Bug 1814330

Summary:	Manifest refresh does not import new CDN certificates into Pulp
Product:	Red Hat Satellite	Reporter:	Justin Sherrill <jsherril>
Component:	Repositories	Assignee:	satellite6-bugs <satellite6-bugs>
Status:	CLOSED WONTFIX	QA Contact:	Cole Higgins <chiggins>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	Unspecified	CC:	dsynk, ktordeur, pdwyer, swadeley
Target Milestone:	Unspecified	Keywords:	Triaged
Target Release:	Unused
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-03-18 19:44:22 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Justin Sherrill 2020-03-17 16:44:30 UTC

This bug was initially created as a copy of Bug #1688973

I am copying this bug because: 

There have been reports of this happening again, but no more details (such as task exports) exist to help debug the situation. 


1) On a Satellite with an expired set of subscriptions, try and sync repos from the CDN and ensure they fail. You need expired, non-valid subscriptions where you get Permission Denied errors syncing. 

2) Find the x509 certs stored in one of the Pulp repositories, substitute the repo-id of say.. the RHEL7 Server repo

#  curl -k -u admin:************ https://localhost/pulp/api/v2/repositories/33fb2576-e5f7-4946-944d-66e0593271aa/?details=true  | json_reformat 

3) Copy the ssl_client* fields to a text file for future reference

4) Download an updated un-expired manifest with new subscriptions

5) Import into Satellite 6

6) Try to sync repos again, note that you *still* get Permission Denied errors from the CDN.

7) Repeat step (2) and (3) and note that there is still the old expired ssl_certs in the pulp feed ssl certs.

WORKAROUND:

Run this foreman-rake task to refresh the certs out of Candlepin:

# LIFECYCLE_ENVIRONMENT=Library foreman-rake katello:refresh_pulp_repo_details

Comment 3 Justin Sherrill 2020-03-17 16:49:35 UTC

To assist in further debugging this issue, we need a task export showing the manifest refresh.

Comment 4 Mike McCune 2022-01-28 22:30:40 UTC

Upon review of our valid but aging backlog the Satellite Team has concluded that this Bugzilla does not meet the criteria for a resolution in the near term, and are planning to close in a month. This message may be a repeat of a previous update and the bug is again being considered to be closed. If you have any concerns about this, please contact your Red Hat Account team. Thank you.

Comment 5 Mike McCune 2022-03-18 19:44:22 UTC

Thank you for your interest in Red Hat Satellite. We have evaluated this request, and while we recognize that it is a valid request, we do not expect this to be implemented in the product in the foreseeable future. This is due to other priorities for the product, and not a reflection on the request itself. We are therefore closing this out as WONTFIX. If you have any concerns about this feel free to contact your Red Hat Account Team. Thank you.