Bug 1340323

Summary: Certificate errors when automating the installation of packages using subscription manager
Product: Red Hat Enterprise Linux 7 Reporter: Andrew Beekhof <abeekhof>
Component: cloud-initAssignee: Ryan McCabe <rmccabe>
Status: CLOSED NOTABUG QA Contact: xiachen
Severity: low Docs Contact:
Priority: low    
Version: 7.2CC: fdinitto, huzhao, xchen, yacao, yuxisun
Target Milestone: rcKeywords: Triaged
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-03-11 13:04:33 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Andrew Beekhof 2016-05-27 02:06:12 UTC 
Description of problem:

I am unable to install packages when creating instances from a heat template due to SSL and certificate errors.

Version-Release number of selected component (if applicable):

Whatever comes in http://download.eng.bos.redhat.com/brewroot/packages/rhel-guest-image/7.2/20160302.0/images/rhel-guest-image-7.2-20160302.0.x86_64.qcow2

How reproducible:

100%

Steps to Reproduce:
1. wget http://download.eng.bos.redhat.com/brewroot/packages/rhel-guest-image/7.2/20160302.0/images/rhel-guest-image-7.2-20160302.0.x86_64.qcow2
2. 

Arrange for the following user_data to be passed to the openstack instance when it is created:

user_data_raw:
user_data:
  #cloud-config
  rh_subscription:
    username: rhn-engineering-XXXX
    password: 'secret'
    auto-attach: True
  packages:
   - ntp

3. Watch the console


Actual results:

Out of the box I get:
   https://cdn.redhat.com/content/dist/rhel/server/7/7Server/x86_64/os/repodata/repomd.xml: [Errno 14] curl#77 - "Problem with the SSL CA cert (path? access rights?)"

Running this before first trying to install:
  sed -i 's/insecure.*/insecure = 1/' /etc/rhsm/rhsm.conf
  sed -i 's/sslverify.*/sslverify = 0/' /etc/yum.repos.d/redhat.repo

Produces this instead:
  https://cdn.redhat.com/content/dist/rhel/server/7/7Server/x86_64/os/repodata/repomd.xml: [Errno 14] curl#58 - "unable to load client key: -8178 (SEC_ERROR_BAD_KEY)"


Expected results:

Package is installed

Additional info:

Even running the subscription-manager manually from a script:

user_data_raw:
user_data:
  #!/bin/sh -ex

  subscription-manager register --username='rhn-engineering-XXXX' --password='mysecret'
  subscription-manager attach --auto
  yum install -y ntp

doesn't seem to help, even though it normally works from the
command line.

Perhaps it is something to do with the timing of the commands or the environment in which they are being executed.
Comment 4 Andrew Beekhof 2018-01-17 04:06:09 UTC 
I'm not sure I even know how to test this anymore.
I was doing it in the context of Heat and OSP and many moons ago
Comment 5 Huijuan Zhao 2020-03-09 09:56:42 UTC 
Xiaoyi, could you please check if this issue is still occur with the latest el7 build? If not, I think we can close it. Thanks!
Comment 8 xiachen 2020-03-11 15:01:04 UTC 
(In reply to Huijuan Zhao from comment #5)
> Xiaoyi, could you please check if this issue is still occur with the latest
> el7 build? If not, I think we can close it. Thanks!

Test latest rhel7.8+cloud-init-18.5-6, no issue, ntp package is installed as expected. so bug is closed.

To bug reporter, please re-open if the latest version does not work for you.