Bug 2016845

Summary: Bugzilla 1951057 & 2016840 makes rhui-subscription-sync trigger a refresh of the SCA entitlement with every run
Product: Red Hat Update Infrastructure for Cloud Providers Reporter: Taft Sanders <tasander>
Component: RHUAAssignee: RHUI Bug List <rhui-bugs>
Status: CLOSED ERRATA QA Contact: Radek Bíba <rbiba>
Severity: low Docs Contact:
Priority: unspecified    
Version: 4.0.0   
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2021-10-29 05:13:36 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Taft Sanders 2021-10-24 18:35:03 UTC
Description of problem:
Because of the SCA entitlement not being properly cleaned from the /etc/pki/entitlement/ directory on migrating from SCA enabled to SCA disabled and the subscription-manager refresh --force creating multiple SCA entitlements ( https://bugzilla.redhat.com/show_bug.cgi?id=2016840), with every run of the rhui-subscription-sync a new SCA entitlement will be uploaded to the RHUA entitlements list.

Version-Release number of selected component (if applicable):
rhui-tools-4.0.0.33-1.el8ui.noarch

How reproducible:
Every time

Steps to Reproduce:
1. Register the RHUA to an SCA enabled RHSM
2. Install RHUA
3. Run rhui-subscription-sync (no change)
4. Force a serial renewal with `subscription-manager refresh --force`
5. Run rhui-subscription-sync (New entitlement uploaded)
6. Run rhui-subscription-sync (New entitlement uploaded) this time nothing has changed on the attached subscriptions to the OS in /etc/pki/entitlement/. 

Actual results:
rhui-subscription-sync cron will refresh entitlement certificate on RHUA with every run when there is an extra content access certificate in the /etc/pki/entitlement/ directory.

Expected results:
None.
This should work as expected as soon as Bugzillas 1951057 and 2016840 are resolved.

Additional info:
This only appears to impact the RHUA in the capacity of wasted cycles on regenerating certificates for repositories and producing unnecessary repository entitlement mappings cache in /var/cache/rhui/. Each file is about 200KB in size.

Comment 2 Taft Sanders 2021-10-29 05:13:36 UTC
This issue appears to be fixed with the next version of subscription-manager (subscription-manager-1.28.21-2.el8.x86_64.rpm). Closing this one out.

[root@rhua4 tmp]# subscription-manager attach --pool 8a85f99c7b557da4017ba2118d345f26 --pool 8a85f99b799092350179fbcd130e6ced
Successfully attached a subscription for: Red Hat Update Infrastructure and RHEL Add-Ons for Providers
Successfully attached a subscription for: Red Hat Enterprise Linux Atomic Host for Certified Cloud and Service Providers (via Red Hat Update Infrastructure)
[root@rhua4 tmp]# cd /etc/pki/entitlement/
[root@rhua4 entitlement]# ls
213065222705454635-key.pem  213065222705454635.pem  520977371961527012-key.pem  520977371961527012.pem  539273021616027884-key.pem  539273021616027884.pem
[root@rhua4 entitlement]# subscription-manager list --consumed^C
[root@rhua4 entitlement]# for i in $(ls -1 /etc/pki/entitlement/*); do rct cat-cert $i | grep -A1 Order; done
Order:
	Name: Red Hat Update Infrastructure and RHEL Add-Ons for Providers
Order:
	Name: Content Access
Order:
	Name: Red Hat Enterprise Linux Atomic Host for Certified Cloud and Service Providers (via Red Hat Update Infrastructure)
[root@rhua4 entitlement]# subscription-manager refresh --force
2 local certificates have been deleted.
3 local certificates have been deleted.
All local data refreshed
[root@rhua4 entitlement]# for i in $(ls -1 /etc/pki/entitlement/*); do rct cat-cert $i | grep -A1 Order; done
Order:
	Name: Content Access
Order:
	Name: Red Hat Enterprise Linux Atomic Host for Certified Cloud and Service Providers (via Red Hat Update Infrastructure)
Order:
	Name: Red Hat Update Infrastructure and RHEL Add-Ons for Providers
[root@rhua4 entitlement]# subscription-manager refresh --force
2 local certificates have been deleted.
3 local certificates have been deleted.
All local data refreshed
[root@rhua4 entitlement]# for i in $(ls -1 /etc/pki/entitlement/*); do rct cat-cert $i | grep -A1 Order; done
Order:
	Name: Content Access
Order:
	Name: Red Hat Update Infrastructure and RHEL Add-Ons for Providers
Order:
	Name: Red Hat Enterprise Linux Atomic Host for Certified Cloud and Service Providers (via Red Hat Update Infrastructure)


[root@rhua4 entitlement]# ls -l /var/cache/rhui/* | wc -l
215
[root@rhua4 entitlement]# rhui-subscription-sync 
[root@rhua4 entitlement]# ls -l /var/cache/rhui/* | wc -l
216
[root@rhua4 entitlement]# rhui-subscription-sync 
[root@rhua4 entitlement]# ls -l /var/cache/rhui/* | wc -l
216
[root@rhua4 entitlement]# rhui-subscription-sync 
[root@rhua4 entitlement]# ls -l /var/cache/rhui/* | wc -l
216
[root@rhua4 entitlement]# rhui-subscription-sync 
[root@rhua4 entitlement]# ls -l /var/cache/rhui/* | wc -l
216