Chapter 3. Using content templates to apply system patches
Chapter 3. Using content templates to apply system patches Important Red Hat Insights is deprecating patch templates and introducing content templates as the way to manage the content in your Red Hat Enterprise Linux (RHEL) environment. Patch templates filter the errata that are applicable to registered systems in the Hybrid Cloud Console. Content templates provide filtering and control on the systems themselves. In addition, you can use the same set of content to build custom images in Insights. Content templates expand upon patch templates by adding product and architecture attributes. These attributes, plus a date that you select, create a defined set of packages and errata that you can use to build images, report on patching status, and control the content delivered to your registered systems. All content templates include base RHEL repositories, and you can choose to include additional Red Hat and custom repositories. Content templates are currently available in Preview mode. To start using content templates, click the Preview toggle at the top of your Insights window. For more information about content templates, refer to Transition of Red Hat Insights patch template to content templates . For more information about patch templates, see Applying patches to systems in the Red Hat Hybrid Cloud Console . Repository snapshots capture the state of your repository at a point in time. Repositories are collections of Red Hat Package Manager files (RPMs) and metadata. A content template consists of a set of repository snapshots that have the same version of Red Hat Enterprise Linux and the same system architecture. You select the snapshots to ensure that your systems have access only to specific package versions. Using the content templates, you can establish date-based patch baselines for your systems, and then use yum or dnf to perform updates to the systems. For more information about repository snapshots and content templates, refer to Managing content templates in Deploying and managing RHEL systems in hybrid clouds . 3.1. About patch templates Important The current patch templates and the Patch baseline API are deprecated in Insights. Content templates replace the existing patch templates. Patch templates allow you to filter the applicable advisories for systems, but content templates allow you to control the patch content available to the systems. Red Hat cannot provide a migration script to move systems from using patch templates to using content templates. This is because content templates contain additional structure that is not compatible with patch templates. Create new content templates in the Hybrid Cloud Console and manually apply the templates to your systems. If you are using patch templates in place of Satellite content views to ensure that your Insights and Satellite views match, use the Insights client build-packagecache option on the command line. This option reports installable updates to your systems based on the constraints of your subscribed content view. Note Satellite-managed systems are not eligible to have Red Hat Insights content templates applied. Only systems that are directly connected to RH subscription services are eligible. Additional resources For more information about the transition from patch templates to content templates, see the KB article Transition of Red Hat Insights patch templates to content templates . For more information about using the build-packagecache option, see this solution article . 3.2. About snapshots Snapshots are daily reference copies of the state of your repository at specified points in time. Insights for Red Hat Enterprise Linux takes snapshots of the common RHEL repositories as well as your custom repositories. You can view the list of snapshots for the repositories that you select, as well as the changes that occur in time between one snapshot and the . For example, you can see when new packages have been added between snapshots. 3.3. About content templates A content template consists of an explicit set of packages and errata that can be installed or updated on any associated system. It contains a set of repository snapshots that have the same RHEL product/version, system architecture, and template creation date. When you associate a system with a content template, Insights overwrites the repository definitions on the system to point to the repository snapshots in the template. These are the same repository snapshots that appear on the Repositories page in the Hybrid Cloud Console. Once you associate a system with a content template, any yum or dnf commands that you run on that system are constrained to the updates included in those repository snapshots. For more information about the Repositories page, refer to Managing repositories to build your customized operating systems . For example, you can create or edit a content template to contain only snapshots Red Hat Enterprise Linux 9 for x86_64 repositories. You can use that content template to apply consistent patches to systems that match the product/version and architecture. Once you associate a content template with a set of systems, you can run dnf at the command line to easily perform consistent updates to all systems associated with that template. Systems in your inventory that are not associated with that template do not receive the update packages and errata. Systems that you can associate with a content template must meet the following criteria: Must run RHEL 8 or later. The RHEL version must match the version specified in the template. Registered with Insights, but not managed by Red Hat Satellite or Red Hat Update Infrastructure (RHUI). Must have a system architecture that matches that specified in the template. 3.4. How patching works with content templates The workflow for patching with content templates follows these steps: You create the content template in Insights for Red Hat Enterprise Linux. The template includes the RHEL version, system architecture, template creation date, and other criteria. Systems that use the content template must match these criteria. You associate systems with the template. The template points the repositories to snapshots for system updates. Note that the systems can only receive updates through the content template after you associate them. When a system checks in to Insights, it can discover installable updates. The updates match the criteria in the content template. All systems that are associated with the template discover the same updates. This ensures that all the systems using the template receive consistent updates. 3.5. Creating a content template and enabling snapshots For information about creating and editing a content template and enabling snapshots for RHEL systems, refer to Managing content templates in Deploying and Managing RHEL Systems in Hybrid Clouds . For information about creating and managing custom repositories, refer to Managing repositories to build your customized operating systems in Deploying and Managing RHEL Systems in Hybrid Clouds . 3.6. Patching RHEL systems with content templates Content templates help you to apply consistent updates to all the systems assigned to the same template. This approach separates content management from remediation, and allows for more flexibility in patching. You can even use automation tools, such as Ansible Automation Platform, to perform patching operations for you. You need the following administrator permissions to use content templates: Repositories administrator (read, write, upload) Content template administrator (read repositories, read and write templates) To view your permissions, navigate to your profile > My User Access > Users . Click your account name. The list of groups for which you have permission displays. To see the permissions you have within a group, click the group name. The group page displays and shows the types of permissions available (for example, read and write). For more information about administrator permissions, refer to Predefined User Access roles in the User Access Configuration Guide for Role-based Access Control (RBAC) 3.6.1. Assigning systems to content templates Note A system can be associated to only one content template at a time. Prerequisites You must be a Repositories administrator and a Content Template administrator. You have created a content template. The systems you want to assign to the template have the same operating system version and system architecture. The operating system version and system architecture match the criteria in the content template (for example, RHEL 9 and x86_64 ). Procedure Navigate to Content > Templates . The list of available content templates displays. Click the name of the template you want to use. The information page for that template displays. The information page includes information about the template, including the systems that are already assigned to the template and the packages, advisories, and repositories associated with it. To assign the template to a system, click the Systems link. The Assign template to systems dialog box displays. Select the systems you want to associate to the template, and then click Assign . To associate all systems to the template, click All . The template information page displays. To view the associated systems, select the Systems tab. 3.6.2. Editing or deleting content templates Procedure To edit a content template, select Edit from the Actions drop-down menu to the Use template button. The Edit content template wizard displays. For more information about how to edit the template, refer to Editing a content template in Deploying and managing RHEL systems in hybrid clouds . To delete a content template, select Delete from the Actions drop-down menu. If you delete a content template that has associated systems, the association resets to default for those systems. You can associate them to another template. 3.7. Viewing the available advisories for a content template Procedure Navigate to Content > Templates and select a content template from the list. The information page for the template displays. Select Advisories under the Content tab. The list contains all advisories that apply to systems associated with that content template. Optional: To filter advisories, select the criterion you want to use from the drop-down menu ( Name/Synopsis , Type , or Severity ), and then use the second drop-down to select the filter. For example, you can view advisories by severity, and then filter the list to show only the Critical and Important advisories. 3.8. Installing updates Content templates help you to apply consistent updates to all the systems assigned to the same template. This approach separates content management from remediation, and allows for more flexibility in patching. You can even use automation tools, such as Ansible Automation Platform, to perform patching operations for you. Note RHEL 8 supports both the dnf and yum update commands. RHEL 9 and later support only dnf for updates. Prerequisites You have root access to the system (or systems) that you want to update. You have set up your repositories and snapshots. You have created content templates and assigned systems to them. Updates are available for systems associated with the content template. Procedure At the command line, type dnf update to install the updates on the system. This installs the updates to the system. The system receives only the updates associated with the content template. For example, if your content template has systems running RHEL 9, then the updates install only on RHEL 9 systems. Systems in your inventory that have different operating system versions or system architectures remain unaffected. Repeat the update on each of the other systems associated with the same content template.
dnf update