Hello community,
I’d like to give a quick update about some feature items we core maintainers are considering for Katello 5.1 and 5.2. If any of this development interests you, please let us know about how you’d like to help and/or your own ideas for how the feature should look.
Pulp upgrade
We are going to be upgrading Pulpcore to 3.117+ and bumping plugin versions to their latest. We are anticipating a release of Pulpcore 4 sometime within the next year, but will wait to perform prep until the release date is more clear. Pulp 4 is not anticipated to be a large and disruptive upgrade. We do know that domains will be enabled by default and client bindings will no longer be published, which will we resolve by likely using the OpenAPI spec directly. See Pulp4 Roadmap - HackMD for some notes from Pulp.
For this upgrade, Pulp Container will no longer support “container push” repositories, which is a huge benefit because it means that normal container repositories can now be pushed to. We are hoping to not only react to the change but also improve Katello with it by allowing users to push container images to synced repositories.
Angular sunsetting
We previously converted the content credentials page to React in Katello 4.21, and now we are working on the content types pages. There is already a PR to move the File units page to the “generic content types” UI framework: Fixes #39676 - Move Files to generic Content Types UI by pavanshekar · Pull Request #11839 · Katello/katello · GitHub
We plan on continuing to chip away at the content unit pages. We are also planning to include a new content units landing page to clean up the long list in the navigation bar on the left side of the screen. As we introduce more types, that list is going to get unwieldy. The goals is for search functionality to continue to work and perhaps show just some of the most popular content types in the navigation bar.
Python content
We’d like to revisit Python content support to ensure it is not missing core Pulp functionality. First and foremost we plan on bringing download policy to the Python content type. We also plan on improving testing and documentation. I don’t believe there are docs yet for how to consume from Python repositories like we have for Ansible, for example.
I don’t think there will be time in Katello 5.0 since we’re still quite busy working on containerization, but I would also like to see Katello support Pulp’s pull-through caching soon. With a pull-through cache, it becomes much more realistic for Katello to manage a repo that represents all of PyPI.
PQC
We are planning on implementing support for using PQC (ML-DSA focus for now) certificates with Katello. While most of the work needs to happen in foremanctl to support generating the certificates, Katello needs to be able to send and receive cryptographic capabilities to/from Candlepin. Katello also needs to stop assuming RSA in the entire code base, which may already be taken care of in entirety. We’ve done some preliminary testing and found out that aiohttp hit some max header limits with longer PQC certs, but they have already resolved the issue on their end: Test use of PQC client certificates / CAs with Pulp + increase aiohttp default header size limits slightly by dralley · Pull Request #7962 · pulp/pulpcore · GitHub. Katello just needs to test it and see if our Pulp container image generation requires any configuration changes.
I have done some testing with replacing normal certificates with ML-DSA ones on a Katello server and found that most things still work with some configuration changes (mostly in Candlepin). Host registration and content consumption via entitlement certificate both worked, which is great news.
The most visible feature around PQC for Katello this release will be for debug certificate support. Since debug certificates are for any client, Katello needs to let the user decide if they want the certificate to use PQC or legacy RSA certificates. We plan on implementing UI for this feature soon. @aidenfine has been leading this effort.
foremanctl
While it’s not in Katello’s codebase, foremanctl does not yet support the pre-upgrade hooks that Katello relies heavily on. Along with pre-upgrade hooks, foreman-maintain also had steps that would run if the upgrade was triggered from foreman-maintain (a feature that never really become popular for Katello like it did for Satellite). We plan on integrating these upgrade features into foremanctl so that users don’t need to worry about running upgrade steps like pulpcore-manager scripts.
I’ll leave it at that for now. As software development goes, the items above are subject to change. We can keep the conversation going on this thread.
Thanks for reading!