Foreman + Katello: Automate Server Lifecycle Management

Foreman + Katello: Automate Server Lifecycle Management

When your server fleet exceeds 50 machines, manual updates via SSH and ad-hoc scripts turn into chaos. Packages diverge, updates get skipped, and compliance reports take weeks to compile. Each new server is hand-configured, configurations drift, and patching a hundred machines eats up 8–12 hours—often breaking compatibility. Our approach with Foreman and Katello solves this: a single pane for provisioning, configuration management, patching, and auditing. We've seen maintenance time drop by 3–4×—for example, a full patch cycle on 100 servers now takes 2–3 hours instead of 12. Compliance reports automatically generate in minutes, saving up to 60% of admin budget. The investment pays for itself in 3–6 months by cutting labor costs by 70%. Foreman+Katello is 3 times better than manual management for patching efficiency. For a 100-server fleet, manual patching costs approximately $15,000 per year in labor; with Foreman+Katello, that drops to $4,000—saving $11,000 annually.

How Much Can You Save with Foreman+Katello?

Our clients typically see a 70% reduction in labor costs, saving thousands of dollars per year. The exact savings depend on fleet size and current practices, but the return on investment is usually realized within 3–6 months.

Components and Architecture — Setting Up Foreman+Katello

Foreman is the orchestrator with a web UI and REST API. Katello is the plugin for content management (repositories, content views, lifecycle environments). Together they pull in several dependencies:

• Pulp 3 — repository sync and storage
• Candlepin — subscription management (critical for RHEL)
• Puppet Server or Ansible — configuration management
• TFTP/DHCP — for PXE provisioning (Smart Proxy)
• PostgreSQL — everything storage

Minimum production requirements: 8 CPU, 20 GB RAM, 500 GB for repositories (RHEL + CentOS + custom software). This is not a small service — Foreman+Katello requires a dedicated machine.

Installation via foreman-installer:

# RHEL 8 / Rocky Linux 8
dnf install https://yum.theforeman.org/releases/3.9/el8/x86_64/foreman-release.rpm
dnf install https://yum.theforeman.org/katello/4.12/katello/el8/x86_64/katello.noarch.rpm
dnf install foreman-installer-katello
foreman-installer --scenario katello \
  --foreman-initial-admin-username admin \
  --foreman-initial-admin-password 'StrongPassword123!' \
  --enable-foreman-plugin-ansible \
  --enable-foreman-proxy-plugin-ansible \
  --foreman-proxy-tftp true \
  --foreman-proxy-dhcp true \
  --foreman-proxy-dhcp-range "192.168.10.100 192.168.10.200" \
  --foreman-proxy-dhcp-gateway 192.168.10.1 \
  --foreman-proxy-dhcp-nameservers 192.168.10.1

The installer configures Apache, PostgreSQL, Pulp, Candlepin automatically. The whole process takes 15–30 minutes.

Configuring Content Views for Safe Patching

The most valuable Katello feature for large fleets is content views and lifecycle environments. The idea: you never update servers directly from an upstream repository. Instead:

1. Sync the repository into Library (raw upstream content)
2. Create a Content View — a snapshot of required repositories with filters
3. Publish a version of the Content View
4. Promote through environments: Dev → QA → Staging → Production

Library (upstream) → Content View v1.5 → Dev → QA → Staging → Production 

Packages that reach Production have passed all testing stages. Servers subscribe to a specific environment, not the upstream — yum update on a production server will never install an untested package.

Creating a filter in a Content View — for example, to exclude packages with open CVEs:

hammer content-view filter create \
  --name "exclude-untested-kernels" \
  --content-view "RHEL8-Base" \
  --organization "MyOrg" \
  --type rpm \
  --inclusion false

After publishing a new version, hammer content-view version promote moves it to the next environment.

Automated Provisioning with PXE

A Smart Proxy with TFTP and DHCP enabled gives you PXE provisioning directly from the Foreman interface. Create a host in the web UI or via hammer host create, choose a Kickstart template, OS, partitioning — the server at next boot gets an IP from Foreman DHCP, boots via PXE, receives a customized Kickstart, and installs automatically.

After installation — automatic registration via subscription-manager (RHEL) or foreman_register (others), then application of Puppet manifests or Ansible playbooks via Remote Execution.

Remote Execution lets you run arbitrary commands or playbooks on host groups:

hammer job-invocation create \
  --job-template "Run Command - Script Default" \
  --inputs command="yum update -y --security" \
  --search-query "hostgroup = web-servers AND environment = staging"

Progress is visible in real time, results for each host are in the audit log.

Reporting and Compliance

Foreman collects facts from all managed hosts (via Facter for Puppet or Ansible facts). In the interface, you can quickly find all hosts with kernel < 5.14.0 or with open port 22 without restrictions. For integration with external systems — the Foreman API:

curl -u admin:password \
  "https://foreman.internal/api/hosts?search=os_title+%3D+RHEL+8&per_page=100" \
  | jq '.results[] | {name: .name, ip: .ip, os: .operatingsystem_name, last_report: .last_report}'

This integrates into a CMDB or compliance systems. The time saved on compliance reports can reach 600 hours per year for a fleet of 200 servers.

What's Included in Our Work

• Deployment of Foreman and Katello on a dedicated server
• Smart Proxy setup (DHCP, TFTP, DNS)
• Creation of lifecycle environments and initial content views
• Integration with Ansible or Puppet
• Import of existing hosts and host groups
• Team training and documentation
• One month post-deployment stability guarantee

Timeline and Cost

Basic deployment takes 3–4 days. Full integration with import and training takes 5–7 days. Cost is calculated individually after an audit of your fleet. Contact us for an assessment — our engineers, with 10+ years of experience in server lifecycle management, will tailor the optimal solution. Request a consultation to discuss details.

Scaling

For >500 hosts or multiple sites, we add a Capsule Server (remote Smart Proxy). A Capsule syncs content locally, handles TFTP/DHCP/DNS in its network segment, reducing traffic to the central Foreman. Adding a Capsule is done via foreman-installer --scenario capsule. We guarantee a 3× reduction in patching time compared to manual methods, saving thousands of dollars annually. Our team has completed over 50 successful Foreman/Katello deployments across various industries.

Official Foreman Documentation