Automate RPM build with Mock and Satellite-6

This article was originally published on the Red Hat Customer Portal. The information may no longer be current.

In any modern development environment automation is crucial. For Red Hat flavoured OS'es, application management typically is based on RPM packages. Bringing automation into an RPM development environment sooner or later leads to Mock https://fedorahosted.org/mock/.

With Satellite-6, Mock has finally a capable life cycle management counterpart. In large projects with several teams working on interdependent components, Satellite Content Views (CVs) are powerful means to provide a solid baseline for development and change management.

In essence, Mock is creating a chroot environment for building RPM packages. Ideally, this should be independent of the architecture and release version of the build host. However, content distribution via Satellite is bound to subscriptions. To achieve releasever independence with Satellite-6, we have two options: we either broaden the content scope available to the build host or we use dedicated subscriptions for different Mock targets.

The first is possible with Satellite-6 because other than Satellite-5 it has no notion of a base channel. There is no limitation to create CVs with both RHEL-6 and RHEL-7 repos side by side. It is also possible to subscribe a host directly to Library, omitting all life cycle management via CVs.

To implement subscription based content distribution, Satellite-6 is using SSL client certs to authenticate and authorize access to the various repos. Each CV embraces one or more repos for distribution in certain life cycle environments (LCE) for a particular organization. The baseurl for these repos is encoding organization, LCE and CV in addition to releasever and architecture. The SSL client certs associated with a hosts subscription grant access only to one particular CV/LCE combination for each enabled repo.

For example, the baseurl

http://sat.example.com/pulp/repos/Default_Org/Production/RHEL_7_Baseline/content/dist/rhel/server/7/7Server/$basearch/os

requires a subscription for the RHEL 7 Baseline Content View in stage Production belonging to the Default Org. Only if the SSL client cert provides this subscription access to the repo is granted.

Configuring Mock to use Satellite-6 boils down to providing the correct SSL client certs for the required repos. As mentioned above, we can achieve this by either customizing the build host CV to contain all required repos or by giving Mock more than one subscription (taken from other template host).

The following facts need to be observed to acomplish the goal:

• The SSL client certs and associated keys belonging to a subscription are stored in /etc/pki/entitlement/.
• The SSL server cert is always signed with /etc/rhsm/ca/katello-server-ca.pem.
• The yum.repo setup for a Satellite-6 host is configured in /etc/yum.repos.d/redhat.repo.

Bringing these three together makes up a proper Mock configuration.

To make the certs available to Mock, we bind mount /etc/pki/entitlement/ and /etc/rhsm/ca/ into the chroot.
The according configuration settings

config_opts['plugin_conf']['bind_mount_opts']['dirs'].append(('/etc/pki/entitlement', '/etc/pki/entitlement/' ))
config_opts['plugin_conf']['bind_mount_opts']['dirs'].append(('/etc/rhsm/ca/', '/etc/rhsm/ca/' ))

can either be added to /etc/mock/site-defaults.cfg or to a particular chroot configuration.

If you use multiple subscriptions from template hosts you can either copy the SSL client certs to the /etc/pki/entitlement/ of the build host or you bind mount a different directory that holds a collection of all required certs.

The chroot configuration finally must include the appropriate baseurl/client cert combinations for the required repos. The easiest way to get this repo definition is by enabling it on the build- or template-host and copying the appropriate section from /etc/yum.repos.d/redhat.repo.

The resulting /etc/mock/rhel-7-x86_64.cfg should look similar to this:

config_opts['root'] = 'rhel-7-x86_64'
config_opts['target_arch'] = 'x86_64'
config_opts['legal_host_arches'] = ('x86_64',)
config_opts['chroot_setup_cmd'] = 'install bash bzip2 cpio diffutils gzip perl sed tar unzip which @development'
config_opts['dist'] = 'el7'
config_opts['releasever'] = '7Server'
config_opts['yum.conf'] = """
[main]
cachedir=/var/cache/yum
keepcache=1
debuglevel=1
reposdir=/dev/null
logfile=/var/log/yum.log
retries=20
obsoletes=1
gpgcheck=0
assumeyes=1
syslog_ident=mock
syslog_device=
# repos
[rhel-7-server-rpms]
name = Red Hat Enterprise Linux 7 Server (RPMs)
enabled = 1
baseurl = https://sat.example.com/pulp/repos/Default_Org/Production/RHEL_7_Baseline/content/dist/rhel/server/7/7Server/$basearch/os
ui_repoid_vars = basearch
metadata_expire = 1
sslverify = 1
sslclientkey = /etc/pki/entitlement/3132072779642053123-key.pem
sslclientcert = /etc/pki/entitlement/3132072779642053123.pem
sslcacert = /etc/rhsm/ca/katello-server-ca.pem
gpgcheck = 1
gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release