Bug 2216079

Description of problem:
Curl error (77): Problem with the SSL CA cert when using using UBI9 image on OpenShift container platform 4 

Version-Release number of selected component (if applicable):
OCP 4.13 
registry.access.redhat.com/ubi9/ubi:latest

How reproducible:
Always

Steps to Reproduce:
1. Use the following to create one buildconfig

oc create -f buildconfig.yaml
buildconfig.build.openshift.io/my-csi-bc-s2i created


cat buildconfig.yaml
apiVersion: build.openshift.io/v1
kind: BuildConfig
metadata:
  name: my-csi-bc-s2i
  namespace: ent-test
spec:
  runPolicy: Serial
  source:
    dockerfile: |
      FROM registry.access.redhat.com/ubi9/ubi:latest
      RUN ls -la /etc/pki/entitlement &&\
          rm /etc/rhsm-host &&\
          yum install -y yum-utils 
      RUN  echo rhocp-4.13-for-rhel-9-x86_64-rpms >>repo.txt;  echo rhocp-4.13-for-rhel-9-x86_64-debug-rpms >>repo.txt; 
      RUN cat repo.txt | xargs -I {} subscription-manager repos --enable={}
      RUN cat repo.txt | xargs -I {} repoquery --available --quiet --all --repoid={} >> packages.txt  
      RUN shuf -n 3 packages.txt > installed_pck &&\
          cat installed_pck 
      RUN cat installed_pck | xargs -I {} dnf install -y --setopt=*.module_hotfixes=True --skip-broken {}
  strategy:
    type: Docker
    dockerStrategy:
      volumes:
        - mounts:
            - destinationPath: "/etc/pki/entitlement"
          name: my-csi-shared-secret
          source:
            csi:
              driver: csi.sharedresource.openshift.io
              readOnly: true
              volumeAttributes:
                sharedSecret: my-share 
            type: CSI
  output:
    to:
      kind: "ImageStreamTag"
      name: "sample-custom:latest"

2. Start the buildconfig to create container image
oc start-build my-csi-bc-s2i -F

time="2023-06-20T02:11:26Z" level=info msg="Not using native diff for overlay, this may cause degraded performance for building images: kernel has CONFIG_OVERLAY_FS_REDIRECT_DIR enabled"
I0620 02:11:26.814758       1 defaults.go:112] Defaulting to storage driver "overlay" with options [mountopt=metacopy=on].
Caching blobs under "/var/cache/blobs".

Pulling image registry.access.redhat.com/ubi9/ubi:latest ...
Trying to pull registry.access.redhat.com/ubi9/ubi:latest...
Getting image source signatures
Copying blob sha256:33b9f09cff46d8b03b1185767b94e3881ea4cb8a671dd16ca1403f599fb2ed8f
Copying config sha256:e7236a3e070f267713ad79c451b8628166abc0bc9c855f624619e099ec3faa99
Writing manifest to image destination
Storing signatures
Adding transient rw bind mount for /run/secrets/rhsm
STEP 1/9: FROM registry.access.redhat.com/ubi9/ubi:latest
STEP 2/9: RUN ls -la /etc/pki/entitlement &&    rm /etc/rhsm-host &&    yum install -y yum-utils
total 0
drwxrwxrwt.  3 root root 120 Jun 20 02:11 .
drwxr-xr-x. 10 root root 154 May  3 09:06 ..
drwxr-xr-x.  2 root root  80 Jun 20 02:11 ..2023_06_20_02_11_24.158959106
lrwxrwxrwx.  1 root root  31 Jun 20 02:11 ..data -> ..2023_06_20_02_11_24.158959106
lrwxrwxrwx.  1 root root  26 Jun 20 02:11 entitlement-key.pem -> ..data/entitlement-key.pem
lrwxrwxrwx.  1 root root  22 Jun 20 02:11 entitlement.pem -> ..data/entitlement.pem
Updating Subscription Management repositories.
Unable to read consumer identity
Subscription Manager is operating in container mode.

This system is not registered with an entitlement server. You can use subscription-manager to register.

Red Hat Enterprise Linux 9 for x86_64 - AppStre 0.0  B/s |   0  B     00:00    
Errors during downloading metadata for repository 'rhel-9-for-x86_64-appstream-rpms':
  - Curl error (77): Problem with the SSL CA cert (path? access rights?) for https://cdn.redhat.com/content/dist/rhel9/9/x86_64/appstream/os/repodata/repomd.xml [error setting certificate file: %(ca_cert_dir)sredhat-uep.pem]
Error: Failed to download metadata for repo 'rhel-9-for-x86_64-appstream-rpms': Cannot download repomd.xml: Curl error (77): Problem with the SSL CA cert (path? access rights?) for https://cdn.redhat.com/content/dist/rhel9/9/x86_64/appstream/os/repodata/repomd.xml [error setting certificate file: %(ca_cert_dir)sredhat-uep.pem]
error: build error: building at STEP "RUN ls -la /etc/pki/entitlement &&    rm /etc/rhsm-host &&    yum install -y yum-utils": while running runtime: exit status 1


Actual results:
One error will be shown


Expected results:
No error and the package can be installed successfully

Additional info:
It is OK if try with the UBI8:
[root@ocp4-rhel8-ent-slave-1 entitlement-tests]# oc start-build my-csi-bc-s2i -F
build.build.openshift.io/my-csi-bc-s2i-1 started
time="2023-06-20T03:52:13Z" level=info msg="Not using native diff for overlay, this may cause degraded performance for building images: kernel has CONFIG_OVERLAY_FS_REDIRECT_DIR enabled"
I0620 03:52:13.435155       1 defaults.go:112] Defaulting to storage driver "overlay" with options [mountopt=metacopy=on].
Caching blobs under "/var/cache/blobs".

Pulling image registry.access.redhat.com/ubi8/ubi:latest ...
Trying to pull registry.access.redhat.com/ubi8/ubi:latest...
Getting image source signatures
Copying blob sha256:0fa65fe5c23e8b1745b1f39aa3735f2f3ce77cad9e470bfbb1468cb45a886bbe
Copying config sha256:817f060b4672f886292b297d96d2288dec751013210f35a4c89cd9499866e7a5
Writing manifest to image destination
Storing signatures
Adding transient rw bind mount for /run/secrets/rhsm
STEP 1/9: FROM registry.access.redhat.com/ubi8/ubi:latest
STEP 2/9: RUN ls -la /etc/pki/entitlement &&    ls -la /etc/rhsm/ca &&    rm /etc/rhsm-host &&    yum install -y yum-utils
total 0
drwxrwxrwt.  3 root root 120 Jun 20 03:52 .
drwxr-xr-x. 10 root root 154 May  3 15:08 ..
drwxr-xr-x.  2 root root  80 Jun 20 03:52 ..2023_06_20_03_52_10.110422034
lrwxrwxrwx.  1 root root  31 Jun 20 03:52 ..data -> ..2023_06_20_03_52_10.110422034
lrwxrwxrwx.  1 root root  26 Jun 20 03:52 entitlement-key.pem -> ..data/entitlement-key.pem
lrwxrwxrwx.  1 root root  22 Jun 20 03:52 entitlement.pem -> ..data/entitlement.pem
total 12
drwxr-xr-x. 2 root root   68 May  3 15:07 .
drwxr-xr-x. 6 root root  104 May  3 15:08 ..
-rw-r--r--. 1 root root 2305 Feb 23 06:16 redhat-entitlement-authority.pem
-rw-r--r--. 1 root root 7411 Feb 23 06:16 redhat-uep.pem
Updating Subscription Management repositories.
Unable to read consumer identity

This system is not registered with an entitlement server. You can use subscription-manager to register.

Red Hat Enterprise Linux 8 for x86_64 - AppStre 107 MB/s |  57 MB     00:00    
Red Hat Enterprise Linux 8 for x86_64 - BaseOS  103 MB/s |  61 MB     00:00    
Red Hat Universal Base Image 8 (RPMs) - BaseOS  5.1 MB/s | 839 kB     00:00    
Red Hat Universal Base Image 8 (RPMs) - AppStre  14 MB/s | 3.3 MB     00:00    
Red Hat Universal Base Image 8 (RPMs) - CodeRea 918 kB/s | 106 kB     00:00    
Dependencies resolved.
================================================================================
 Package          Arch   Version            Repository                     Size
================================================================================
Installing:
 yum-utils        noarch 4.0.21-19.el8_8    rhel-8-for-x86_64-baseos-rpms  75 k
Installing dependencies:
 dnf-plugins-core noarch 4.0.21-19.el8_8    rhel-8-for-x86_64-baseos-rpms  75 k

Transaction Summary
================================================================================
Install  2 Packages

Total download size: 150 k
Installed size: 44 k
Downloading Packages:
(1/2): dnf-plugins-core-4.0.21-19.el8_8.noarch. 695 kB/s |  75 kB     00:00    
.....