1. Foreman use cases
Foreman is a centralized tool for provisioning, content delivery, remote management, and monitoring of multiple Enterprise Linux deployments. With Foreman, you can deploy, configure, and maintain your systems across physical, virtual, and cloud environments.
Foreman helps you provision hosts, manage patches and content, and strengthen security across physical, virtual, and cloud environments. You can also benefit from AI-powered assistance by deploying the Model Context Protocol (MCP) server for Foreman, which enables you to interact with your infrastructure using natural language.
Foreman focuses on the following use cases:
- Provisioning
-
Deploy consistently configured hosts on bare metal, virtual machines, and cloud instances from a unified interface.
Foreman automates key stages of the deployment lifecycle, including network configuration, operating system installation, and post-installation tasks. For example, you can define templates, partition layouts, and available software to achieve flexibility in how you deploy hosts.
This approach helps reduce deployment time, standardize the provisioning process, and support scaling of your infrastructure.
- Patch management and content distribution
-
Apply updates to hosts in a consistent, scalable, and repeatable manner. Import, organize, and distribute content to hosts.
NoteIn the context of Foreman, content is defined as the software installed on hosts. For example, you can use Foreman to distribute a broad range of content ranging from packages and errata to container images, Ansible content, and custom file types.
Foreman enables you to import, organize, and distribute content to hosts while staying in control of which versions of content reaches which hosts and when. For example, you can schedule maintenance windows, test updates in staging environments, and roll out patches across your infrastructure with controlled deployment strategies.
This approach provides enhanced control over what software runs in your environment and reduces the manual effort required to keep hosts up to date.
- Security management
-
Reduce the effort required to secure hosts at scale.
Foreman helps you enforce security policies, scan for vulnerabilities, and remediate compliance violations across your infrastructure. For example, you can integrate Foreman with security scanning tools, track compliance against security baselines, and set up procedures to help ensure hosts meet regulatory requirements.
This capability enables centralized security oversight, supports incident response, and helps reduce the attack surface of your hosts.
- Knowledge and analytics
-
Identify potential issues and gain a comprehensive view of your infrastructure.
Foreman collects data from hosts, generates reports on system status and trends, and provides dashboards that visualize infrastructure health. For example, you can monitor resource utilization, track configuration changes, and identify patterns.
This knowledge helps you make informed decisions about your infrastructure and spot potential problems.
- Configuration management
-
Apply configurations to hosts in a consistent and repeatable manner.
Foreman integrates with configuration management tools to define desired state, enforce policies, and remediate drift across your infrastructure. For example, you can manage configurations as code, version control your infrastructure definitions, and automate updates to help keep hosts compliant with organizational standards.
This approach reduces the risk of manual configuration errors and helps maintain consistency across your hosts.
2. Deployment path for Foreman
During installation and initial configuration of Foreman, you can customize your deployment to fit your specific needs and operational environment. By customizing each stage of the deployment process, you can choose deployment options that meet the requirements of your organization.
2.1. Installing a Foreman server
Installing an instance of Foreman server on a dedicated server is the first step to a working Foreman infrastructure.
A default Foreman server installation includes installing PostgreSQL databases on the server. However, you can configure your Foreman server to use external databases instead. Moving to external databases distributes the workload and can reduce overall Foreman memory usage.
Consider using external databases if you plan to use your Foreman deployment for the following scenarios:
-
Frequent remote execution tasks. This requires a high volume of records in PostgreSQL and generates heavy database workloads.
-
High disk I/O workloads from frequent repository synchronization or content view publishing. This requires Foreman to create a record in PostgreSQL for each job.
-
High volume of hosts.
-
High volume of synchronized content.
2.2. Configuring external authentication in Foreman
The authentication methods you can configure depend on the authentication source you are using. If the native authentication features provided by Foreman are not sufficient for your use case, use this information to decide which external authentication provider best suits your requirements.
Foreman includes native support for authentication with a username and password. If you require additional methods of authentication, configure your Foreman server to use an external authentication source.
| Username and password | Single sign-on (SSO) | One-time password (OTP) | Time-based one-time password (TOTP) | PIV cards | |
|---|---|---|---|---|---|
Active Directory (direct integration) |
Yes |
Yes |
No |
No |
No |
FreeIPA |
Yes (Linux and Active Directory users) |
Yes (Linux users only) |
No |
No |
No |
Quarkus-based Keycloak |
Yes |
Yes |
Yes |
Yes |
Yes |
Wildfly-based Keycloak |
Yes |
Yes |
Yes |
Yes |
Yes |
LDAP |
Yes |
No |
No |
No |
No |
2.3. Planning organization and location context
Context in Foreman consists of organizations and locations. You can associate most resources, for example hosts, subnets, and domains, with at least one organization and location context.
Organizations and locations enable you to arrange Foreman resources into logically structured groups. For example, you can create groups based on ownership, purpose, content, or security level. You can create and manage multiple organizations through Foreman, then divide and assign subscriptions to each individual organization.
- Organizations
-
Organizations can represent different business units, departments, or teams, such as Finance, Marketing, or Web Development. To manage Red Hat content, each organization requires a separate Red Hat subscription manifest.
By creating organizations, you can create logical containers to isolate and manage their configurations separately according to their specific requirements.
- Locations
-
Locations can represent physical locations, such as countries or cities.
By creating locations, you can define geographical sites where hosts are located. For example, this is useful in environments with multiple data centers.
You can use locations to map the network infrastructure to prevent incorrect host placement or configuration. While you cannot assign a subnet, domain, or compute resources directly to a Smart Proxy server, you can assign them to a location.
Unlike organizations, locations can have a hierarchical structure. Resources and users can generally only access resources within their own context, which makes configuring organizations and locations an integral part of access management in Foreman.
Foreman server defines all locations and organizations. Each Smart Proxy server synchronizes content and handles configuration of hosts in a different location.
Your Foreman server retains the management function, while the content and configuration is synchronized between your Foreman server and Smart Proxy servers assigned to certain locations.
|
Important
|
If you use host groups to bundle provisioning and configuration information, avoid mismatching resources from mutually exclusive contexts. For example, setting a subnet from one organization or location and a compute resource from a different organization or location creates an invalid host group. |
The structure of a multi-national company includes the Finance, Marketing, and Sales departments. The company operates across United States, United Kingdom, and Japan.
The system administrator creates the following organizations on their Foreman server:
-
Finance
-
Marketing
-
Sales
Additionally, the administrator creates the following locations on their Foreman server:
-
United States
-
United Kingdom
-
Japan
The administrator can define a nested location hierarchy to divide the United States location into additional locations based on specific cities:
-
Boston
-
Phoenix
-
San Francisco
2.4. Installing Smart Proxy servers
By installing Smart Proxy servers, you extend the reach and scalability of your Foreman deployment. You register each Smart Proxy server to Foreman server and configure it to provide the required services within your Foreman deployment.
You can install a Smart Proxy server in each of your geographic locations. By assigning a Smart Proxy to each location, you decrease the load on Foreman server, increase redundancy, and reduce bandwidth usage.
|
Note
|
The maximum number of Smart Proxy servers that Foreman server can support has no fixed limit. It was tested that a Foreman server can support 17 Smart Proxy servers with 2 vCPUs. |
Decide what services you want to enable on each Smart Proxy server. You can configure the DNS, DHCP, and TFTP services on one of your Smart Proxy servers or you can use an external server to provide these services to your Smart Proxy servers.
2.5. Defining your content library and content access strategy
To ensure that your Foreman server can manage software and provide it to your hosts, you create repositories and synchronize them. You can also define which hosts can access which content and content versions.
Your Foreman content library can include various types of content. Creating repositories allows you to choose the specific software required for your environment. By creating only the necessary repositories, you avoid downloading unnecessary content.
Synchronizing repositories downloads the content from Red Hat CDN or another source to your Foreman server. The synchronized content is stored on your Foreman server, eliminating the need for hosts to access the repositories. You can synchronize repositories manually, or you can create a sync plan to ensure synchronization runs on a regular basis.
By default, Foreman includes the Default Organization View content view and the Library lifecycle environment.
- Default Organization View
-
The Default Organization View is the default content view in Foreman that contains all the content that is synchronized to Foreman. After you update your content, such as by adding or removing a repository, the update is immediately reflected in Default Organization View.
- Library
-
The Library lifecycle environment is the default lifecycle environment in Foreman. Every newly published content view version is automatically published to the Library lifecycle environment. You can also promote specific content view versions to the Library lifecycle environment if needed.
In smaller deployments or when you do not require content versioning and environment promotion, you can associate a host to the Library environment under the Default Organization View without configuring additional lifecycle environments.
2.6. Defining role-based access control policies
You can define role-based access control policies to manage access to Foreman resources. A role-based access control policy is a set of rules that defines which users can access which resources and what actions they can perform on those resources.
Users in Foreman can have one or more roles assigned. These roles are associated with permissions that enable users to perform specified administrative actions in Foreman. Permission filters define the actions allowed for a certain resource type.
Foreman provides a set of predefined roles with permissions sufficient for standard tasks. You can also configure custom roles.
|
Note
|
One of the predefined roles is the Default role. Foreman assigns the Default role to every user in the system. By default, the Default role grants only a limited set of permissions. Be aware that if you add a permission to the Default role, every Foreman users will gain that permission. Assigning a different role to a user does not remove the Default role from the user. |
The following types of roles are commonly defined within various Foreman deployments:
- Roles related to applications or parts of infrastructure
-
For example, roles for owners of Enterprise Linux as the operating system as opposed to roles for owners of application servers and database servers.
- Roles related to a particular stage of the software lifecycle
-
For example, roles divided among the development, testing, and production phases, where each phase has one or more owners.
- Roles related to specific tasks
-
For example, you can create a role for security managers and a role for license managers, depending on the specific tasks users need to be able to perform within your organization.