Expected outcome: foremanctl deploy runs through successfully.
Foreman and Proxy versions:foremanctl-3.3.develop-1.20260915013906217250.master.6.gd2f802e.el9.noarch
Foreman and Proxy plugin versions:
Distribution and version:Rocky Linux 10.2
Other relevant data:
Hi everyone,
I just installed the latest version of foremanctl and ran foremanctl pull images. Afterward, I ran foremanctl deploy --add-feature foreman-proxy --add-feature remote-execution --add-feature hammer.
However, Ansible fails at the following point:
TASK [certificate_checks : Check certificates] *******************************************************************************************************************************************************************************************************************************************
ok: [localhost]
TASK [foreman_core_network : Create foreman-core-network] ********************************************************************************************************************************************************************************************************************************
fatal: [localhost]: FAILED! =>
changed: false
msg: Can’t create network foreman-core-network
stderr: |-
Error: subnet 10.130.0.0/24 is already used on the host or by another config
stderr_lines:
stdout: ‘’
stdout_lines:
PLAY RECAP *******************************************************************************************************************************************************************************************************************************************************************************
localhost : ok=70 changed=0 unreachable=0 failed=1 skipped=25 rescued=0 ignored=0
Does anyone have a solution for this problem, or is this a bug in the playbook/role?
I’m wondering if it’s possible to avoid specifying a subnet at all and let it pick a random one. I know that for IPv6 you can simply pass IPv6=true and it will do that. The docs state:
Enable IPv6 (Dual Stack) networking. If no subnets are given, it allocates an IPv4 and an IPv6 subnet.
Sounds like that picks a random range?
Can we count on everything being IPv6 compatible and not use IPv4? Or will podman pick a valid range when bringing up the network if you don’t specify an IPv4 range?
Firewall wise I don’t know if that’s better or worse.
No, there is no other podman network on my system:
[root@foremancontainer ~]# podman network list
NETWORK ID NAME DRIVER
2f259bab93aa podman bridge
[root@foremancontainer ~]# podman network inspect podman
[
{
“name”: “podman”,
“id”: “2f259bab93aaaaa2542ba43ef33eb990d0999ee1b9924b557b7be53c0b7a1bb9”,
“driver”: “bridge”,
“network_interface”: “podman0”,
“created”: “2026-09-16T13:33:32.776598321+02:00”,
“subnets”: [
{
“subnet”: “10.88.0.0/16”,
“gateway”: “10.88.0.1”
}
],
“ipv6_enabled”: false,
“internal”: false,
“dns_enabled”: false,
“ipam_options”: {
“driver”: “host-local”
},
“containers”: {}
}
]
[root@foremancontainer ~]#
Only Rocky Linux with Foreman/Katello is running on the machine. Nothing else.
Could the fact that I’m using a 10.0.0.0/8 network at home be causing problems?
[dirk@foremancontainer ~]$ ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host noprefixroute
valid_lft forever preferred_lft forever
2: eno1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether 6c:2b:59:f4:3a:76 brd ff:ff:ff:ff:ff:ff
altname enp0s31f6
altname enx6c2b59f43a76
inet 10.0.0.123/8 brd 10.255.255.255 scope global noprefixroute eno1
valid_lft forever preferred_lft forever
inet6 fe80::6e2b:59ff:fef4:3a76/64 scope link noprefixroute
valid_lft forever preferred_lft forever
Thanks for the details. The 10.0.0.123/8 on eno1 explains the conflict. I think since 10.130.0.0/24 falls within that range, Podman is rejecting the network creation.
I think we can let Podman auto select the subnet, but there’s one complication with the current IOP gateway setup. The IOP gateway nginx config has resolver 10.130.0.1;, so it currently expects the Podman network gateway/DNS to be 10.130.0.1. If Podman picks another subnet, that resolver address would no longer be correct right?
I wonder why we need to configure resolver in nginx at all.
Module ngx_http_core_module sadly doesn’t say what happens if you don’t set one, but I kinda would expect it just uses the one from /etc/resolv.conf (either directly or via libc), and that is managed by podman anyway.
In the previous designs, foreman was on the host network and iop parts were on a dedicated podman network with the gateway as a bridge between the two. With putting them on the same network, I wonder if we can relax the gateway configuration. At a minimum, we can likely make this more dynamic from foremanctl point of view.
On the whole I think we have two options.
Have a well known default, and provide users a method to override it.
Let podman randomly assign it, and provide users a method to override it.
@dirk_2809 kudos for using our bleeding edge version and reporting what you find!
As a regular user, I’d say I don’t really care.
But since I work as a Linux architect, I’d prefer to set a well-known default value and give users the option to override it. That way, everyone knows—no matter what system they’re working on—that everything is the same in that regard. It makes it easier to make changes, if desired.
Is there any news on this? I’m still getting the same error. I ran foremanctl pull-images and then foremanctl deploy --add-feature foreman-proxy --add-feature remote-execution --add-feature hammer, but I’m still getting the same error. foremanctl deploy --help isn’t helping either
I’m currently using foremanctl-3.3.1-2.el9.noarch
Why el9, anyway? But that’s another topic
TASK [foreman_core_network : Create foreman-core-network] ********************************************************************************************************************************************************************************************************************************************************************
fatal: [localhost]: FAILED! =>
changed: false
msg: Can’t create network foreman-core-network
stderr: |-
Error: subnet 10.130.0.0/24 is already used on the host or by another config
stderr_lines:
stdout: ‘’
stdout_lines:
rpm -qa | grep foremanctl
foremanctl-3.3.2-1.el10.noarch
my deployment script looks like this:
cat foremanctl_deploy.sh
foremanctl deploy --add-feature foreman-proxy --add-feature remote-execution --add-feature hammer
do I need to set up another option for this? foremanctl deploy --help didn’t help me, and unfortunately there’s no man foremanctl
