Bug 2011303
| Summary: | Unable to sync content from CDN when using an HTTP proxy | ||
|---|---|---|---|
| Product: | Red Hat Satellite | Reporter: | Radovan Drazny <rdrazny> |
| Component: | Pulp | Assignee: | satellite6-bugs <satellite6-bugs> |
| Status: | CLOSED ERRATA | QA Contact: | Jameer Pathan <jpathan> |
| Severity: | urgent | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 6.10.0 | CC: | dkliban, egolov, jpathan, ltran, pmendezh, rchan, ssydoren, ttereshc, zhunting |
| Target Milestone: | 6.10.0 | Keywords: | Regression, Triaged |
| Target Release: | Unused | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2021-11-16 14:13:58 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Radovan Drazny
2021-10-06 11:27:27 UTC
I bet this comes from https://github.com/theforeman/pulpcore-packaging/pull/288/files One thing that I noticed: https://github.com/aio-libs/aiohttp/pull/5992 (where the patch we applied comes from, essentially) mentions Python 3.7+, but we're running this on 3.6! @Evgeni is correct in that this patch does not work on Python 3.6. CPython 3.6 does not have support for TLS in TLS. This feature was added in Python 3.7. For the context, see https://github.com/aio-libs/aiohttp/pull/5992.patch — this is the upstream patch that I've got merged into the aiohttp master last night. master corresponds to v4.0+ and has already dropped support for Python 3.6. There's a backporting attempt for this change at https://github.com/aio-libs/aiohttp/pull/6049 to get it into the upcoming release of aiohttp v3.8.0. It hasn't yet dropped support for Python 3.6 but there's a chance it will because CPython 3.6 will reach EOL in two months and it's rather pointless to support it upstream. The reason the backport is not yet merged is that this specific error is happening in the CI jobs for Python 3.6 (that are still present in the branch `3.8` but haven't been in the master branch for over a year at least). The current plan is to recover the guard expression in the code, just for aiohttp v3.8 that would tell the users when they attempt to use this feature in an unsupported environment (which is anything below Python 3.7, for `start_tls()`). So for Sattelite to use this feature, it'll be necessary to upgrade the Python runtime to 3.7 or higher and migrate to using aiohttp v3.8 once it's out. I would recommend using something newer, though. Like Python 3.10 or 3.9: over the years, since this feature has been added, there's been talk about it being having a lot of corner cases that got addressed over time. So the ideal case for this is to use Python 3.10+ really. If you attempt to backport those upstream patches on top of CPython 3.6, I foresee that it may end up being rather complicated and I wouldn't have any confidence in such a setup. I believe the behavior described by this bugzilla is a result of including bug 1993917. We will likely need to revert that change from the current 6.10 SNAP, at which time this one can go to ON_QA to confirm the issue no longer exists. @ssydoren Thanks for the info. We won't go to a Python 3.9 or 3.10 as we are reliant on the SCL from RHEL. We will move forward with an option to get to python 3.8. Here are some more details on the decision. https://docs.google.com/document/d/1nusVTz4Kdx-HPb05kUHA-HMF0MBMX7vZxETGZ1YoPhA/edit?usp=sharing I have successfully synced a RH repository using an HTTP proxy on a Sat 6.10 Snap 23.0 in the IPv6 only environment. I will leave IPv4 testing to Jameer, but I believe there shouldn't be much of a difference. Verified Verified with: - Satellite 6.10.0 snap 23 Test steps: - Create HTTP Proxy (Infrastructure > Http proxies) - Set it as content default http proxy in setting - Try to sync redhat repository. Observations: - Repository sync completed successfully. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Moderate: Satellite 6.10 Release), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2021:4702 |