Bug 1349415

Description of problem:
Capsule upgrade fails with Proxy cannot be registered (422 Unprocessable Entity)

Version-Release number of selected component (if applicable):
Satellite 6.2.0 Snap17

How reproducible:
always

Steps to Reproduce:
1. Re-register Capsule after upgrading Satellite to 6.2
# subscription-manager register --force --activationkey ak_rhel7 --org Default_Organization

2. Upgrade capsule packages
# yum update 

3. Generate capsule certs on Satellite and copy them to Capsule
# ssh $SAT capsule-certs-generate --capsule-fqdn $(hostname) --certs-tar $(hostname).tar
# scp $SAT:$(hostname).tar .

4. Upgrade Capsule <- THIS FAILS
# satellite-installer --upgrade --certs-tar $(hostname).tar
Upgrading...
Upgrade Step: stop_services...
Upgrade Step: start_databases...
Upgrade Step: update_http_conf...
Upgrade Step: migrate_pulp...
Upgrade Step: fix_pulp_httpd_conf...
Upgrade Step: start_httpd...
Upgrade Step: start_qpidd...
Upgrade Step: start_pulp...
Upgrade Step: remove_nodes_importers...
Upgrade Step: Running installer...
Installing             --- /etc/foreman-proxy/settings.d/pulpnode.ymlstr201 [99%] [....................................  /Stage[main]/Foreman_proxy::Register/Foreman_smartproxy[<CAPSULE_FQDN>]: Failed to call refresh: Proxy <CAPSULE_FQDN> cannot be registered (422 Unprocessable Entity): Unable to communicate with the Capsule: ERF12-2530 [ProxyAPI::ProxyException]: Unable to detect features ([Errno::EHOSTUNREACH]: No route to host - connect(2) for "<CAPSULE_FQDN>" port...) for Capsule https://<CAPSULE_FQDN>:9090/features Please check the Capsule is configured and running on the host.
 /Stage[main]/Foreman_proxy::Register/Foreman_smartproxy[<CAPSULE_FQDN>]: Proxy <CAPSULE_FQDN> cannot be registered (422 Unprocessable Entity): Unable to communicate with the Capsule: ERF12-2530 [ProxyAPI::ProxyException]: Unable to detect features ([Errno::EHOSTUNREACH]: No route to host - connect(2) for "<CAPSULE_FQDN>" port...) for Capsule https://<CAPSULE_FQDN>:9090/features Please check the Capsule is configured and running on the host.
Installing             Done                                               [100%] [....................................]
  Something went wrong! Check the log for ERROR-level output
  The full log is at /var/log/foreman-installer/capsule.log
Upgrade Step: restart_services...

5. Check from outside of capsule open ports
PORT     STATE SERVICE
22/tcp   open  ssh
53/tcp   open  domain
443/tcp  open  https
3128/tcp open  squid-http
7911/tcp open  unknown
8000/tcp open  http-alt
8443/tcp open  https-alt
9090/tcp open  zeus-admin

6. Disable fw 
# iptables -F ; ip6tables -F


7. Re-run capsule upgrade successfully
# satellite-installer --upgrade --certs-tar $(hostname).tar
Upgrading...
Upgrade Step: stop_services...
Upgrade Step: start_databases...
Upgrade Step: update_http_conf...
Upgrade Step: migrate_pulp...
Upgrade Step: fix_pulp_httpd_conf...
Upgrade Step: start_httpd...
Upgrade Step: start_qpidd...
Upgrade Step: start_pulp...
Upgrade Step: remove_nodes_importers...
Upgrade Step: Running installer...
Installing             Done                                               [100%] [...........................................................................................]
  The full log is at /var/log/foreman-installer/capsule.log
Upgrade Step: restart_services...
Katello upgrade completed!


Actual results:
capsule upgrade fails possibly due to firewall

Expected results:
capsule upgrade is successful