What I want to be able to do:
- Centralized package management.
- Keep systems updated without downloading entire repos (i.e. if a system doesn't have Libreoffice on it, I don't want to have to download any Libreoffice packages).
- Run automated testing of packages before deploying them, and
- Keep specific packages- which are mission critical- and their dependencies subject to more exhaustive testing (including automated components), which involve some human intervention to approve.
Really, keeping everything up to date isn't necessarily- the most important thing is automatically testing and keeping up to date with security patches in non-mission-critical packages (and putting mission-critical patches through more rigorous testing).
What I've looked into so far
I know about spacewalk and pulp, but for a number of reasons (shoddy documentation, the fact that it requires ugly hacks to avoid downloading entire large repositories unnecessarily regardless of what you have on a given system) I have ruled them out as options. We do use Puppet, but on its own that isn't the right tool for the job, here.
yum alone certainly has some of what I'd need, but (unless there's something I'm missing) it, too, (alone) doesn't really seem like the right tool for the job. At the moment, I'm also looking into foreman but I'm not sure whether that's the right place to look, either, and I know most of the functionality it provides really isn't about addressing this kind of issue.