This SUSE product includes materials licensed to SUSE under the GNU General Public License (GPL). The GPL requires that SUSE makes available certain source code that corresponds to the GPL-licensed material. The source code is available for download.

For up to three years after SUSE’s distribution of the SUSE product, SUSE will mail a copy of the source code upon request. Requests should be sent by e-mail or as otherwise instructed here. SUSE may charge a fee to recover reasonable costs of distribution.

Version revision history

  • 22nd April, 2022: 4.3 Beta 3 release

  • 25th March, 2022: 4.3 Beta 2 release

  • 25th February, 2022: 4.3 Beta 1 release

About SUSE Manager 4.3

SUSE Manager 4.3, the latest release from SUSE based on SUSE Linux Enterprise Server 15 SP4 and the Uyuni Project, delivers a best-in-class open source infrastructure management and automation solution that lowers costs, identifies risk, enhances availability and reduces complexity.

As a key component of a software-defined infrastructure, SUSE Manager 4.3 delivers the following new or enhanced capabilities to your Edge, Cloud & Datacenter environments.

Expanded operating system support

Adding to its extensive list of Linux distributions, SUSE Manager 4.3 introduces support for Debian 11, further enabling the management of all your Enterprise Linux distributions from a single tool – no matter where they are located.

SUSE Manager now supports the management of SLE, SLE-Micro, RHEL, openSUSE, Oracle Linux, CentOS, AlmaLinux, Rocky Linux, Ubuntu, Debian, and Amazon Linux.

Scaling SUSE Manager

With the "SUSE Manager Hub" multi-server architecture we are gradually introducing a framework that allows you to scale SUSE Manager deployments to hundreds of thousands of nodes using tiered management servers.

SUSE Manager 4.3 further introduces new features in Hub framework, optimizing it for the edge deployments, and fill the gaps by introducing centralized reporting and enhancing ISSv2 by adding capabilities to transfer OS Images and configuration channels from Hub to peripheral servers.

With ever growing Linux footprints you need your management tool be able to scale to tens of thousands of Linux devices and beyond. With the performance and scalability enhancements in 4.3, your SUSE Manager deployment can easily scale in your environment in any direction, while providing better performance than any previous version even in very large-scale environments.

This allows you the flexibility to grow your infrastructure as required by your business needs, with the peace of mind that SUSE Manager will be able to manage your large estate, and the cost implications of growing their footprint will not be exaggeratedly high.

Before you begin , you should always get advice from a SUSE partner, sales engineer, or consultant.

Updating and Configuration Management

With SUSE Manager 4.3, one of the goal is to make typical system administration tasks even more easier. There will be number of improvments when it comes to SSM, action status at given time, to name a few.

Interoperability

One of the main areas that we wanted to improve with SUSE Manager 4.3 is interoperability. Our goal was to make SUSE Manager play well with the existing tools that users already have.

Salt bundle

One effort in this regard has been around salt. SUSE Manager 4.3 comes with salt-bundle. The Salt Bundle can be used on systems that already run another Salt Minion or systems which do not meet Salt’s requirements or already provide a newer salt version that is used instead of the version provided by SUSE Manager.

Containerization

Another goal that we want to achieve in a long run is to enable SUSE Manager to be deployed in container-only environments, independently from the base OS. Allow SUSE Manager components (specifically Proxies/Retail Branch servers) to run in more resource-constrained environments. Edge market is our main audience here with this effort. It will allow users to install SUSE Manager components on top of kubernetes, increasing flexibility and future viability

Enabling SUSE Manager Proxy and Retail Branch Servers to also run in containers, is in SUSE Manager 4.3 scope.

HTTP API

SUSE Manager is seeing more& more use in automated scenarios, where it is a part of a bigger system and driven via its APIs - possibly but not necessarily a CI system.

The XMLRPC protocol has a very low barrier of entry for some use cases, notably Python programs, but as of recent years the industry has favored REST and, in general, HTTP APIs in terms of popularity and tooling support.

With 4.3, we have decided to provide an HTTP API via plain JSON, in addition to the XMLRPC protocol.

Keep Informed

You can stay up-to-date regarding information about SUSE Manager and SUSE products:

Installation

Requirements

SUSE Manager Server 4.3 is provided through SUSE Customer Center and can be installed with the unified installer for SUSE Linux Enterprise 15 Service Pack 4. It is available for x86-64, POWER (ppc64le), or IBM Z (s390x). No separate SUSE Linux Enterprise subscription is required.

With the adoption of a unified installer in SUSE Linux Enterprise 15, system roles are used to customize the installation for each product. The unified installer provides an easier way to install the operating system and the SUSE Manager Server application together with specific pre-configured system settings. This addresses the need for enterprise deployments to standardize on the base operating system as well as on specific storage setups.

PostgreSQL is the only supported database. Using a remote PostgreSQL database is not supported.

Update from previous versions of SUSE Manager Server

In-place update from SUSE Manager Server 4.1 and 4.2 is supported.

All connected clients will continue to run and remain unchanged.

For detailed upgrading instructions, see the Upgrade Guide on https://documentation.suse.com/suma/4.3/.

Major changes since SUSE Manager Server 4.2

Beta 3 release

Technology Preview: Containerized SUSE Manager Proxy and Retail Branch Server

Starting with SUSE Manager 4.3, it will be possible to run the SUSE Manager proxy and Retail branch server also in containers. This could be very helpful in scenarios where adding new virtual machines is not feasible for some reason. Additionally, the ability to run SUSE Manager Proxy and Retail branch servers in containers make it more flexible to run them anywhere without worrying about the underlying OS, while also making it possible to get the advantage of Kubernetes offerings like HA.

Technology Preview: JSON over HTTP API

With SUSE Manager 4.3, in addition to the current XML-RPC API, a new JSON over HTTPI API will also be provided to make SUSE Manager API even easier to consume.

SUSE Manager is seeing more and more use in automated scenarios, where it is a part of a bigger system and driven via its APIs. The XML-RPC protocol has served user well so far and will continue to do so, but HTTP APIs are more in demand and have better tooling support.

Reporting Database improvements

The following improvements have been made in the reporting database

  • Add UI for peripheral server with report database password regeneration

  • Added the server location information to the reporting database

  • detect MgrServer on bootstrap and store report database settings

  • Added Channel information

  • Added System packages information

  • Added OpenScap scans information

  • Added Groups information

  • Added System packages information

  • Added proxy information to the system table

  • Changed table SystemGroup to better reflect its content

  • Added location information to the system table

Improved image management

SUSE Manager 4.3 comes with a lot of improvements for image management.

  • Kiwi images:

    • Uses name and version from Kiwi config file, revision is increased on each build

    • Built image files are referenced in the database and deleted with the image entry

    • Image pillars are stored in the database

    • The build log is visible in the User Interface

  • Docker images:

    • Use a new database entry for each revision

    • Old revision can be shown with the "Show obsolete" checkbox

  • Updated XML RPC API to manipulate with images, image files and pillars:

Debian 11

SUSE Manager 4.3 is now able to manage Debian 11 "bullseye" clients as salt or salt-ssh minions.

For more information about the registration process, refer Registering Debian Clients, and for more information about supported features, consult Supported Debian Features.

HSTS Enabled

HTTP Strict Transport Security (HSTS) is a policy mechanism that helps to protect websites against man-in-the-middle attacks such as protocol downgrade attacks and cookie hijacking. SUSE Manager 4.3 comes with HSTS enabled. Which means each request will need to be HTTPS while plain HTTP requests will be rejected.

Migration from 4.1 and 4.2 to 4.3

It is now possible to migrate from 4.1 and 4.2 to 4.3. The user should upgrade SUSE Manager Server and its related products i-e SUSE Manager Proxy and Retail Branch Server as product is not meant to be run in a mixed-version scenario. When upgrading, upgrade SUSE Manager Server first before upgrading SUSE Manager Proxy or Retail Branch Server.

There is a known issue when migrating to 4.3, please consult the Known Issues section for more detail.

Beta 2 release

New XML-RPC API version 26

SUSE Manager 4.3 Beta 2 updates the XML-RPC API version from 25 to 26.

There are no breaking changes to any methods.

If any of your scripts are checking for the version 25, you can change them to use version 26 without any further changes.

smdba: changed defaults for newer PostgreSQL versions

Starting with PostgreSQL 13, some defaults have changed.

To improve performance, smdba autotuning was adapted to use the new values.

Additionally an extra paramater --ssd was added to autotuning to tell smdba that the database is stored on ssd or fast network storage.

To change an existing configuration with the new defaults call

smdba system-check autotuning

Remember you can also adjust some other parameters, in case you need them:

smdba system-check autotuning [--max_connections=<number>] [--ssd]

Monitoring: Grafana 8.3.5

SUSE Manager 4.3 Beta 2 updates Grafana from version 7.5.12 to 8.3.5.

This update fixes several security vulnerabilities:

  • XSS vulnerability in handling data sources (CVE-2022-21702)

  • Cross-origin request forgery vulnerability (CVE-2022-21703)

  • Insecure Direct Object Reference vulnerability in Teams API (CVE-2022-21713)

  • GetUserInfo: return an error if no user was found (CVE-2022-21673)

Updating Grafana is strongly recommended.

Relevant changes are:

  • New Alerting for Grafana 8

  • CloudWatch: Add support for AWS Metric Insights

  • CloudWatch: Add AWS RoboMaker metrics and dimension

  • CloudWatch: Add AWS Transfer metrics and dimension

  • CloudWatch: Add AWS LookoutMetrics

  • CloudWatch: Add Lambda@Edge Amazon CloudFront metrics

  • CloudMonitoring: Add support for preprocessing

  • CloudWatch: Add AWS/EFS StorageBytes metric

  • CloudWatch: Add Amplify Console metrics and dimensions

  • CloudWatch: Add metrics for managed RabbitMQ service

  • Elasticsearch: Add support for Elasticsearch 8.0

  • AzureMonitor: Add support for PostgreSQL and MySQL Flexible Servers

  • AzureMonitor: Add Azure Resource Graph

  • AzureMonitor: Add support for Microsoft.SignalRService/SignalR metrics

Check the upstream changelog for more details on what has changed.

There is one breaking change:

  • Grafana 8 Alerting enabled by default for installations that do not use legacy alerting.

SUSE Manager does not use Grafana alerting, so if you do not need it, you can disable it at the Grafana WebUI.

If you use legacy Grafana alerting in your environment, consider migrating to new Grafana 8 alerting.

Monitoring: Prometheus 2.32.1

SUSE Manager 4.3 Beta 2 updates Prometheus from version 2.27.1 to 2.32.1.

The new version contains some breaking changes that need to be addressed after the SUSE Manager is updated.

Breaking changes:

  • Uyuni Service Discovery: The configuration and the returned set of meta labels have changed. Please check the upstream documentation for more details.

  • As a consequence all users with existing monitoring setup must reapply the highstate on the monitoring server(s).

Important changes:

  • Introduced generic HTTP-based service discovery.

  • New expression editor with advanced autocompletion, inline linting, and syntax highlighting.

  • Discovering Kubernetes API servers using a kubeconfig file.

  • Faster server restart times via snapshotting.

  • Controlling scrape intervals and timeouts via relabeling.

Check the upstream changelog for more details on what has changed.

Salt SSH now uses the Salt Bundle

The Salt Bundle is now used to handle Salt SSH executions on the client side. The bootstrap of new Salt clients using webUI or API is now also using the Salt Bundle.

To ensure bootstrap works in the proper way, the bootstrap repositories for the clients must be regenerated before bootstrapping new clients.

The bootstrap repository regeneration happens for any given product when a resync for the product repositories happens:

  • For products provided by the SUSE Customer Center, added via de Setup Wizard or mgr-sync, this happens each night.

  • For products added via spacewalk-common-channels there is no automated resync by default, unless it was configured after adding the product. In this case, the regeneration needs to be trigger manually.

To manually trigger the regeneration, use the tool mgr-create-bootstrap-repo at the SUSE Manager Server.

Beta 1 release

Salt 3004

Salt has been upgraded to upstream version 3004, plus a number of patches, backports and enhancements by SUSE, for the SUSE Manager Server, Proxy and Client Tools.

We intend to regularly upgrade Salt to more recent versions.

For more details about changes in your manually-created Salt states, see the Salt 3004 upstream release notes.

Reporting Database

The reporting database provides Uyuni data used for reports in a simplified schema, and is accessible by any reporting tool with support for SQL databases as content sources.

This new database database is isolated from the one used for the Uyuni Server, and created automatically.

The uyuni-setup-reportdb-user can create new users which have access to the data.

For more information on this topic, see Hub reporting.

PostgreSQL 14

The database engine has been updated from PostgreSQL 13 to PostgreSQL 14, which brings a number of performance and reliability improvements. A detailed changelog is available upstream.

To prevent inconsistent configurations and data on upgrade or update, SUSE Manager 4.3 will refuse to start until the database migration from PostgreSQL 13 to PostgreSQL 14 has completed successfully.

Base system upgrade

The base system was upgraded to SUSE Linux Enterprise 15 SP4.

Dropped features

CaaSP support

We had added CaaSP support in previous versions but unfortunately, CaaSP got disconnected and no further development will be happening there.

The currently released versions of CaaSP will soon be going EOL and this naturally implies that we should also remove all the bits related to it from SUSE Manager.

Deprecated features

Traditional Stack has been deprecated

With SUSE Manager 4.3 release, traditional stack has been deprecated.

The release that follows SUSE Manager 4.3 will not support traditional clients and traditional proxies, and is planned for 2023. We encourage all new deployments to use Salt clients and Salt proxies exclusively, and to migrate existing traditional clients and proxies to Salt.

Unsupported products

  • Red Hat Enterprise Linux 6

  • SUSE Linux Enterprise Server Expanded Support 6

  • Oracle Linux 6

  • CentOS 6

  • CentOS 8

  • Ubuntu 16.04

  • SUSE Linux Enterprise Server 11

We highly encourage you to migrate your workload to a newer version of each distribution, or to an alternative distribution that is still supported, so you can continue managing your infrastructure with SUSE Manager.

Please note that we will not break things on purpose for these unsupported products, and there is a possibility that they could still continue to work. But if things break, there will not be any support provided, not even on a best-effort basis.

Deprecated products

  • Debian 9 (after EOL 2022-06-30)

The support policy of SUSE Manager clients can be summarized as: "if the operating system is under general support by its vendor, then SUSE Manager supports it as a client".

After the EOL of a product, for a grace period of 3 months, a product will be considered as deprecated before moving to unsupported.

For deprecated products, support will only be provided on a best-effort basis.

Upgrade

Upgrading with SUSE Manager Proxy

SUSE Manager Server 4.3 works with SUSE Manager Proxy 4.1/4.2 and SUSE Manager Retail Branch Server 4.1/4.2 but only for upgrade purposes. The product is not intented to be used in a mixed-version scenario in production. When upgrading, upgrade the SUSE Manager Server first, followed by the SUSE Manager Proxy and Retail Branch Servers.

For instructions on upgrading when SUSE Manager Proxy or SUSE Manager Retail Branch Servers are in use, see the Upgrade Guide on https://documentation.suse.com/suma/4.3/.

Upgrading with inter-server synchronization

When upgrading, upgrade the ISS master first, followed by the ISS slaves.

Support

Supportconfig confidentiality disclaimer

When handling Service Requests, supporters and engineers may ask for the output of the supportconfig tool from SUSE Manager Server or clients.

This disclaimer applies:

Detailed system information and logs are collected and organized in a
manner that helps reduce service request resolution times.
Private system information can be disclosed when using this tool.

If this is a concern, please prune private data from the log files.

Several startup options are available to exclude more sensitive
information. Supportconfig data is used only for diagnostic purposes
and is considered confidential information.

When you run supportconfig on the SUSE Manager Server, the output will contain information about your clients as well as about the Server. In particular, debug data for the subscription matching feature contains a list of registered clients, their installed products, and some minimal hardware information (such as the CPU socket count). It also contains a copy of the subscription data available from the SUSE Customer Center.

If this is a concern, please prune data in the subscription-matcher directory in the spacewalk-debug tarball before sending it to SUSE.

Support for SLE Micro

SLE Micro is only supported as a Salt minion. The traditional stack will not be supported.

Supportability of embedded software components

All software components embedded into SUSE Manager, like Cobbler for PXE booting, are only supported in the context of SUSE Manager. Stand-alone usage (e. g. Cobbler command-line) is not supported.

Support for older products

The SUSE Manager engineering team provides 'best effort' support for products past their end-of-life date. For more information about product support, see Product Support Lifecycle.

Support for products that are considered past their end-of-life is limited to assisting you to bring production systems to a supported state. This could be either by migrating to a supported service pack or by upgrading to a supported product version.

Support for RHEL, CentOS and Oracle Linux Clients

SUSE Manager supports only the latest RHEL 7 and 8 minor release clients. Older minor releases might still work but will only be supported on a limited and reasonable-effort basis.

The same rule applies to CentOS, Oracle Linux and SLES Expanded Support.

CentOS Stream is explicitly not supported by SUSE. You may try to register CentOS Stream clients by:

  1. Using the spacewalk-common-channels command-line tool to synchronize the product

  2. Using the CentOS Stream client tools from the upstream Uyuni Project.

Support for Ubuntu Clients

SUSE Manager supports Ubuntu 18.04 LTS and 20.04 LTS clients using Salt. Traditional clients are not supported.

Support for Ubuntu is limited to a growing list of specific features. For a detailed list of supported features, check the Client Configuration Guide.

Support for Debian Clients

SUSE Manager supports Debian 10 "Buster" & Debian 11 "bullseye" clients using Salt. Traditional clients are not supported.

Support for Debian is limited to a growing list of specific features. For a detailed list of supported features, check the Client Configuration Guide.

L1 support for RHEL and CentOS ppc64le clients

For RHEL and CentOS clients on the ppc64le architecture, SUSE Manager offers the same functionality that is supported for the x86_64 architecture. Client tools are not available yet from SCC but the CentOS 7 client tools from Uyuni can be enabled using spacewalk-common-channels. CentOS 8 is dead.

RHEL and CentOS ppc64le are only supported at L1 level support. L1 support is limited to problem determination, which means technical support designed to provide compatibility information, usage support, on-going maintenance, information gathering, and basic troubleshooting using available documentation. At the time of writing, any problems or bugs specific to RHEL and CentOS on ppc64le will only be fixed on a best-effort basis.

Please contact your Sales Engineer or SUSE Consulting if you need additional support or features for these operating systems.

Browser support

Microsoft Internet Explorer fails to render some parts of the SUSE Manager Web UI and is therefore not a supported browser, in any version.

Please refer to the General Requirements for a list of supported browsers.

SUSE Manager installation

The SUSE Unified Installer, and installing SUSE Manager on top of SLE JeOS, are the only supported mechanisms to install SUSE Manager.

Known issues

Migration from 4.1 and 4.2 to 4.3

SUSE Manager 4.3 is the base product for SLE15 SP4, this applies to Server, Proxy, and Retail Branch Server. In SLE 15 SP4, sle-module-python2 is no longer available (in favor of sle-module-python3). This means that migration(using yast2 migration or zypper migration) from 4.1/4.2 to 4.3 will not work without deactivating this module first. yast2 and zypper raise the following error if the module is still activated during migration

Can't get available migrations from server: SUSE::Connect::ApiError: There are activated extensions/modules on this system that cannot be migrated.
Deactivate them first, and then try migrating again.
The product(s) are 'Python 2 Module 15 SP3 x86_64'.
You can deactivate them with:
SUSEConnect -d -p sle-module-python2/15.3/x86_64

As suggested in the error message one can deactivate the module using SUSEConnect -d -p sle-module-python2/15.3/x86_64.

After this, migration should work.

Container build host and salt bundle

Conatiner build host will not work with salt bundle, we are working on the fix. In the meanwhile, in case of Container build host, don’t use salt bundle but rather normal salt.

Registering Spacewalk 2.x/Red Hat Satellite 5.x clients to SUSE Manager as Salt minions

If a client machine is running the Red Hat Satellite 5.x agent, registering it to SUSE Manager as a Salt minion will fail due to package conflicts.

Registering a RH Satellite 5.x client as a SUSE Manager traditional client works fine.

Registering a SUSE Manager traditional client as a SUSE Manager Salt minion will also work.

Works Fails

RH Satellite 5.x ⇒ SUSE Manager traditional

RH Satellite 5.x ⇒ SUSE Manager Salt minion

SUSE Manager traditional ⇒ SUSE Manager Salt minion

In order to register Red Hat Satellite 5.x clients to SUSE Manager as Salt minions, you will need to modify the bootstrap script to remove the Satellite agent packages first.

Spacewalk 2.x and Oracle Spacewalk 2.x clients will show the same behavior as Red Hat Satellite 5.x clients

Providing feedback

If you encounter a bug in any SUSE product, please report it through your support contact or in the SUSE Forums:

Resources

Latest product documentation: https://documentation.suse.com/suma/4.3/.

Technical product information for SUSE Manager: https://www.suse.com/products/suse-manager/

These release notes are available online: https://www.suse.com/releasenotes/

Visit https://www.suse.com for the latest Linux product news from SUSE.

Visit https://www.suse.com/download-linux/source-code.html for additional information on the source code of SUSE Linux Enterprise products.

SUSE Software Solutions Germany GmbH
Maxfeldstr. 5
D-90409 Nürnberg
Tel: +49 (0)911 740 53 - 0
Email: feedback@suse.com
Registrierung/Registration Number: HRB 36809 AG Nürnberg
Managing Director/Geschäftsführer: Ivo Totev

SUSE makes no representations or warranties with regard to the contents or use of this documentation, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. Further, SUSE reserves the right to revise this publication and to make changes to its content, at any time, without the obligation to notify any person or entity of such revisions or changes.

Further, SUSE makes no representations or warranties with regard to any software, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. Further, SUSE reserves the right to make changes to any and all parts of SUSE software, at any time, without any obligation to notify any person or entity of such changes.

Any products or technical information provided under this Agreement may be subject to U.S. export controls and the trade laws of other countries. You agree to comply with all export control regulations and to obtain any required licenses or classifications to export, re-export, or import deliverables. You agree not to export or re-export to entities on the current U.S. export exclusion lists or to any embargoed or terrorist countries as specified in U.S. export laws. You agree to not use deliverables for prohibited nuclear, missile, or chemical/biological weaponry end uses. Please refer to the SUSE Legal information page for more information on exporting SUSE software. SUSE assumes no responsibility for your failure to obtain any necessary export approvals.

Copyright © 2012-2022 SUSE LLC.

This release notes document is licensed under a Creative Commons Attribution-NoDerivatives 4.0 International License (CC-BY-ND-4.0). You should have received a copy of the license along with this document. If not, see https://creativecommons.org/licenses/by-nd/4.0/.

SUSE has intellectual property rights relating to technology embodied in the product that is described in this document. In particular, and without limitation, these intellectual property rights may include one or more of the U.S. patents listed at https://www.suse.com/company/legal/ and one or more additional patents or pending patent applications in the U.S. and other countries.

For SUSE trademarks, see SUSE Trademark and Service Mark list (https://www.suse.com/company/legal/). All third-party trademarks are the property of their respective owners.

Colophon

Thank you for using SUSE Manager Server in your business.

Your SUSE Manager Server Team.