Pulp

Here is a proposal to update nodes to use ZERO symlinks.

In the nodes apache configuration add:

+Alias /pulp/nodes/https/content /var/www/pulp/nodes/https/content
+<Directory /var/www/pulp/nodes/https/repos >
+  Options FollowSymLinks Indexes
+  SSLRequireSSL
+  SSLVerifyClient require
+  SSLVerifyDepth  5
+  SSLOptions +FakeBasicAuth
+  SSLRequire %{SSL_CLIENT_S_DN_O} eq "PULP" and %{SSL_CLIENT_S_DN_OU} eq "NODES"
+</Directory>

To expose /var/lib/pulp/content at: /pulp/nodes/https/content and protect it using the node certificate.

The published manifest contains a base url property today that the child uses to construct urls to download content. The manifest would be augmented to include a new property having the value of: '/var/www/pulp/nodes/https/content'. The child node (importer) would use this information (when available) when constructing the download urls instead. If not available, it would construct the urls as it does today.

After upgrade:

The parent node (satellite):

On the next node publish will generate a new manifest and NOT create any symlinks. Any existing symlinks are cleaned up as part of the atomic publish.

The child node (capsule):

On the next node sync, the new manifest is downloaded. When content needs to be downloaded, the new property is noticed and used to construct the download URL.

So, no migration required unless we want to do this without requiring users to run a node publish. But not sure that is worth the extra effort.