Chapter 4. Upgrading Satellite or Capsule to Red Hat Enterprise Linux 8 In-Place Using Leapp

Use this procedure to upgrade your Satellite or Capsule installation from Red Hat Enterprise Linux 7 to Red Hat Enterprise Linux 8.


  • Satellite 6.11 or Capsule 6.11 running on Red Hat Enterprise Linux 7.
  • Review Known Issues before you begin an upgrade. For more information, see Known Issues in Red Hat Satellite 6.11.
  • If you previously upgraded Satellite or Capsule from an earlier version, and the /var/lib/pgsql contained the PostgreSQL database content before the migration from PostgreSQL 9 to PostgreSQL 12 from the SCL, empty /var/lib/pgsql before proceeding.
  • During the upgrade, the PostgreSQL data is moved from /var/opt/rh/rh-postgresql12/lib/pgsql/data/ to /var/lib/pgsql/data/. If these two paths reside on the same partition, no further action is required. If they reside on different partitions, ensure that there is enough space for the data to be copied over. You can move the PostgreSQL data on your own and the upgrade will skip this step if /var/opt/rh/rh-postgresql12/lib/pgsql/data/ does not exist.

Prerequisites for Disconnected Environment

If you run Satellite in a disconnected environment, ensure it also meets the following prerequisites:

  • Satellite supports DEFAULT and FIPS crypto-policies. The FUTURE crypto-policy is not supported for Satellite and Capsule installations.
  • In-place upgrade of Red Hat Enterprise Linux systems in FIPS mode is not supported by Red Hat. Turning FIPS off, upgrading from Red Hat Enterprise Linux 7 to Red Hat Enterprise Linux 8, and then turning FIPS on is not supported either. Instead, migrate your Satellite 6.11 to a freshly installed Red Hat Enterprise Linux 8 system with FIPS mode enabled. For more information, see Chapter 5, Migrating Satellite to a New Red Hat Enterprise Linux System.


  1. Configure the repositories to obtain Leapp.

    On Red Hat Enterprise Linux, enable the rhel-7-server-extras-rpms repository:

    # subscription-manager repos --enable=rhel-7-server-extras-rpms
  2. Install required packages:

    # satellite-maintain packages install leapp leapp-repository
  3. For Leapp to perform the upgrade in a disconnected environment, download the metadata and manually extract, as described in Leapp utility metadata in-place upgrades of RHEL for disconnected upgrades.
  4. Set up the following repositories to perform the upgrade in a disconnected environment:

    1. /etc/yum.repos.d/rhel8.repo:

    2. /etc/yum.repos.d/satellite.repo:

  5. Configure Leapp to skip updating the Tomcat packages to ensure the upgrade does not fail:

    # echo tomcat >> /etc/leapp/transaction/to_remove
    # echo tomcat-lib >> /etc/leapp/transaction/to_remove
  6. Let Leapp analyze your system:

    # leapp preupgrade

    If you run Satellite in a disconnected environment, add the --no-rhsm and --enablerepo parameters:

    # leapp preupgrade \
    --no-rhsm \
    --enablerepo BaseOS \
    --enablerepo AppStream \
    --enablerepo satellite-6.11-for-rhel-8-x86_64-rpms \
    --enablerepo satellite-maintenance-6.11-for-rhel-8-x86_64-rpms

    The first run is expected to fail but report issues and inhibit the upgrade. Examine the report in the /var/log/leapp/leapp-report.txt file, answer all questions (using leapp answer), and manually resolve the other reported problems.

    The following commands show the most common steps required:

    # rmmod pata_acpi
    # echo PermitRootLogin yes | tee -a /etc/ssh/sshd_config
    # leapp answer --section remove_pam_pkcs11_module_check.confirm=True

    If leapp preupgrade inhibits the upgrade with Unsupported network configuration because there are multiple legacy named network interfaces, follow the instructions shown by Leapp to rename the interfaces, followed by an installer run to reconfigure Satellite or Capsule to use the new interface names:

    # satellite-installer --help |grep 'interface.*eth'
        --foreman-proxy-dhcp-interface  DHCP listen interface (current: "eth0")
        --foreman-proxy-dns-interface  DNS interface (current: "eth0")

    If eth0 was renamed to em0, call the installer to use the new interface name with:

    # satellite-installer --foreman-proxy-dhcp-interface=em0 --foreman-proxy-dns-interface=em0
  7. Ensure leapp preupgrade has no issues.
  8. Run:

    # leapp upgrade

    If you run Satellite in a disconnected environment, add the --no-rhsm and --enablerepo parameters:

    # leapp upgrade \
    --no-rhsm \
    --enablerepo BaseOS \
    --enablerepo AppStream \
    --enablerepo satellite-6.11-for-rhel-8-x86_64-rpms \
    --enablerepo satellite-maintenance-6.11-for-rhel-8-x86_64-rpms
  9. Reboot the system.

    After the system reboots, a live system conducts the upgrade, reboots to fix SELinux labels, then reboots into the final Red Hat Enterprise Linux 8 system.

  10. Leapp finishes the upgrade, watch it with:

    # journalctl -u leapp_resume -f
  11. Complete these procedures in Upgrading from RHEL 7 to RHEL 8:

    1. Unlock packages:

      # satellite-maintain packages unlock
    2. Verifying the post-upgrade state of the RHEL 8 system
    3. Performing post-upgrade tasks
    4. Lock packages:

      # satellite-maintain packages lock
  12. For Satellite only and not Capsule, if you require SELinux to be in enforcing mode, run the following command before changing SELinux to enforcing mode:

    # dnf reinstall foreman-selinux katello-selinux --disableplugin=foreman-protector
  13. Complete the steps for changing SELinux to enforcing mode described in Changing SELinux mode to enforcing in the Upgrading from RHEL 7 to RHEL 8 guide.
  14. Unset the subscription-manager release:

    # subscription-manager release --unset