Satellite on prem vs hosted, read for posture.
The Satellite on prem vs hosted decision is sold by Red Hat as an operational choice and read by the audit reading as a posture choice. The on prem deployment keeps content management, entitlement reconciliation, and inventory inside the buyer's network; the hosted path moves the same functions into the Red Hat Hybrid Cloud Console. The two paths cost differently, surface differently in the audit reading, and carry different exit costs at renewal. This note walks the difference, the operational trade offs, and the buyer side posture that keeps the choice deliberate.
The two paths in plain language.
Red Hat Satellite is the on prem content and lifecycle management server for RHEL hosts. The buyer installs the Satellite server on infrastructure under the buyer's control, registers RHEL hosts against the server, configures content views and lifecycle environments, and uses the server as the central point for package distribution, errata management, configuration policy, and subscription reconciliation. The Satellite server holds the entitlement view of the registered estate; the entitlement view is inside the buyer's perimeter.1
The hosted path is the Red Hat Hybrid Cloud Console, formerly cloud.redhat.com, with the Subscription Watch, Insights, Inventory, and Image Builder services. The buyer registers hosts directly against the hosted console rather than against an on prem Satellite. The console holds the entitlement view, the inventory, the vulnerability data, the compliance data, the patching recommendations, and the image building pipeline. The entitlement view is outside the buyer's perimeter; the view lives in Red Hat's hosted infrastructure.2
The two paths are not mutually exclusive. A buyer may run on prem Satellite and also register hosts to Insights in the Hybrid Cloud Console; a buyer may run hosted only; a buyer may run on prem only. The combinations matter because each combination has a different audit surface. The context for the comparison is the broader Satellite practice reading at the Satellite practice hub and the Insights data discussion at Insights data sharing implications.
The subscription difference between the two paths.
The on prem Satellite path requires the Satellite server subscription itself. The server subscription is priced separately from the RHEL host subscriptions; the buyer pays for the server seats, the storage and infrastructure to run the Satellite environment, and the operations time to maintain it. The on prem Satellite also typically requires the Smart Management add on against each managed RHEL host; the add on is the entitlement that allows the host to be managed by Satellite at the configuration, patch, and lifecycle level. The full discussion of the add on lives at Satellite Smart Management entitlements.
The hosted path does not require the Satellite server subscription. The hosted path requires only the RHEL host subscription with the relevant capabilities turned on in the host's entitlement; Insights is included with many RHEL subscription variants by default, and the broader hosted services are bundled into the same console. The hosted path appears, on first read, to be cheaper. The first read is not always the right read.3
The cost line does not stop at the subscription. The on prem Satellite carries an operations cost the hosted path does not; the hosted path carries an entitlement gravity the on prem Satellite does not. A buyer with five thousand RHEL hosts in the hosted console is, by virtue of the console's structure, more visible to Red Hat than a buyer with five thousand RHEL hosts behind an on prem Satellite that reports nothing externally. The visibility is the price the hosted path adds back.
The data difference and what the audit reading sees.
The data difference between the on prem and hosted paths is the central buyer side reading. The on prem Satellite holds the inventory, the entitlement reconciliation, and the lifecycle data inside the buyer's perimeter. None of those data sets is automatically visible to Red Hat. The audit reading against an on prem Satellite shop has to build its inventory from contractual records, the buyer's own attestation, and any voluntarily shared exports. The audit reading's starting position is procurement records and the buyer's narrative.
The hosted path inverts this. The Hybrid Cloud Console holds the inventory, the entitlement reconciliation, the vulnerability and compliance reports, and the patching history. The data lives in the hosted service that Red Hat operates. The audit reading against a hosted shop opens with the console's own view; the starting position is the data, not the narrative. The audit's first row is computed by the same service that produces the buyer's operational dashboard.4
The two readings produce different defensive postures. The on prem Satellite shop has a defensive position rooted in evidence control: what the audit reading sees is what the buyer provides, and the buyer's provision schedule is under buyer control. The hosted shop has a defensive position rooted in evidence shaping: the data is what it is, and the buyer's posture is to keep the data clean rather than to control the disclosure of it. Both postures are defensible; the trade off is between control of the disclosure and control of the data itself.
For the audit defense entry, see audit defense. For the deployment evidence discussion that frames both readings, see deployment evidence in audit defense.
The operational trade off in the buyer's hands.
The on prem Satellite path has operational benefits the hosted path does not. The on prem server can sit in a disconnected or air gapped environment, which is required for many regulated and federal scopes. The on prem server can serve content to hosts in offline networks. The on prem server can be configured against the buyer's identity and access management infrastructure, which keeps the operational and security teams' tooling consistent. The on prem server's configuration is in the buyer's automation tooling, which keeps the change history in the buyer's version control.5
The hosted path has operational benefits the on prem path does not. The hosted path eliminates the infrastructure to maintain. The hosted path provides the broader Insights advisor logic without an additional configuration step. The hosted path's update cadence is handled by Red Hat; the buyer does not patch the Satellite server itself. The hosted path provides image building and elasticity features that the on prem path does not match without significant additional integration. The hosted path's data is also available from any operations location, which simplifies a distributed operations model.
The decision between the two paths is operational at the surface and commercial below the surface. The operations team has a strong preference for one or the other based on its operations model; the procurement team has a different reading based on the cost line and the audit exposure; the security team has a third reading based on the data control posture.6
| Posture dimension | On prem | Hosted |
|---|---|---|
| Subscription cost line | higher | lower |
| Operations cost line | higher | lower |
| Data control posture | strong | weaker |
| Audit reading start point | narrative | data |
| Disconnected operation | supported | no |
What the choice means at renewal.
The renewal reading of the Satellite path choice has three threads. The first is the Smart Management line item. The on prem Satellite path makes the Smart Management add on a load bearing element of the contract; the hosted path makes the same add on largely irrelevant because the equivalent functions live in the bundled console. A buyer with an on prem Satellite is contractually attached to the Smart Management line; a buyer on the hosted path is not.
The second thread is the Satellite server subscription itself. A buyer that migrates from on prem to hosted in the year before renewal eliminates a discrete subscription line; a buyer that migrates from hosted to on prem adds one. Either direction changes the renewal scope materially, and the negotiation should be conducted with the direction declared and the timing controlled. The renewal mechanics belong in the discussion at renewal negotiation.
The third thread is the exit posture. The on prem Satellite produces an environment that is easier to lift to an alternative content management approach because the data and the operational model are under the buyer's control; the hosted path produces an environment that is harder to lift because the operational data and tooling live in Red Hat's hosted service. The exit posture matters in the renewal negotiation because credible exit is leverage; the exit posture discussion lives at credible migration plan as leverage.7
For a desk engagement on the path choice, see the contact form. For the broader subscription assessment that frames the choice, see subscription assessment.
Notes & references
- 1. Red Hat Satellite documentation is published on access.redhat.com. The product architecture, the content view and lifecycle environment model, and the registration mechanics for managed hosts are described there. Satellite is the on prem implementation of Foreman with Katello integration; the product has a long operational history in regulated and government scopes.
- 2. The Red Hat Hybrid Cloud Console replaced the earlier cloud.redhat.com presentation and bundles the Insights, Subscription Watch, Inventory, and Image Builder services. The console is documented separately from Satellite and is a hosted service operated by Red Hat.
- 3. The first read on the hosted path's cost is typically lower than the on prem path because the Satellite server subscription is eliminated. The full read should include the audit surface, the data control posture, and the renewal exit posture, all of which move in the other direction.
- 4. The audit reading's starting position differs materially between the two paths. The practice observes this consistently across engagements; an on prem Satellite shop typically opens with a narrative defense, while a hosted shop typically opens with a data defense. Neither is preferable in general; the appropriate defense depends on the underlying estate.
- 5. Disconnected and air gapped operation is a feature of on prem Satellite and is required for several regulated scopes. A federal scope, a financial scope with strict segmentation, or a classified scope each push toward the on prem path; the buyer side reading should not treat the choice as purely commercial in these scopes.
- 6. The practice observes the three sided decision pattern consistently in larger buyers: operations, procurement, and security each have a different read on the path choice. The buyer side posture is to surface all three reads in the same review rather than to allow one team's preference to drive the decision.
- 7. The exit posture difference between the two paths is meaningful at renewal. A credible exit is leverage; an on prem Satellite produces a credible exit posture more easily than the hosted path because the operational data and the automation stay in the buyer's control.
Preparing a response? The practice keeps a one-page Red Hat audit response checklist — what to acknowledge, what to preserve, and what not to volunteer in the first fourteen days after the letter arrives.