Bug 1882941

Summary: product certificates in the overcloud-minimal images causes 'Not supported by a valid subscription'
Product: Red Hat OpenStack Reporter: Bernd Zehrfuchs <bernd>
Component: rhosp-director-imagesAssignee: Lon Hohberger <lhh>
Status: CLOSED ERRATA QA Contact: Lon Hohberger <lhh>
Severity: high Docs Contact:
Priority: high    
Version: 16.1 (Train)CC: johfulto, karim.blidi, lhh, mburns, michal.vasko, ramishra, smykhail, spower, tvignaud
Target Milestone: z4Keywords: Triaged
Target Release: 16.1 (Train on RHEL 8.2)   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: rhosp-director-images-16.1-20210216.1.el8ost Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2021-03-17 16:06:36 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
Fix none

Description Bernd Zehrfuchs 2020-09-26 20:51:31 UTC 
Description of problem:

If the overcloud-minimal image is used to deploy nodes that do not require an OSP subscription, and the subscription being used does not contain RHEL EUS, an "Not supported by a valid subscription" error message appears.

This is caused through the product certificate which is contained in the overcloud-minimal image.

eg: Ceph OSD node with only a Ceph subscription

  /etc/pki/product/70.pem

  Product Name:   Red Hat Enterprise Linux for x86_64 - Extended Update Support
  Product ID:     70


Version-Release number of selected component (if applicable):
rhosp-director-images-minimal-16.0-*
rhosp-director-images-minimal-16.1-*

How reproducible:
always

Steps to Reproduce:
1. deploy Overcloud Ceph OSD nodes by using the overcloud-minimal image
2. register the Ceph OSD nodes with a Ceph subscription only
3. run 'subscription-manager list' on the Ceph OSD nodes or check the subscription state of the nodes on the Satellite Server


Actual results:
output of 'subscription-manager list' contains a product with status 'Not supported by a valid subscription'

Expected results:
the output of the 'subscription-manager list' contains the status 'Subscribed' for all products

Additional info:
Comment 5 Lon Hohberger 2020-10-01 13:23:29 UTC 
The overcloud-minimal starts with 479.pem - is it possible the ceph node deployment steps are changing the image's subscription(s)?
Comment 7 Bernd Zehrfuchs 2020-10-02 18:29:17 UTC 
(In reply to Lon Hohberger from comment #5)
> The overcloud-minimal starts with 479.pem - is it possible the ceph node
> deployment steps are changing the image's subscription(s)?

The image contains the additional product certificate right from the beginning.

Here the steps to verify it:

Download the rhosp-director-images-minimal RPM package.
eg: rhosp-director-images-minimal-16.1-20200812.3.el8ost.noarch.rpm

Extract the content of the rpm package:
$ rpm2cpio rhosp-director-images-minimal-16.1-20200812.3.el8ost.noarch.rpm | cpio -idmv

Extract the tar file which was extracted from the RPM package:
tar xf usr/share/rhosp-director-images/overcloud-minimal-16.1-20200812.3.el8ost.x86_64.tar

Connect and mount the qcow2 image:
$ qemu-nbd --connect=/dev/nbd0 /tmp/overcloud-minimal.qcow2
$ mount /dev/nbd0 /mnt

List the product certificates included in the image:
$ ls /mnt/etc/pki/product/
408.pem  70.pem
Comment 10 Lon Hohberger 2021-02-09 21:34:44 UTC 
Created attachment 1756049 [details]
Fix
Comment 12 Lon Hohberger 2021-02-16 14:36:58 UTC 
The overcloud-minimal image 16.2-20210215.4 and later have only 408.pem
Comment 13 Lon Hohberger 2021-02-16 14:38:22 UTC 
For 16.1, 16.1-20210216.1 contains the fix and only has 408.pem
Comment 20 errata-xmlrpc 2021-03-17 16:06:36 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Red Hat OpenStack Platform 16.1.4 director images bug fix advisory), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2021:0918