Release notes for Uyuni Server

Until Uyuni 2023.03, localhost.log, manager.log, host-manager.log, localhost_access_log.txt and catalina.out were rotated with Valve.

Valve does not support archiving, so now the Tomcat logs are configured to rotate with logrotate and support archiving.

The configuration is the same as for the other tomcat logs: weekly rotation, one year of retention and compression enabled.

Together with the password, this Uyuni release also removes the arguments key and content from the API logging, because they could still include sensitive data and should not be exposed in the logs.

openSUSE Leap Micro is an ultra-reliable, lightweight operating system built for containerized and virtualized workloads.

Based on SUSE Linux Enterprise Micro, it leverages the enterprise hardened security and compliance components of SUSE Linux Enterprise. This merging of technologies provides for a modern, immutable and developer-friendly OS platform.

Check the Client Configuration Guide for information about the supported features.

Both products are still beta, and both products will work only using the Salt Bundle (default since Uyuni 2022.12) as otherwise they ship Salt 3005 which is incompatible with the salt master version being used on Uyuni server (the Salt master on Uyuni still uses Salt 3004 as provided by openSUSE Leap 15.4).

This update fixes several security vulnerabilities:

No other bugfixes, features or changelogs are part of this update.

Check the upstream changelog for all the details.

Until Uyuni 2023.01, syncing optional channels was only possible with the CLI tool mgr-sync, but not from the WebUI Setup Wizard.

Starting with Uyuni 2023.03, doing this from WebUI is now possible.

Each product at the Setup Wizard will now allow syncing optional channels, provided that the mandatory channels for the product are already synced.

To enable the optional channels:

This change is only relevant for users using SUSE subscriptions.

Previous versions of Uyuni created a notification each day when a SUSE Customer Center (SCC) subscription was about to expire, starting 90 days before the subscription expiration and 30 days after expiration.

With Uyuni 2023.03 we are addressing the feedback we got about the frequency, and we are changing it to happen weekly, on Mondays.

The warning box at the Dashboard (Home > Overview) will still show up any time there is a subscription expiring in the next 90 days, or expired in the last 30 days.

Upstream Salt 3000 went End of life on August 31, 2021. However, because it was part of the Advanced Systems Management Module of SUSE Linux Enterprise 12 and there was no bundle available for SUSE Manager 4.1, it was still supported.

Salt 3000 will no longer be supported in the context of Uyuni now that both SUSE Manager 4.1 and the Advanced Systems Management Module of SUSE Linux Enterprise 12 are End of Life.

Users are required to migrate existing Salt 3000 minions for SUSE Linux Enterprise Server 12, Red Hat Enterprise Linux 7, CentOS 7, Oracle Linux 7, and Amazon Linux 2 to the Salt Bundle before creating any bug reports.

For more information about performing Salt 3000 to Salt Bundle migrations, please consult the Salt Bundle section in the Client Configuration Guide.

Debian 9 LTS support ended in June 30th, 2022.

After a grace period of more than half a year, Uyuni 2023.03 is stopping support for this operating system.

While existing client tools repositories will not be removed, they will not get updates.

As for the code, it will not be broken on purpose, but it will not get tested for Debian 9 anymore, so even if Uyuni 2023.03 can still manage Debian 9, this can break at any further release.

All remaining users with Debian 9 systems are encouraged to migrate to Debian 10 or Debian 11 as soon as possible.

With Uyuni 2023.03, spacewalk-clone-by-date tool has been deprecated. With CLM (Content Lifecycle Management), we believe users have a better alternative to spacewalk-clone-by-date, which is much more flexible and powerful.

CLM provides a comprehensive API to cover all the important features that spacewalk-clone-by-date tool offers.

With Uyuni 2023.01, we are removing versions older than 2021.12 from the release notes, to make the document smaller and easier to review.

Release notes for older versions, up to 4.0.0 can still be found at the website.

SUSE Linux Enterprise Server Micro is an ultra-reliable, lightweight operating system purpose built for containerized and virtualized workloads. It leverages the enterprise hardened security and compliance components of SUSE Linux Enterprise and merges them with a modern, immutable, developer-friendly OS platform.

Support for SUSE Linux Enterprise Server Micro in Uyuni was added as a tech preview. In the meanwhile, we have made some significant improvements around it to make sure that users get the seamless usability experience in case of an immutable OS such as SUSE Linux Enterprise Server Micro.

Check the Client Configuration Guide for information about the supported features.

Please consult the Known issues section for an issue around SUSE Linux Enterprise Micro support.

Starting with Uyuni 2023.01, AppStream modularity can be disabled by removing the module metadata from the target repositories without having to enable any modules. This can be achieved by using the new none matcher with the AppStream filters.

This new feature is especially useful for AlmaLinux 9, Rocky Linux 9, Oracle Linux 9 or RHEL 9, as default versions of most applications are now served as regular packages.

Check the Administration Guide for more information.

Uyuni 2022.12 brings several improvements to the reboot of the Uyuni clients:

Uyuni shows notification messages on the webUI, but they are not very useful for those users that do not login very often.

With Uyuni 2022.12, each user can enable such notifications to be delivered via email using the user preferences (checkbox Receive email notifications).

This update fixes several security vulnerabilities:

No other bugfixes, features or changelogs are part of this update.

Check the upstream changelog for all the details-

Uyuni 2022.12 will show notifications at the Overview page now, when SUSE subscriptions are about to expire or have already expired.

This will not affect users not using SUSE subscriptions.

Until 2022.11, Uyuni added all the changelog entries for all packages to the generated metadata for each repository generated at the Uyuni Server. This caused the file others.xml.gz to be very big in some situations, and therefore increasing the time it takes to synchronize the metadata on the Uyuni clients.

Starting with Uyuni 2022.12, this is now limited to 20 entries for each package by default for new packages. Already synced packages will keep the whole changelog.

This change is only about the repository metadata and will not affect the packages themselves, which will keep the complete changelogs.

If you want to go back to keeping all the changelog entries, increase the number of entries, or apply the new default for all existing packages. For that check the Administration Guide.

In the past, using DISABLE_LOCAL_REPOS=0 with the bootstrap script allowed users to keep local repositories enabled after registration.

This feature can be accomplished with Salt, for any kind of onboarding (webUI, API, Bootstrap script, etc.), as explained at the Client Configuration Guide.

The System list page has been refactored to be more optimized and can handle thousands of systems with a breeze.

For this we had to add a new database table to store the cached system data.

This table is updated every hour by the update-system-overview-default task and within a minute after data for any of the systems is changed.

As a side effect, the System list will be empty after the server upgrade until the refresh is triggered.

To force a refresh before the top of the hour, run the update-system-overview-default task manually in Admin > Task Schedules page. Keep in mind that processing this task can take some time depending on how many systems are present in the database.

We intend to automate the initial refresh during during the Uyuni Server update in a future release, for people that are still upgrading from versions older than 2022.11

The new page has also introduced a more advanced filtering of the data. Though quite powerful, the user interface for the value selection is still rough and requires knowing what to query. While this has been temporarily been worked around by keeping the old links in the Systems List menu, we expect improvements for the interface in a future release.

Since Uyuni 2022.10, the custom channels are now synced automatically.

By default, a synchronization will start automatically after adding a new repository to a custom channel. Moreover, they will all update daily as a part of the mgr-sync-refresh-default scheduled task.

To disable this new feature and revert back to the old behaviour, you can set in /etc/rhn/rhn.conf:

Custom Channels section of the Administration guide for information about the custom channel synchronization.

Until now, the Uyuni Server only supported Wicked for network management, because of a problem at the uyuni-check-database service.

With Uyuni 2022.11, this problem is fixed and now any other tool such as NetworkManager can be used.

Uyuni 2022.03 updates Grafana from version 8.3.5 to 8.5.13.

This update fixes several security vulnerabilities:

Check the upstream changelog for all the details on what has changed.

There is one breaking change: - For a data source query made via /api/ds/query, if the DatasourceQueryMultiStatus feature is enabled and the data source response has an error set as part of the DataResponse, the resulting HTTP status code is now 207 Multi Status instead of 400 Bad gateway.

Updating Grafana is strongly recommended.

Uyuni 2022.10 and previous versions were using basic authentication for the Blackbox exporter scrapping, even though using TLS client certificates was enabled at the prometheus-formula

With Uyuni 2022.11, the Prometheus formula adds a section for the Blackbox exporter with TLS certificate and key for client certificate authentication.

Uyuni 2022.06 was the last version where traditional client tools were tested to work, and it was announced that with Uyuni 2022.08 the traditional client tools will be deprecated and removed at some point after the summer.

Uyuni 2022.11 is already removing code for the traditional clients, so this version will not support traditional clients in any way. New deployments will not work and existing deployments will not work either. If you still have traditional clients and they still work normally, you need to migrate them to Salt before updating to Uyuni 2022.11.

WARNING: This release requires vendor changes for some Uyuni dependencies at the server, so pay attention to the following instructions!

Because of bug at zypper, it could be that --allow-vendor-change is broken on your system. This can apply even if you are still on Uyuni 2022.05 or earlier (based on openSUSE Leap 15.3)

Make sure you manually update zypper first at the Uyuni Server with zypper ref && zypper in zypper, and then verify that the installed zypper version is 1.14.57 or newer (use zypper info zypper).

Then:

Uyuni is now able to manage RHEL/Oracle Linux/AlmaLinux/Rocky Linux 9 as Salt or Salt SSH minions. All other features that worked for previous versions of RHEL/Oracle Linux/AlmaLinux/Rocky will work now too, with the exception of the Prometheus Exporters.

The following architectures can be managed:

Check the Client Configuration Guide for information about how to configure the Uyuni Server to work with RHEL/Oracle Linux/AlmaLinux/Rocky Linux 8 clients.

The Client Tools for Ubuntu 22.04 now contain four exporters:

With these tools all of the features available for previous Ubuntu versions are available at 22.04

The Salt Bundle now includes support for pip, allowing users to extend the functionality of the bundled Salt Minion with extra Python packages.

Check the official Saltstack documentation on how to do it as a module and a state.

Keep in mind that not all of the functions are available with the state, but the missing functionality can still be accessed with module.run.

Uyuni 2022.10 updates the Prometheus exporter for Apache from version 0.7 to version 0.10.0 for SUSE Linux Enterprise and openSUSE, including the Uyuni Server, the Uyuni Proxy and the Uyuni Retail Branch Server.

Check the upstream release notes for more details, including new metrics.

Cobbler was updated from version 3.1.2 to version 3.3.3.

For the complete list of changes, see the upstream release notes:

A backup of old Cobbler settings file will be created at /etc/cobbler/settings.before-migration-backup and old collections backup under /var/lib/cobbler/.

Uyuni is now able to manage Ubuntu 22.04 clients as Salt or Salt SSH minions. All other features that worked for previous versions of Ubuntu will work now too, with the exception of the Prometheus Exporters and package vendor identification, which will be part of a future Uyuni release (for now, Prometheus Exporters are available in the Universe repositories).

The following architectures can be managed:

Check the Client Configuration Guide for information about how to configure Uyuni Server to work with Ubuntu 22.04 clients.

Uyuni is now taking care of trusting the required GPG keys on the clients, in order to install packages from assigned channels

The GPG key URL can be defined for Software Channels which will be used to find the key needed for that channel.

When the channel is assigned to the client the key will be trusted on repository refresh or when installing a package out of the channels.

For more information, check the documentation.

To prevent problems with local defined repositories providing wrong or unwanted packages, we disable now all these repositories as the first step in bootstraping.

Additionally we try to keep local repositories disabled and perform this in the channel state which is also used during highstate.

For more information, check the documentation.

Deploying Proxy and Retail Branch Servers as containers is now also possible using a Helm chart.

For more information check this README file. The information will be part of the Uyuni official documentation in a future release.

WARNING: The container images configuration has a new format and it is now packaged as tar.gz file. All previously deployed container Proxies and Retail Branch Servers will need to get their configuration regenerated and deployed again before pulling these images.

WARNING: This release updates the base OS from openSUSE Leap 15.3 to openSUSE Leap 15.4 and there are special steps required. You need at least Uyuni 2021.06 already installed to perform the upgrade, and you need to follow the major upgrade procedure for the Server. More details are also available at the "Update from previous versions of Uyuni Server" section below.

WARNING: This release updates the Salt version for master and minions to a next major release. Make sure you update the Uyuni Server before updating the clients, as backward compatiblity of minions agains an older master is not guaranteed

WARNING: With Uyuni 2021.12, we announced the future deprecation of the Traditional client tools. Uyuni 2022.06 is the last release that supports them. Starting with Uyuni 2022.08, the traditional client tools will be deprecated as we will start removing the code at some point after the summer. Do not use traditional for any new deployments of clients or proxies, and start migrating your traditional clients to Salt.

The base system has been upgraded to openSUSE Leap 15.4.

The database engine has been updated from PostgreSQL 13 to PostgreSQL 14, which brings a number of performance and reliability improvements. A detailed changelog is available upstream.

To prevent inconsistent configurations and data on upgrade or update, Uyuni 2022.06 refuse to start until the database migration from PostgreSQL 13 to PostgreSQL 14 has been completed successfully.

Salt has been upgraded to upstream version 3004, plus a number of patches, backports and enhancements by SUSE, for the Uyuni Manager Server, Proxy, and Client Tools.

We intend to regularly upgrade Salt to more recent versions.

For more details about changes in your manually-created Salt states, see the Salt 3004 upstream release notes.

Salt Bundle 3004 will be available for all supported clients.

The non-bundle version of Salt requires Python3 installed by default, so it will not be available for:

The reporting database schema is now fully documented.

The documentation describes the schema in detail, showing all the tables and the views available and highlighting the relationships among them.

You can access it from the Uyuni Server WebUI, at Help > Report Database Schema, from the left navigation bar.

Starting with Uyuni 2022.05, spacewalk-report will use the data from the report database by default. This change affects both new and updated setups.

This means that the new generated reports will differ in the structure and the format of the data and might break existing integrations.

If this change causes trouble in your use case, the new option --legacy-report can be used to fallback to the old report engine.

For a comprehensive list of what is changed and what reports are affected, see the section "Generate Reports" at the Administration Guide.

It is now possible to select and add systems that failed or completed actions, with a new button Add Selected to SSM that shows for the actions at "Completed Systems" and "Failed Systems".

You can the find the actions at the Uyuni Server WebUI, at Schedule on the left navigation bar.

This can be useful to fix issues with systems that failed to complete actions, or to run more actions on those that completed them.

With Uyuni 2022.05, in addition to the current XML-RPC API, a new JSON over HTTPI API will also be provided to make Uyuni API even easier to consume.

Uyuni is seeing more and more use in automated scenarios, where it is a part of a bigger system and driven via its APIs.

The XML-RPC protocol has served users well so far and will continue to do so, but HTTP APIs are more in demand and have better tooling support.

The API documentation has been updated to reflect the changes to support the HTTP API, and is available at the Uyuni Server WebUI under About > API, and at the website

Usage examples can be found in the "Sample scripts" section of the documentation.

With the addition of the JSON over HTTP API documentation:

The Salt Bundle is now used to handle Salt SSH executions on the client side. The bootstrap of new Salt clients using webUI or API is now also using the Salt Bundle.

To ensure bootstrap works in the proper way, the bootstrap repositories for the clients must be regenerated before bootstrapping new clients.

The bootstrap repository regeneration happens for any given product when a resync for the product repositories happens:

To manually trigger the regeneration, use the tool mgr-create-bootstrap-repo at the Uyuni Server.

Starting with Uyuni 2022.04, it will be possible to run the Uyuni proxy and Retail branch server also in containers. This could be very helpful in scenarios where adding new virtual machines is not feasible for some reason.

Additionally, the ability to run Uyuni Proxy and Retail branch servers in containers make it more flexible to run them anywhere without worrying about the underlying OS, while also making it possible to get the advantage of Kubernetes offerings like HA.

The following improvements have been made in the reporting database

Uyuni 2022.04 comes with a lot of improvements for image management.

HTTP Strict Transport Security (HSTS) is a policy mechanism that helps to protect websites against man-in-the-middle attacks such as protocol downgrade attacks and cookie hijacking.

Uyuni 2022.04 allows enabling HSTS. Which means each request will need to be HTTPS while plain HTTP requests will be rejected.

To enable it for the Uyuni Server:

To enable it for the Uyuni Proxy

IMPORTANT: If you enable HSTS while using the default SSL certificate generated by Uyuni, or a self-signed certificate, some browsers will refuse to connect using HTTPS unless the CA used to sign such certificates is trusted by the browser. If you are using the SSL certificate generated by Uyuni, you can trust it at the servers by using the file located at http://<UYUNI-SERVER-HOSTNAME>/pub/RHN-ORG-TRUSTED-SSL-CERT

Fixes for the following security issues have been released: CVE-2022-22934, CVE-2022-22935, CVE-2022-22936, CVE-2022-22941.

You should patch your Salt master at the Uyuni Server and minions as soon as possible. Please take the next section into account when upgrading the Salt.

To properly upgrade Salt with the fixes for the latest CVEs, and avoid breaking the communication between for Salt master and minion, you need to upgrade your "salt-master" first and then continue upgrading your Salt minions.

In case that a Salt minion is upgraded with the CVE fixes but your Salt master is not, then the communication between the master and this minion will be broken, and you would see errors like the following in your minion logs:

As soon as your Salt master is upgraded and restarted then the communication between master and minion will be restablished and the errors messages will not longer happen.

Uyuni 2022.03 updates the XML-RPC API version from 25 to 26, in preparation for SUSE Manager 4.3

There are no breaking changes to any methods.

If any of your scripts are checking for the version 25, you can change them to use version 26 without any further changes.

Starting with PostgreSQL 13, some defaults have changed.

To improve performance, smdba autotuning was adapted to use the new values.

Additionally an extra paramater --ssd was added to autotuning to tell smdba that the database is stored on ssd or fast network storage.

To change an existing configuration with the new defaults call

Remember you can also adjust some other parameters, in case you need them:

Uyuni 2022.03 updates Grafana from version 7.5.12 to 8.3.5.

This update fixes several security vulnerabilities:

Updating Grafana is strongly recommended.

Relevant changes are:

Check the upstream changelog for more details on what has changed.

There is one breaking change:

Uyuni does not use Grafana alerting, so if you do not need it, you can disable it at the Grafana WebUI.

If you use legacy Grafana alerting in your environment, consider migrating to new Grafana 8 alerting.

We highly encourage you to migrate your workload to a newer version of each distribution, or to an alternative distribution that is still supported, so you can continue managing your infrastructure with Uyuni.

Please note that we will not break things on purpose for these unsupported products, and there is a possibility that they could still continue to work. But if things break, there will not be any support provided, not even on a best-effort basis, unless someone from the community can step in.

PostgresSQL is changing its default password encryption mechanism from md5 to scram-sha-256.

With this update Uyuni will follow this change and will migrate the database user to this new encryption mechanism.

This should happen fully automated for the existing database user.

The following changes will happen:

In case additional users where created, the passwords must be reseted.

This can be done with the following command on the Uyuni Server executed as "root" user, and exchanging`<DBUSER>` with the right username and <DBPASSWD> with the new password:

The reporting database provides Uyuni data used for reports in a simplified schema, and is accessible by any reporting tool with support for SQL databases as content sources.

This new database is isolated from the one used for the Uyuni Server, and created automatically.

The tool uyuni-setup-reportdb-user can create new users which has read-only access to the data.

For more information on this topic, see Hub reporting.

Uyuni now comes with Ubuntu errata support. It does this by downloading errata information from https://usn.ubuntu.com/usn-db/database.json and matching it after the syncing of Ubuntu channels.

It also adds support for installing errata on Ubuntu systems by mapping them to package installs.

For users, it will be a seamless experience and they will get exactly the same UX as it was for errata management for other distros.

It is now possible to sync content from SUSE-operated Cloud RMT Server from the Uyuni. This makes it a lot easier for users with SLES PAYG instances because now they don’t need to go through a cumbersome process of getting zero-cost subscriptions.

It works in all three major public clouds AWS, GCP, and Azure.

For more information and instructions on this topic, see the Connect Pay-as-you-go instance.

Uyuni 2022.02 provides the openscap package binaries using the sources from Debian Sid. Debian11 itself does not provide openscap, as it was removed from Debian Testing during Debian 11 development.

This is a Tech Preview and therefore not supported, but we invite the community to provide feedback and will provide updates from the Debian upstream package if needed.

Uyuni is now able to manage Debian 11 clients as salt or salt-ssh minions, as well as all other features that work for previous versions of Debian, with the exception of openscap as it is not available on Debian 11

The following architectures can be managed:

Check the Client Configuration Guide for information about how to configure Uyuni Server to work with Debian 11 clients.

The patch details page now contains a new section Vendor Advisory, which links to the original advisory provided by the vendor of the patch.

This information is auto-generated from data already existing in the database thus, when possible, it will be available for both new and existing patches.

With Uyuni 2022.01, the following providers are supported:

Starting with Uyuni 2022.01, using TCP port 22 for SSH minions is not required anymore, and any TCP port can be used.

It is now possible to change the proxy used by an Uyuni client using the WebUI.

This can be done from the Connection tab at the Details tab for any Salt client, using the new link Change to change the connection type.

Using System Set Manager is supported as well, and can be done from the Misc tab, and then Proxy tab.

NOTE: Changing the connection for a Proxy to move it, is not supported at this moment. The Connectiontab will not show the Change link for proxies.

Salt Bundle is a single package called venv-salt-minion containing the Salt Minion, Python and all Python modules. It is exactly the same version and codebase for the current salt-minion RPM package.

The Salt Bundle can be used on systems that already run another Salt Minion, that do not meet Salt’s requirements or already provide a newer salt version that is used instead of the version provided by Uyuni.

Starting with Uyuni 2021.12, Uyuni is able to bootstrap systems with Salt Bundle for all the supported operating systems.

On bootstrapping new clients the Salt Bundle package will be used instead of salt-minion, if the package venv-salt-minion is present in the bootstrap repo.

Clients already registered will not be changed, but can be switched to Salt Bundle with applying the state util.mgr_switch_to_venv_minion to them. For more information see the Client Configuration Guide.

Uyuni 2021.12 adds support for the aarch64 (ARM64) architecture for the following operating systems:

It is now possible to re-activate a system using the UI/XMLRPC-API of Uyuni which was only possible using bootstrap script before. The bootstrapping page UI has been extended and the user can now enter the reactivation key of the system and the UI/XMLRPC-API of Uyuni will take care of the rest.

The same could be achieved from the XMLRPC API.

With Uyuni 2021.12, on the login page, a banner will be shown when available disk space on the server will be running low. This will help users avoid situations like the automatic shutdown of Uyuni when disk space is critically low, without even noticing it.

Package locks are used to prevent unauthorized installation or upgrades of software packages. In the past the package lock feature was only available for traditional clients. Now it is also available for Salt clients (SUSE, RHEL and clones, and Debian/Ubuntu).

Check the Package Locking documentation for information about how to use this feature.

From the Content Lifecycle Management project view, the new column Last build has been added. This information is useful when you need a general overview of all latest build times rather than retrieving the information project by project.

Following new XMLRPC methods have been added in SaltKey namespace.

These methods could further help in improving the automation workflows.

A security fix for CVE-2021-40348 is included as apart of Uyuni 2021.08, to fix a potential injection arbitrary code to a root-owned file that eventually will be executed by the system.

The fix for this problem was previously released on October 29th as a patch on top of Uyuni 2021.09, but if you did not apply such patch yet, we recommend appling the update to Uyuni 2021.12 as soon as possible.

CentOS 8 will be End of Life on December 31st, 2021. Uyuni support for this product will end as well.

Please refer to support section for more information.

With Uyuni 2021.12, we announced the future deprecation of the Traditional client tools.

Uyuni 2022.06 is the last release that supports them.

Starting with Uyuni 2022.08, the traditional client tools will be deprecated as we will start removing the code at some point after the summer.

Do not use traditional for any new deployments of clients or proxies, and start migrating your traditional clients to Salt.