Skip to content

Add satellite flavor for downstream deployments #628

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
zjhuntin wants to merge 2 commits into from
Closed

Add satellite flavor for downstream deployments #628

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7df5ede
Add satellite flavor for downstream deployments
zjhuntin Jul 7, 2026
9a01171
Add satellite flavor test mapping and CI job
zjhuntin Jul 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
71 changes: 71 additions & 0 deletions .github/workflows/test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -465,6 +465,76 @@ jobs:
limit-access-to-actor: true
wait-timeout-minutes: 5

satellite-tests:
runs-on: ubuntu-24.04
name: "Tests Satellite Deployment"
steps:
- uses: actions/checkout@v7
- name: Set up Python
uses: actions/setup-python@v7
with:
python-version: '3.12'
- name: Setup libvirt for Vagrant
uses: voxpupuli/setup-vagrant@v0
with:
configure_dns: true
- name: Install Ansible
run: pip install --upgrade ansible-core
- name: Setup environment
run: ./setup-environment
- name: Start VMs
run: |
./forge vms start --vms "quadlet client"
- name: Configure repositories
run: |
./forge setup-repositories
- name: Run image pull
run: |
./foremanctl pull-images
- name: Run deployment
run: |
./foremanctl deploy \
--flavor satellite \
--initial-admin-password=changeme \
--initial-organization "Foreman CI" \
--initial-location "Internet" \
--tuning development
- name: Deploy features
run: |
./foremanctl deploy \
--add-feature hammer \
--add-feature foreman-proxy \
--add-feature azure-rm \
--add-feature google \
--add-feature bmc
Comment on lines +507 to +509

@adamruzicka adamruzicka Jul 22, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Shouldn't those be part of the flavor or am I misinterpreting why those would get enabled?

@evgeni evgeni Jul 28, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

right now they are optional, because it's a bit undecided which features will get enabled by default on new installs. this PR gives enough building blocks for future adjustment :)

- name: Run tests
run: |
./forge test
- name: Run smoker
run: |
./forge smoker
- name: Archive smoker report
if: ${{ always() }}
uses: actions/upload-artifact@v7
with:
name: smoker-satellite
path: "/home/runner/smoker/report/"
- name: Generate sos reports
if: ${{ always() }}
run: ./forge sos
- name: Archive sos reports
if: ${{ always() }}
uses: actions/upload-artifact@v7
with:
name: sosreport-satellite
path: sos/
- name: Setup upterm session
if: ${{ failure() }}
uses: owenthereal/action-upterm@v1
with:
limit-access-to-actor: true
wait-timeout-minutes: 5

# A dummy job that you can mark as a required check instead of each individual test
test-suite:
if: always()
Expand All @@ -474,6 +544,7 @@ jobs:
- upgrade
- migration
- foreman-proxy-content-tests
- satellite-tests
- ansible-lint
- python-lint
runs-on: ubuntu-latest
Expand Down
5 changes: 5 additions & 0 deletions src/features.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -90,3 +90,8 @@ registration:
plugin_name: registration
dependencies:
- templates
theme-satellite:
Comment thread
ekohl marked this conversation as resolved.
description: Satellite theme for Foreman
internal: true
foreman:
plugin_name: foreman_theme_satellite
1 change: 1 addition & 0 deletions src/playbooks/deploy/metadata.obsah.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@ variables:
help: Base flavor to use in this deployment.
choices:
- katello
- satellite
Comment on lines 9 to +10

@evgeni evgeni Jul 27, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We should not allow users to select between katello and satellite.

In #643 I started with a PoC how this could work

Feel free to implement this part in a follow up tho.

external_authentication:
help: External authentication method to use
choices:
Expand Down
2 changes: 1 addition & 1 deletion src/roles/post_install/tasks/message.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
---
- name: Post install message
when: flavor in ['katello']
when: flavor in ['katello', 'satellite']
ansible.builtin.debug:
msg:
- "{{ _post_install_url_msg }}"
Expand Down
29 changes: 29 additions & 0 deletions src/vars/flavors/satellite.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
---
flavor_features:
- foreman
- katello
Comment on lines +3 to +4

@Gauravtalreja1 Gauravtalreja1 Jul 7, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

foreman-proxy feature can be added to this list

@evgeni evgeni Jul 7, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

as with hammer, I think that is something people should be actively opt in for?
content distribution to external proxies works without the feature, so in many architectures it won't be needed

@zjhuntin zjhuntin Jul 7, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

for now I do not have foreman-proxy enabled by default.

@Gauravtalreja1 Gauravtalreja1 Jul 8, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think it should be identical to what we've currently with rpm based installations and we should have similar features pre-enabled on satellite deploy for existing users, where foreman-proxy and hammer are enabled by default
@ekohl @vijay8451 wdyt?

@ekohl ekohl Jul 8, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, I do think that.

@ehelms ehelms Jul 9, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

One of our goals with foremanctl and containers was to encourage users to deploy external proxy/capsule/thing when they need functionality that is not available within the core Foreman(+Katello) stack rather than getting a local proxy by default. So that they have to make the choice whether to have it locally or not actively.

Upgrades will result in the same functionality, but the baseline feature set doesn't necessarily have to replicate what we had before.

For example, as a best practice, hammer should be installed on and used from a separate node. We should discourage admins from sshing in as root and using a CLI on the same machine that the service exists on. That's just a good security posture for us to encourage users to have. Should we block this? No. But it shouldn't be the default behaviour IMO.

@ekohl ekohl Jul 9, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

One of our goals with foremanctl and containers was to encourage users to deploy external proxy/capsule/thing when they need functionality that is not available within the core Foreman(+Katello) stack rather than getting a local proxy by default. So that they have to make the choice whether to have it locally or not actively.

I think this is a good discussion topic. It will mean that by default you won't have a working remote execution setup. Is that what we expect?

Upgrades will result in the same functionality, but the baseline feature set doesn't necessarily have to replicate what we had before.

Agreed

For example, as a best practice, hammer should be installed on and used from a separate node. We should discourage admins from sshing in as root and using a CLI on the same machine that the service exists on. That's just a good security posture for us to encourage users to have. Should we block this? No. But it shouldn't be the default behaviour IMO.

This is IMHO a good thing, but I wonder about the documentation impact. Today we often document the Hammer procedure. Should we modify those to all to refer to a chapter to install Hammer (somewhere)?

@jeremylenz jeremylenz Jul 14, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

+1 to everything Ewoud said here. I think users will expect the same plugins and features to be enabled on a containerized install that they used to get with the classic installer. If that's not going to be the case, our documentation should be loud about that.

- content/ansible
- content/container
- content/deb
- content/python
- content/rpm

@adamruzicka adamruzicka Aug 4, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since #444 is already in

Suggested change
- content/rpm
- content/rpm
- ansible

- remote-execution
- rh-cloud
- theme-satellite
Comment thread
evgeni marked this conversation as resolved.
- webhooks

checks_to_execute:
- check_features
- check_hostname
- check_database_connection
- check_system_requirements
- check_podman_network_backend

health_checks_to_execute:
- check_hostname
- check_database_connection
- check_services
- check_foreman_api
- check_foreman_tasks
- check_host_facts_count
- check_duplicate_permissions
4 changes: 2 additions & 2 deletions tests/backup_test.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,8 +18,8 @@ def expected_databases(enabled_features, flavor):
"""
databases = []

# Katello flavor has foreman, candlepin, and pulp
if flavor == 'katello':
# Katello and Satellite flavors have foreman, candlepin, and pulp
if flavor in ('katello', 'satellite'):
databases = ['foreman', 'candlepin', 'pulp']

# Foreman-proxy-content flavor only has pulp
Expand Down
13 changes: 11 additions & 2 deletions tests/conftest.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -284,16 +284,25 @@ def pytest_configure(config):
config.user_parameters = UserParameters(config)


FLAVOR_TEST_DIRS = {
'katello': ['katello', 'satellite'],
'foreman-proxy-content': ['foreman-proxy-content', 'capsule'],
}


def pytest_collection_modifyitems(config, items):
active_flavor = config.user_parameters.flavor
active_flavor_dir = FLAVOR_TESTS_DIR / active_flavor
allowed_dirs = set()
for test_dir, flavors in FLAVOR_TEST_DIRS.items():
if active_flavor in flavors:
allowed_dirs.add(test_dir)

deselected = []
selected = []
for item in items:
test_path = py.path.local(item.fspath)
if test_path.relto(FLAVOR_TESTS_DIR):
if not test_path.relto(active_flavor_dir):
if not any(test_path.relto(FLAVOR_TESTS_DIR / d) for d in allowed_dirs):
deselected.append(item)
continue
selected.append(item)
Expand Down