depsolve: add rhui flag to skip RHSM cert lookup for cloud RHUI repos#5029
Closed
brandonrc wants to merge 1 commit intoosbuild:mainfrom
Closed
depsolve: add rhui flag to skip RHSM cert lookup for cloud RHUI repos#5029brandonrc wants to merge 1 commit intoosbuild:mainfrom
brandonrc wants to merge 1 commit intoosbuild:mainfrom
Conversation
Add a `rhui: true` repository config flag that allows cloud RHUI systems to bypass the Go-side RHSM entitlement certificate lookup. On cloud instances (AWS, Azure, GCP), RHEL repos are served via RHUI mirrors authenticated by cloud instance identity headers and host-installed SSL certificates, not RHSM entitlement certs from /etc/pki/entitlement/. The existing `rhsm: true` flag requires those certs to exist, which fails on RHUI-only systems with "no matching key and certificate pair". When `rhui: true` is set on a repository: - validateSubscriptionsForRepos() skips the RHSM cert check - reposFromRPMMD() passes rhsm: true to the Python depsolve script, which handles RHUI secret discovery via osbuild's util.rhsm and util.rhui modules - Package secrets are set to "org.osbuild.rhui" instead of "org.osbuild.rhsm" This works in conjunction with osbuild's RHUI support which discovers RHUI repo files, SSL certs, and cloud identity headers from the host system automatically.
brandonrc
force-pushed
the
rhui-support
branch
from
48d79be to
01a0c8c
Compare
|
This PR is stale because it had no activity for the past 30 days. Remove the "Stale" label or add a comment, otherwise this PR will be closed in 7 days. |
|
This PR was closed because it has been stalled for 30+7 days with no activity. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds RHUI support to osbuild-composer so that the worker can generate manifests that use
org.osbuild.rhuisecrets for RPM downloads on cloud instances.Closes #5028
Related: #820 (original report, closed as stale), osbuild/osbuild#2355 (companion osbuild changes), osbuild/images#2208 (companion images changes)
Dependencies
This PR depends on two upstream PRs that must merge first:
RHUI booltoRepoConfig,case "org.osbuild.rhui"toNewCurlPackageItem(), and RHUI handling indepsolvednforg.osbuild.rhuisecrets provider, cloud provider detection, and identity header supportAfter osbuild/images#2208 merges, this PR will need an images dependency bump (
go mod vendor) to pull in the RHUI changes, replacing the direct vendor edits currently included here.Changes
depsolve: add rhui flag to skip RHSM cert lookup for cloud RHUI reposRHUI boolfield toDepsolvedRepoConfigininternal/worker/json.gowith JSON serialization supportTestDepsolvedRepoConfigJSONRoundtripandTestDepsolvedRepoConfigRPMMDConversioncurl_source.go— addcase "org.osbuild.rhui"repository.go— addRHUI booltoRepoConfigdepsolvednf.go— RHUI secrets and subscription validationv2.go— pass RHUI flag to solverTest plan
Stopgap
Until this is merged, users can use osbuild-rhui-shim as a workaround.