Issue

What were you trying to do that didn't work? Cloud automatic registration workflow via redhat-cloud-client-configuration-cdn packaging. What is the impact of this issue to you? Prevents use/registration of insights-client Please provide the package NVR for which the bug is seen: insights-client-3.10.1-2.el10.noarch How reproducible is this bug?: 100% Steps to reproduce Install insights-client from latest nightly Utilize redhat-cloud-client-configuration{-cdn} from a cloud instance to automate execution of insights-client Expected results Registration should succeed / core should be found Actual results Aug 05 16:42:06 ip-10-31-51-217.us-east-1.aws.redhat.com systemd[1]: Started insights-register.service - Automatically Register with Red Hat Insights. Aug 05 16:42:06 ip-10-31-51-217.us-east-1.aws.redhat.com insights-client[1946]: Client: 3.10.1 Aug 05 16:42:06 ip-10-31-51-217.us-east-1.aws.redhat.com insights-client[1946]: Core: not found Additional Info: Here are all the details I have: Updating packages from nightly: [root@ip-10-31-51-217 yum.repos.d]# dnf update subscription-manager insights-client rhc -y;systemctl daemon-reload;systemctl stop rhsmcertd Updating Subscription Management repositories. Unable to read consumer identity This system is not registered with an entitlement server. You can use "rhc" or "subscription-manager" to register. Last metadata expiration check: 0:00:26 ago on Tue Aug 5 16:24:55 2025. Dependencies resolved. ============================================================================================================================== Package Arch Version Repository Size ============================================================================================================================== Upgrading: insights-client noarch 3.10.1-2.el10 rhel-for-x86_64-appstream-rpms-nightly 1.2 M libdnf-plugin-subscription-manager x86_64 1.30.10-1.el10 rhel-for-x86_64-baseos-rpms-nightly 43 k libselinux x86_64 3.9-1.el10 rhel-for-x86_64-baseos-rpms-nightly 97 k libselinux-utils x86_64 3.9-1.el10 rhel-for-x86_64-baseos-rpms-nightly 127 k libsemanage x86_64 3.9-1.el10 rhel-for-x86_64-baseos-rpms-nightly 122 k libsepol x86_64 3.9-1.el10 rhel-for-x86_64-baseos-rpms-nightly 348 k policycoreutils x86_64 3.9-1.el10 rhel-for-x86_64-baseos-rpms-nightly 227 k policycoreutils-python-utils noarch 3.9-1.el10 rhel-for-x86_64-appstream-rpms-nightly 47 k python3-cloud-what x86_64 1.30.10-1.el10 rhel-for-x86_64-baseos-rpms-nightly 72 k python3-libselinux x86_64 3.9-1.el10 rhel-for-x86_64-appstream-rpms-nightly 201 k python3-libsemanage x86_64 3.9-1.el10 rhel-for-x86_64-appstream-rpms-nightly 81 k python3-policycoreutils noarch 3.9-1.el10 rhel-for-x86_64-appstream-rpms-nightly 2.2 M python3-subscription-manager-rhsm x86_64 1.30.10-1.el10 rhel-for-x86_64-baseos-rpms-nightly 183 k rhc x86_64 1:0.3.3-1.el10 rhel-for-x86_64-appstream-rpms-nightly 3.4 M selinux-policy noarch 42.1.4-1.el10 rhel-for-x86_64-baseos-rpms-nightly 47 k selinux-policy-targeted noarch 42.1.4-1.el10 rhel-for-x86_64-baseos-rpms-nightly 6.2 M subscription-manager x86_64 1.30.10-1.el10 rhel-for-x86_64-baseos-rpms-nightly 959 k Installing dependencies: insights-core-selinux noarch 3.7.0-1.el10 rhel-for-x86_64-appstream-rpms-nightly 31 k Transaction Summary ============================================================================================================================== Install 1 Package Upgrade 17 Packages Total download size: 16 M Downloading Packages: (1/18): insights-core-selinux-3.7.0-1.el10.noarch.rpm 396 kB/s | 31 kB 00:00 (2/18): libdnf-plugin-subscription-manager-1.30.10-1.el10.x86_64.rpm 469 kB/s | 43 kB 00:00 (3/18): libselinux-3.9-1.el10.x86_64.rpm 821 kB/s | 97 kB 00:00 (4/18): libsemanage-3.9-1.el10.x86_64.rpm 880 kB/s | 122 kB 00:00 (5/18): libselinux-utils-3.9-1.el10.x86_64.rpm 759 kB/s | 127 kB 00:00 (6/18): python3-cloud-what-1.30.10-1.el10.x86_64.rpm 811 kB/s | 72 kB 00:00 (7/18): libsepol-3.9-1.el10.x86_64.rpm 1.3 MB/s | 348 kB 00:00 (8/18): policycoreutils-3.9-1.el10.x86_64.rpm 1.5 MB/s | 227 kB 00:00 (9/18): selinux-policy-42.1.4-1.el10.noarch.rpm 319 kB/s | 47 kB 00:00 (10/18): python3-subscription-manager-rhsm-1.30.10-1.el10.x86_64.rpm 913 kB/s | 183 kB 00:00 (11/18): subscription-manager-1.30.10-1.el10.x86_64.rpm 1.3 MB/s | 959 kB 00:00 (12/18): insights-client-3.10.1-2.el10.noarch.rpm 1.7 MB/s | 1.2 MB 00:00 (13/18): policycoreutils-python-utils-3.9-1.el10.noarch.rpm 456 kB/s | 47 kB 00:00 (14/18): python3-libselinux-3.9-1.el10.x86_64.rpm 1.2 MB/s | 201 kB 00:00 (15/18): python3-libsemanage-3.9-1.el10.x86_64.rpm 661 kB/s | 81 kB 00:00 (16/18): selinux-policy-targeted-42.1.4-1.el10.noarch.rpm 4.8 MB/s | 6.2 MB 00:01 (17/18): python3-policycoreutils-3.9-1.el10.noarch.rpm 4.8 MB/s | 2.2 MB 00:00 (18/18): rhc-0.3.3-1.el10.x86_64.rpm 3.5 MB/s | 3.4 MB 00:00 ------------------------------------------------------------------------------------------------------------------------------ Total 6.3 MB/s | 16 MB 00:02 Running transaction check Transaction check succeeded. Running transaction test Transaction test succeeded. Running transaction Running scriptlet: selinux-policy-targeted-42.1.4-1.el10.noarch 1/1 Preparing : 1/1 Upgrading : libsepol-3.9-1.el10.x86_64 1/35 Upgrading : libselinux-3.9-1.el10.x86_64 2/35 Running scriptlet: libselinux-3.9-1.el10.x86_64 2/35 Upgrading : python3-libselinux-3.9-1.el10.x86_64 3/35 Upgrading : libselinux-utils-3.9-1.el10.x86_64 4/35 Upgrading : libsemanage-3.9-1.el10.x86_64 5/35 Upgrading : policycoreutils-3.9-1.el10.x86_64 6/35 Running scriptlet: policycoreutils-3.9-1.el10.x86_64 6/35 Upgrading : selinux-policy-42.1.4-1.el10.noarch 7/35 Running scriptlet: selinux-policy-42.1.4-1.el10.noarch 7/35 Running scriptlet: selinux-policy-targeted-42.1.4-1.el10.noarch 8/35 Upgrading : selinux-policy-targeted-42.1.4-1.el10.noarch 8/35 Running scriptlet: selinux-policy-targeted-42.1.4-1.el10.noarch 8/35 Upgrading : python3-cloud-what-1.30.10-1.el10.x86_64 9/35 Upgrading : python3-subscription-manager-rhsm-1.30.10-1.el10.x86_64 10/35 Running scriptlet: insights-core-selinux-3.7.0-1.el10.noarch 11/35 Installing : insights-core-selinux-3.7.0-1.el10.noarch 11/35 Running scriptlet: insights-core-selinux-3.7.0-1.el10.noarch 11/35 Upgrading : python3-libsemanage-3.9-1.el10.x86_64 12/35 Upgrading : python3-policycoreutils-3.9-1.el10.noarch 13/35 Upgrading : policycoreutils-python-utils-3.9-1.el10.noarch 14/35 Upgrading : libdnf-plugin-subscription-manager-1.30.10-1.el10.x86_64 15/35 Running scriptlet: subscription-manager-1.30.10-1.el10.x86_64 16/35 Upgrading : subscription-manager-1.30.10-1.el10.x86_64 16/35 warning: /etc/rhsm/rhsm.conf created as /etc/rhsm/rhsm.conf.rpmnew Running scriptlet: subscription-manager-1.30.10-1.el10.x86_64 16/35 Upgrading : insights-client-3.10.1-2.el10.noarch 17/35 Running scriptlet: insights-client-3.10.1-2.el10.noarch 17/35 Running scriptlet: rhc-1:0.3.3-1.el10.x86_64 18/35 Upgrading : rhc-1:0.3.3-1.el10.x86_64 18/35 Running scriptlet: rhc-1:0.3.3-1.el10.x86_64 18/35 Running scriptlet: rhc-1:0.3.1-2.el10.x86_64 19/35 Cleanup : rhc-1:0.3.1-2.el10.x86_64 19/35 Running scriptlet: rhc-1:0.3.1-2.el10.x86_64 19/35 Running scriptlet: insights-client-3.10.0-1.el10.noarch 20/35 Cleanup : insights-client-3.10.0-1.el10.noarch 20/35 Running scriptlet: insights-client-3.10.0-1.el10.noarch 20/35 Running scriptlet: selinux-policy-40.13.26-1.el10.noarch 21/35 Cleanup : selinux-policy-40.13.26-1.el10.noarch 21/35 Running scriptlet: selinux-policy-40.13.26-1.el10.noarch 21/35 Running scriptlet: subscription-manager-1.30.6-1.el10_0.x86_64 22/35 Cleanup : subscription-manager-1.30.6-1.el10_0.x86_64 22/35 Running scriptlet: subscription-manager-1.30.6-1.el10_0.x86_64 22/35 Cleanup : selinux-policy-targeted-40.13.26-1.el10.noarch 23/35 Running scriptlet: selinux-policy-targeted-40.13.26-1.el10.noarch 23/35 Cleanup : policycoreutils-python-utils-3.8-1.el10.noarch 24/35 Cleanup : python3-policycoreutils-3.8-1.el10.noarch 25/35 Running scriptlet: policycoreutils-3.8-1.el10.x86_64 26/35 Cleanup : policycoreutils-3.8-1.el10.x86_64 26/35 Cleanup : libselinux-utils-3.8-1.el10.x86_64 27/35 Cleanup : python3-libsemanage-3.8.1-1.el10_0.x86_64 28/35 Cleanup : libsemanage-3.8.1-1.el10_0.x86_64 29/35 Cleanup : python3-libselinux-3.8-1.el10.x86_64 30/35 Cleanup : libselinux-3.8-1.el10.x86_64 31/35 Cleanup : python3-subscription-manager-rhsm-1.30.6-1.el10_0.x86_64 32/35 Cleanup : python3-cloud-what-1.30.6-1.el10_0.x86_64 33/35 Cleanup : libsepol-3.8-1.el10.x86_64 34/35 Cleanup : libdnf-plugin-subscription-manager-1.30.6-1.el10_0.x86_64 35/35 Running scriptlet: selinux-policy-targeted-42.1.4-1.el10.noarch 35/35 Running scriptlet: subscription-manager-1.30.10-1.el10.x86_64 35/35 Running scriptlet: libdnf-plugin-subscription-manager-1.30.6-1.el10_0.x86_64 35/35 Installed products updated. Upgraded: insights-client-3.10.1-2.el10.noarch libdnf-plugin-subscription-manager-1.30.10-1.el10.x86_64 libselinux-3.9-1.el10.x86_64 libselinux-utils-3.9-1.el10.x86_64 libsemanage-3.9-1.el10.x86_64 libsepol-3.9-1.el10.x86_64 policycoreutils-3.9-1.el10.x86_64 policycoreutils-python-utils-3.9-1.el10.noarch python3-cloud-what-1.30.10-1.el10.x86_64 python3-libselinux-3.9-1.el10.x86_64 python3-libsemanage-3.9-1.el10.x86_64 python3-policycoreutils-3.9-1.el10.noarch python3-subscription-manager-rhsm-1.30.10-1.el10.x86_64 rhc-1:0.3.3-1.el10.x86_64 selinux-policy-42.1.4-1.el10.noarch selinux-policy-targeted-42.1.4-1.el10.noarch subscription-manager-1.30.10-1.el10.x86_64 Installed: insights-core-selinux-3.7.0-1.el10.noarch Complete! RHCCC is installed after this, and a reboot follows to simulate autoreg workflow - which is just a dance of systemd units looking for files and executing commands. The system gets automatically registered via subscription-manager, and insights-client registration is to follow, but fails: Aug 05 16:42:04 ip-10-31-51-217.us-east-1.aws.redhat.com systemd[1]: Starting insights-register.service - Automatically Register with Red Hat Insights... Aug 05 16:42:04 ip-10-31-51-217.us-east-1.aws.redhat.com systemd[1]: insights-unregister.service - Automatically Unregister from Red Hat Insights was skipped because of an unmet condition check (ConditionPathExists=!/etc/pki/consumer/cert.pem). Aug 05 16:42:04 ip-10-31-51-217.us-east-1.aws.redhat.com systemd[1]: yggdrasil-stop.service - Automatically stop yggdrasil when rhsm cert does not exists was skipped because of an unmet condition check (ConditionPathExists=!/etc/pki/consumer/cert.pem). Aug 05 16:42:04 ip-10-31-51-217.us-east-1.aws.redhat.com systemd[1]: Starting yggdrasil.service - yggdrasil system service... Aug 05 16:42:05 ip-10-31-51-217.us-east-1.aws.redhat.com yggd[1876]: [yggd] 2025/08/05 16:42:05 starting yggd version 0.4.5 Aug 05 16:42:05 ip-10-31-51-217.us-east-1.aws.redhat.com yggd[1876]: [yggd] 2025/08/05 16:42:05 facts file not found, created '/var/lib/yggdrasil/canonical-facts.json' Aug 05 16:42:05 ip-10-31-51-217.us-east-1.aws.redhat.com systemd[1]: Started insights-register.service - Automatically Register with Red Hat Insights. Aug 05 16:42:05 ip-10-31-51-217.us-east-1.aws.redhat.com yggd[1876]: [yggd] 2025/08/05 16:42:05 exported /com/redhat/Yggdrasil1/Dispatcher1 on bus Aug 05 16:42:05 ip-10-31-51-217.us-east-1.aws.redhat.com yggd[1876]: [yggd] 2025/08/05 16:42:05 failed to publish message: not Connected Aug 05 16:42:05 ip-10-31-51-217.us-east-1.aws.redhat.com yggd[1876]: [yggd] 2025/08/05 16:42:05 cannot send connection status: not Connected Aug 05 16:42:05 ip-10-31-51-217.us-east-1.aws.redhat.com systemd[1]: Started yggdrasil.service - yggdrasil system service. Aug 05 16:42:05 ip-10-31-51-217.us-east-1.aws.redhat.com yggd[1876]: [yggd] 2025/08/05 16:42:05 exported /com/redhat/Yggdrasil1 on bus Aug 05 16:42:05 ip-10-31-51-217.us-east-1.aws.redhat.com yggd[1876]: [yggd] 2025/08/05 16:42:05 connecting to broker: [wss://connect.cloud.stage.redhat.com:443] Aug 05 16:42:05 ip-10-31-51-217.us-east-1.aws.redhat.com insights-client[1874]: Client: 3.10.1 Aug 05 16:42:05 ip-10-31-51-217.us-east-1.aws.redhat.com insights-client[1874]: Core: not found Aug 05 16:42:05 ip-10-31-51-217.us-east-1.aws.redhat.com subscription-manager[817]: Added subscription for 'Content Access' contract 'None' Aug 05 16:42:05 ip-10-31-51-217.us-east-1.aws.redhat.com subscription-manager[817]: Added subscription for product ' Content Access' Aug 05 16:42:05 ip-10-31-51-217.us-east-1.aws.redhat.com yggd[1876]: [yggd] 2025/08/05 16:42:05 cannot start watching '/etc/yggdrasil/tags.toml': lstat /etc/yggdrasil/tags.toml: no such file or directory Aug 05 16:42:05 ip-10-31-51-217.us-east-1.aws.redhat.com systemctl[1897]: Created symlink '/etc/systemd/system/insights-register.path' → '/dev/null'. Aug 05 16:42:05 ip-10-31-51-217.us-east-1.aws.redhat.com systemd[1]: Reload requested from client PID 1897 ('systemctl') (unit insights-register.service)... Aug 05 16:42:05 ip-10-31-51-217.us-east-1.aws.redhat.com systemd[1]: Reloading... Aug 05 16:42:05 ip-10-31-51-217.us-east-1.aws.redhat.com systemd-rc-local-generator[1933]: /etc/rc.d/rc.local is not marked executable, skipping. Aug 05 16:42:05 ip-10-31-51-217.us-east-1.aws.redhat.com systemd[1]: Reloading finished in 229 ms. Aug 05 16:42:05 ip-10-31-51-217.us-east-1.aws.redhat.com systemd[1]: Started yggdrasil.service - yggdrasil system service. Aug 05 16:42:05 ip-10-31-51-217.us-east-1.aws.redhat.com systemd[1]: insights-register.path: Deactivated successfully. Aug 05 16:42:05 ip-10-31-51-217.us-east-1.aws.redhat.com systemd[1]: Stopped insights-register.path. Aug 05 16:42:05 ip-10-31-51-217.us-east-1.aws.redhat.com systemd[1]: insights-register.service: Deactivated successfully. Aug 05 16:42:05 ip-10-31-51-217.us-east-1.aws.redhat.com systemd[1]: Starting insights-register.service - Automatically Register with Red Hat Insights... Aug 05 16:42:06 ip-10-31-51-217.us-east-1.aws.redhat.com systemd[1]: Started insights-register.service - Automatically Register with Red Hat Insights. Aug 05 16:42:06 ip-10-31-51-217.us-east-1.aws.redhat.com insights-client[1946]: Client: 3.10.1 Aug 05 16:42:06 ip-10-31-51-217.us-east-1.aws.redhat.com insights-client[1946]: Core: not found Aug 05 16:42:06 ip-10-31-51-217.us-east-1.aws.redhat.com systemd[1]: Reload requested from client PID 1962 ('systemctl') (unit insights-register.service)... Aug 05 16:42:06 ip-10-31-51-217.us-east-1.aws.redhat.com systemd[1]: Reloading... Aug 05 16:42:06 ip-10-31-51-217.us-east-1.aws.redhat.com systemd-rc-local-generator[2000]: /etc/rc.d/rc.local is not marked executable, skipping. Aug 05 16:42:06 ip-10-31-51-217.us-east-1.aws.redhat.com systemd[1]: Reloading finished in 242 ms. Aug 05 16:42:06 ip-10-31-51-217.us-east-1.aws.redhat.com systemd[1]: Started yggdrasil.service - yggdrasil system service. Aug 05 16:42:06 ip-10-31-51-217.us-east-1.aws.redhat.com systemd[1]: insights-register.service: Deactivated successfully. Some follow-on investigations: [root@ip-10-31-51-217 ec2-user]# systemctl status insights-register.service -l --no-pager ○ insights-register.service - Automatically Register with Red Hat Insights Loaded: loaded (/usr/lib/systemd/system/insights-register.service; static) Active: inactive (dead) Docs: man:insights-client(8) Aug 05 16:42:05 ip-10-31-51-217.us-east-1.aws.redhat.com systemd[1]: Started insights-register.service - Automatically Register with Red Hat Insights. Aug 05 16:42:05 ip-10-31-51-217.us-east-1.aws.redhat.com insights-client[1874]: Client: 3.10.1 Aug 05 16:42:05 ip-10-31-51-217.us-east-1.aws.redhat.com insights-client[1874]: Core: not found Aug 05 16:42:05 ip-10-31-51-217.us-east-1.aws.redhat.com systemctl[1897]: Created symlink '/etc/systemd/system/insights-register.path' → '/dev/null'. Aug 05 16:42:05 ip-10-31-51-217.us-east-1.aws.redhat.com systemd[1]: insights-register.service: Deactivated successfully. Aug 05 16:42:05 ip-10-31-51-217.us-east-1.aws.redhat.com systemd[1]: Starting insights-register.service - Automatically Register with Red Hat Insights... Aug 05 16:42:06 ip-10-31-51-217.us-east-1.aws.redhat.com systemd[1]: Started insights-register.service - Automatically Register with Red Hat Insights. Aug 05 16:42:06 ip-10-31-51-217.us-east-1.aws.redhat.com insights-client[1946]: Client: 3.10.1 Aug 05 16:42:06 ip-10-31-51-217.us-east-1.aws.redhat.com insights-client[1946]: Core: not found Aug 05 16:42:06 ip-10-31-51-217.us-east-1.aws.redhat.com systemd[1]: insights-register.service: Deactivated successfully. [root@ip-10-31-51-217 ~]# ll -a /etc/insights-client/ total 1328 drwxr-xr-x. 2 root root 177 Aug 5 16:25 . drwxr-xr-x. 92 root root 8192 Aug 5 16:41 .. -rw-r--r--. 1 root root 185 May 20 10:28 .exp.sed -r--r--r--. 1 root root 4586 May 20 10:28 cert-api.access.redhat.com.pem -rw-r--r--. 1 root root 1236 Aug 5 16:20 insights-client.conf -rw-r--r--. 1 root root 401 May 20 10:28 insights-client.motd -r--r--r--. 1 root root 1147 May 20 10:28 redhattools.pub.gpg -rw-r--r--. 1 root root 1318691 May 20 10:28 rpm.egg -rw-r--r--. 1 root root 819 May 20 10:28 rpm.egg.asc Selinux info: [root@ip-10-31-51-217 ~]# python3 -c 'import insights_client.constants; print(f"{insights_client.constants.CORE_SELINUX_POLICY=}")' insights_client.constants.CORE_SELINUX_POLICY='insights_core_t' Audit log: [root@ip-10-31-51-217 ~]# ausearch -i -ts today -m AVC,USER_AVC,SELINUX_ERR,USER_SELINUX_ERR ---- type=PROCTITLE msg=audit(08/05/25 16:42:05.503:155) : proctitle=gpg-agent --homedir /var/lib/insights/tmpgwfdzd9w --use-standard-socket --daemon type=SYSCALL msg=audit(08/05/25 16:42:05.503:155) : arch=x86_64 syscall=bind success=no exit=EACCES(Permission denied) a0=0x3 a1=0x5606da6316e0 a2=0x2b a3=0x0 items=0 ppid=1888 pid=1889 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=gpg-agent exe=/usr/bin/gpg-agent subj=system_u:system_r:gpg_agent_t:s0 key=(null) type=AVC msg=audit(08/05/25 16:42:05.503:155) : avc: denied { create } for pid=1889 comm=gpg-agent name=S.gpg-agent scontext=system_u:system_r:gpg_agent_t:s0 tcontext=system_u:object_r:insights_client_var_lib_t:s0 tclass=sock_file permissive=0 ---- type=PROCTITLE msg=audit(08/05/25 16:42:06.444:196) : proctitle=gpg-agent --homedir /var/lib/insights/tmpfl8jv7tp --use-standard-socket --daemon type=SYSCALL msg=audit(08/05/25 16:42:06.444:196) : arch=x86_64 syscall=bind success=no exit=EACCES(Permission denied) a0=0x3 a1=0x55f174fc46e0 a2=0x2b a3=0x0 items=0 ppid=1952 pid=1953 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=gpg-agent exe=/usr/bin/gpg-agent subj=system_u:system_r:gpg_agent_t:s0 key=(null) type=AVC msg=audit(08/05/25 16:42:06.444:196) : avc: denied { create } for pid=1953 comm=gpg-agent name=S.gpg-agent scontext=system_u:system_r:gpg_agent_t:s0 tcontext=system_u:object_r:insights_client_var_lib_t:s0 tclass=sock_file permissive=0 Finally, manually trying insights-client --register: [root@ip-10-31-51-217 ~]# insights-client --register Automatic scheduling for Insights has been enabled. Starting to collect Insights data for ip-10-31-51-217.us-east-1.aws.redhat.com Writing RHSM facts to /etc/rhsm/facts/insights-client.facts ... Uploading Insights data. Successfully uploaded report for ip-10-31-51-217.us-east-1.aws.redhat.com. View the Red Hat Insights console at https://console.stage.redhat.com/insights/ So we see that it works unconfined from root, but not executed by the systemd service units.

Release Notes

No. of Comments

Resolution

Unresolved