk/grep should be more strict - #36293

  • AlmaLinux UEFI Grub2 chainloading is broken - #36189

  • Windows default user data template - #36161

  • root_pass from settings not detected as unencrypted - #35942

  • Fix preseed_kernel_options to work with full-host-bootdisk deployments - #35124

4.2.21. Users, Roles and Permissions

  • Personal access tokens don't handle invalid expire_at dates gracefully - #36699

  • Make new pf4 modal for adding personal access token - #36001

4.2.22. Web Interface

  • Typo in variable name in form for taxonomies - #36791

  • Remove dividers between navigation items - #36571

  • Navigation items don't open in a new tab on ctrl+click - #36543

  • Add line breaks to bookmarks if the name is too long - #36350

  • Use pf4 in vertical navigation - #30344

4.3. Installer

  • Reuse foreman_proxy::foreman_base_url value for puppet::server_foreman_url - #36573

4.3.1. Foreman modules

  • allow setting (fc)ct_location - #36812

  • CVE-2023-4886: World readable tomcat server.xml contains passwords - #36760

  • Set ANSIBLE_PERMISSION_CLASSES as empty list to allow syncing collection repos on capsule without RBAC access to Galaxy endpoints - #36709

  • Expose candlepin logging parameter in the installer - #36697

  • Change the default Foreman Redis cache DB to 4 - #36645

  • Puppet module for Puppet should use "allowlist" instead of "whitelist" - #36620

  • Automatically detect Foreman logging layout based on logging type - #36582

  • Switch to puppetlabs vcsrepo for gitrepo tracking - #35943

4.3.2. foreman-installer script

  • Drop Apache mpm_event MaxRequestPerChild values from tuning profiles - #36784

  • Show failed resources in failed installation report - #36694

  • katello-certs-check does not cause the installer to halt execution on failure - #36567

  • Allow enabling mod_status for better Apache monitoring - #36311

4.4. Packaging

4.4.1. RPMs

  • Remove Katello Agent from katello-debug - #36676

Appendix A: Foreman Contributors

We’d like to thank the following people who contributed to the Foreman 3.8 release:

Adam Ruzicka, Alexey Masolov, Archana Kumari, Ashish Humbe, Bernhard Suttner, Daniel Alley, Eric D. Helms, Et7f3, Evgeni Golov, Ewoud Kohl van Wijngaarden, Girija Soni, Gordon Bleux, Griffin Sullivan, Ian Ballou, Jeremy Lenz, Jonas Trüstedt, Kamil Szubrycht, Karolina Malyjurkova, Leos Stejskal, Lior Keren, Lucy Fu, Marcel Kühlhorn, Maria Agaphontzev, Markus Bucher, Maximilian Kolb, Mike Rochefort, Nadja Heitmann, Nofar Alfassi, Oleh Fedorenko, Pat Riehecky, Romain Tartière, Ron Lavi, Samir Jha, Shimon Shtein, Tim Meusel, Trey Dockendorf, Vitaly Pyslar, William Clark, archanaserver, chr1s692, wlma

As well as all users who helped test releases, report bugs and provide feedback on the project.

Appendix B: Katello Contributors

Adam Růžička, Ashish Humbe, Chris Roberts, Evgeni Golov, Girija Soni, Ian Ballou, Jeremy Lenz, Leos Stejskal, Lucy Fu, Lukas Magauer, Maria Agaphontzev, Markus Bucher, Nagoor Shaik, Partha Aji, Quinn James, Samir Jha, Sayan Das, Trevor Allison, William Bradford Clark