RHSM: Adjust the switch to container mode for new RHSM

[pirat89]

RHSM in RHEL 8.9+ & RHEL 9.3+ requires newly for the switch to the container mode existence and content under /etc/pki/entitlement-host, which in our case should by symlink to /etc/pki/entitlement.

So currently we need for the correct switch 2 symlinks:

• /etc/pki/rhsm-host -> /etc/pki/rhsm
• /etc/pki/entitlement-host -> /etc/pki/entitlement

Technically we need that only for RHEL 8.9+ but discussing it with RHSM SST, we can do this change unconditionally for any RHEL system as older versions of RHSM do not check /etc/pki/entitlement-host.

jira: RHEL-14839

[github-actions]

Thank you for contributing to the Leapp project!

Please note that every PR needs to comply with the Leapp Guidelines and must pass all tests in order to be mergeable.
If you want to request a review or rebuild a package in copr, you can use following commands as a comment:

• review please @oamg/developers to notify leapp developers of the review request
• /packit copr-build to submit a public copr build using packit

Packit will automatically schedule regression tests for this PR's build and latest upstream leapp build. If you need a different version of leapp from PR#42, use /packit test oamg/leapp#42

It is possible to schedule specific on-demand tests as well. Currently 2 test sets are supported, beaker-minimal and kernel-rt, both can be used to be run on all upgrade paths or just a couple of specific ones.
To launch on-demand tests with packit:

• /packit test --labels kernel-rt to schedule kernel-rt tests set for all upgrade paths
• /packit test --labels beaker-minimal-8.9to9.3,kernel-rt-8.9to9.3 to schedule kernel-rt and beaker-minimal test sets for 8.9->9.3 upgrade path

[Deprecated] To launch on-demand regression testing public members of oamg organization can leave the following comment:

• /rerun to schedule basic regression tests using this pr build and latest upstream leapp build as artifacts
• /rerun 42 to schedule basic regression tests using this pr build and leapp*PR42* as artifacts
• /rerun-sst to schedule sst tests using this pr build and latest upstream leapp build as artifacts
• /rerun-sst 42 to schedule sst tests using this pr build and leapp*PR42* as artifacts

Please open ticket in case you experience technical problem with the CI. (RH internal only)

Note: In case there are problems with tests not being triggered automatically on new PR/commit or pending for a long time, please contact leapp-infra.

[abadger]

Just a cosmetic question: you mentioned that this is only needed for RHEL-8.9+. On older releases, does this result in a dangling symlink or does the /etc/pki/entitlement file exist there as well? (I don't see how a dangling symlink would cause a failure since it's unused on those older versions so that's why I don't consider the answer to this question to be a blocker).

[pirat89]

@abadger yes, the directory exists on all systems. the difference is that /etc/pki/entitlement-host has not been created in the past and was not checked by rhsm. so in both cases it is not expected that our symlink will be dangling.

RHEL 7 subscribed system:

[root@localhost ~]# ls /etc/pki
CA  ca-trust  consumer  entitlement  java  nssdb  nss-legacy  product  product-default  rpm-gpg  rsyslog  tls

(owned by subscription-manager rpm)

[evgeni]

This broke upgrades on systems that don't have entitlements at all (CentOS Stream 8 in my case, but I guess also others that don't have sub-man installed):

Traceback (most recent call last):
  File "/usr/lib64/python3.6/multiprocessing/process.py", line 258, in _bootstrap
    self.run()
  File "/usr/lib64/python3.6/multiprocessing/process.py", line 93, in run
    self._target(*self._args, **self._kwargs)
  File "/usr/lib/python3.6/site-packages/leapp/repository/actor_definition.py", line 74, in _do_run
    actor_instance.run(*args, **kwargs)
  File "/usr/lib/python3.6/site-packages/leapp/actors/__init__.py", line 289, in run
    self.process(*args)
  File "/etc/leapp/repos.d/system_upgrade/common/actors/targetuserspacecreator/actor.py", line 58, in process
    userspacegen.perform()
  File "/usr/lib/python3.6/site-packages/leapp/utils/deprecation.py", line 42, in process_wrapper
    return target_item(*args, **kwargs)
  File "/etc/leapp/repos.d/system_upgrade/common/actors/targetuserspacecreator/libraries/userspacegen.py", line 857, in perform
    _create_target_userspace(context, indata.packages, indata.files, target_repoids)
  File "/etc/leapp/repos.d/system_upgrade/common/actors/targetuserspacecreator/libraries/userspacegen.py", line 826, in _create_target_userspace
    _prep_repository_access(context, target_path)
  File "/etc/leapp/repos.d/system_upgrade/common/actors/targetuserspacecreator/libraries/userspacegen.py", line 403, in _prep_repository_access
    _copy_certificates(context, target_userspace)
  File "/etc/leapp/repos.d/system_upgrade/common/actors/targetuserspacecreator/libraries/userspacegen.py", line 364, in _copy_certificates
    context.copytree_from('/etc/pki', target_pki)
  File "/etc/leapp/repos.d/system_upgrade/common/libraries/mounting.py", line 220, in copytree_from
    shutil.copytree(self.full_path(src), dst)
  File "/usr/lib64/python3.6/shutil.py", line 365, in copytree
    raise Error(errors)
shutil.Error: [('/var/lib/leapp/scratch/mounts/root_/system_overlay/etc/pki/entitlement-host', '/var/lib/leapp/el9userspace/etc/pki/entitlement-host', "[Errno 2] No such file or directory: '/var/lib/leapp/scratch/mounts/root_/system_overlay/etc/pki/entitlement-host'")]
2023-11-01 19:20:16.661 ERROR    PID: 37030 leapp.workflow.TargetTransactionFactsCollection: Actor target_userspace_creator has crashed: Traceback (most recent call last):
  File "/usr/lib/python3.6/site-packages/leapp/repository/actor_definition.py", line 74, in _do_run
    actor_instance.run(*args, **kwargs)
  File "/usr/lib/python3.6/site-packages/leapp/actors/__init__.py", line 289, in run
    self.process(*args)
  File "/etc/leapp/repos.d/system_upgrade/common/actors/targetuserspacecreator/actor.py", line 58, in process
    userspacegen.perform()
  File "/usr/lib/python3.6/site-packages/leapp/utils/deprecation.py", line 42, in process_wrapper
    return target_item(*args, **kwargs)
  File "/etc/leapp/repos.d/system_upgrade/common/actors/targetuserspacecreator/libraries/userspacegen.py", line 857, in perform
    _create_target_userspace(context, indata.packages, indata.files, target_repoids)
  File "/etc/leapp/repos.d/system_upgrade/common/actors/targetuserspacecreator/libraries/userspacegen.py", line 826, in _create_target_userspace
    _prep_repository_access(context, target_path)
  File "/etc/leapp/repos.d/system_upgrade/common/actors/targetuserspacecreator/libraries/userspacegen.py", line 403, in _prep_repository_access
    _copy_certificates(context, target_userspace)
  File "/etc/leapp/repos.d/system_upgrade/common/actors/targetuserspacecreator/libraries/userspacegen.py", line 364, in _copy_certificates
    context.copytree_from('/etc/pki', target_pki)
  File "/etc/leapp/repos.d/system_upgrade/common/libraries/mounting.py", line 220, in copytree_from
    shutil.copytree(self.full_path(src), dst)
  File "/usr/lib64/python3.6/shutil.py", line 365, in copytree
    raise Error(errors)
shutil.Error: [('/var/lib/leapp/scratch/mounts/root_/system_overlay/etc/pki/entitlement-host', '/var/lib/leapp/el9userspace/etc/pki/entitlement-host', "[Errno 2] No such file or directory: '/var/lib/leapp/scratch/mounts/root_/system_overlay/etc/pki/entitlement-host'")]

The system has no /etc/pki/entitelement:

[root@centos8-stream ~]# ls -alh /etc/pki
total 12K
drwxr-xr-x.  7 root root   75 May  1  2023 .
drwxr-xr-x. 87 root root 8.0K Nov  1 19:01 ..
drwxr-xr-x.  4 root root   73 May  1  2023 ca-trust
drwxr-xr-x.  2 root root   21 May  1  2023 java
drwxr-xr-x.  2 root root  110 May  1  2023 rpm-gpg
drwx------.  2 root root    6 Jan 12  2023 rsyslog
drwxr-xr-x.  5 root root  104 May  1  2023 tls

[pirat89]

@abadger @evgeni you are right guys. I've completely omit the possibility that subscription-manager does not have to be installed on the system (e.g. RHUI or disconnected systems) and in such a case it will be problematic actually.