RHOAIENG-32541: fix(subscription): remove subscription-manager.*register from Dockerfiles to have Konflux do it for us

jiridanek · jiridanek · commit a90c7b480916 · 2025-11-15T18:04:24.000+01:00
```
        if ! grep -E "^[^#]*subscription-manager.[^#]*register" "$dockerfile_path"; then
          # user is not running registration in the Containerfile: pre-register.
          echo "Pre-registering with subscription manager."
          export RETRY_MAX_TRIES=6
          if ! retry subscription-manager register --org "$(cat /tmp/activation-key/org)" --activationkey "$(cat /tmp/activation-key/activationkey)"
          then
            echo "Subscription-manager register failed"
            exit 1
          fi
          unset RETRY_MAX_TRIES
          trap 'subscription-manager unregister || true' EXIT

          # copy generated certificates to /shared volume
          cp /etc/pki/entitlement/*.pem /shared/rhsm/etc/pki/entitlement
          cp /etc/pki/consumer/*.pem /shared/rhsm/etc/pki/consumer

          # and then mount get /etc/rhsm/ca/redhat-uep.pem into /run/secrets/rhsm/ca
          VOLUME_MOUNTS+=(--volume /etc/rhsm/ca/redhat-uep.pem:/etc/rhsm/ca/redhat-uep.pem:Z)
        fi
```
diff --git a/codeserver/ubi9-python-3.12/Dockerfile.konflux.cpu b/codeserver/ubi9-python-3.12/Dockerfile.konflux.cpu
@@ -88,7 +88,7 @@ COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo
 RUN /bin/bash <<'EOF'
 set -Eeuxo pipefail
 if command -v subscription-manager &> /dev/null; then
-  subscription-manager identity &>/dev/null && subscription-manager refresh || echo "Not registered, skipping refresh."
+  subscription-manager identity &>/dev/null && subscription-manager refresh || echo "No identity, skipping refresh."
 fi
 EOF
 
diff --git a/jupyter/datascience/ubi9-python-3.12/Dockerfile.konflux.cpu b/jupyter/datascience/ubi9-python-3.12/Dockerfile.konflux.cpu
@@ -57,7 +57,7 @@ COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo
 RUN /bin/bash <<'EOF'
 set -Eeuxo pipefail
 if command -v subscription-manager &> /dev/null; then
-  subscription-manager identity &>/dev/null && subscription-manager refresh || echo "Not registered, skipping refresh."
+  subscription-manager identity &>/dev/null && subscription-manager refresh || echo "No identity, skipping refresh."
 fi
 EOF
 
diff --git a/jupyter/minimal/ubi9-python-3.12/Dockerfile.konflux.cpu b/jupyter/minimal/ubi9-python-3.12/Dockerfile.konflux.cpu
@@ -45,7 +45,7 @@ COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo
 RUN /bin/bash <<'EOF'
 set -Eeuxo pipefail
 if command -v subscription-manager &> /dev/null; then
-  subscription-manager identity &>/dev/null && subscription-manager refresh || echo "Not registered, skipping refresh."
+  subscription-manager identity &>/dev/null && subscription-manager refresh || echo "No identity, skipping refresh."
 fi
 EOF
 
diff --git a/jupyter/minimal/ubi9-python-3.12/Dockerfile.konflux.cuda b/jupyter/minimal/ubi9-python-3.12/Dockerfile.konflux.cuda
@@ -28,7 +28,7 @@ COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo
 RUN /bin/bash <<'EOF'
 set -Eeuxo pipefail
 if command -v subscription-manager &> /dev/null; then
-  subscription-manager identity &>/dev/null && subscription-manager refresh || echo "Not registered, skipping refresh."
+  subscription-manager identity &>/dev/null && subscription-manager refresh || echo "No identity, skipping refresh."
 fi
 EOF
 
diff --git a/jupyter/minimal/ubi9-python-3.12/Dockerfile.konflux.rocm b/jupyter/minimal/ubi9-python-3.12/Dockerfile.konflux.rocm
@@ -26,7 +26,7 @@ COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo
 RUN /bin/bash <<'EOF'
 set -Eeuxo pipefail
 if command -v subscription-manager &> /dev/null; then
-  subscription-manager identity &>/dev/null && subscription-manager refresh || echo "Not registered, skipping refresh."
+  subscription-manager identity &>/dev/null && subscription-manager refresh || echo "No identity, skipping refresh."
 fi
 EOF
 
diff --git a/jupyter/pytorch+llmcompressor/ubi9-python-3.12/Dockerfile.konflux.cuda b/jupyter/pytorch+llmcompressor/ubi9-python-3.12/Dockerfile.konflux.cuda
@@ -44,7 +44,7 @@ COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo
 RUN /bin/bash <<'EOF'
 set -Eeuxo pipefail
 if command -v subscription-manager &> /dev/null; then
-  subscription-manager identity &>/dev/null && subscription-manager refresh || echo "Not registered, skipping refresh."
+  subscription-manager identity &>/dev/null && subscription-manager refresh || echo "No identity, skipping refresh."
 fi
 EOF
 
diff --git a/jupyter/pytorch/ubi9-python-3.12/Dockerfile.konflux.cuda b/jupyter/pytorch/ubi9-python-3.12/Dockerfile.konflux.cuda
@@ -44,7 +44,7 @@ COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo
 RUN /bin/bash <<'EOF'
 set -Eeuxo pipefail
 if command -v subscription-manager &> /dev/null; then
-  subscription-manager identity &>/dev/null && subscription-manager refresh || echo "Not registered, skipping refresh."
+  subscription-manager identity &>/dev/null && subscription-manager refresh || echo "No identity, skipping refresh."
 fi
 EOF
 
diff --git a/jupyter/rocm/pytorch/ubi9-python-3.12/Dockerfile.konflux.rocm b/jupyter/rocm/pytorch/ubi9-python-3.12/Dockerfile.konflux.rocm
@@ -42,7 +42,7 @@ COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo
 RUN /bin/bash <<'EOF'
 set -Eeuxo pipefail
 if command -v subscription-manager &> /dev/null; then
-  subscription-manager identity &>/dev/null && subscription-manager refresh || echo "Not registered, skipping refresh."
+  subscription-manager identity &>/dev/null && subscription-manager refresh || echo "No identity, skipping refresh."
 fi
 EOF
 
diff --git a/jupyter/rocm/tensorflow/ubi9-python-3.12/Dockerfile.konflux.rocm b/jupyter/rocm/tensorflow/ubi9-python-3.12/Dockerfile.konflux.rocm
@@ -42,7 +42,7 @@ COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo
 RUN /bin/bash <<'EOF'
 set -Eeuxo pipefail
 if command -v subscription-manager &> /dev/null; then
-  subscription-manager identity &>/dev/null && subscription-manager refresh || echo "Not registered, skipping refresh."
+  subscription-manager identity &>/dev/null && subscription-manager refresh || echo "No identity, skipping refresh."
 fi
 EOF
 
diff --git a/jupyter/tensorflow/ubi9-python-3.12/Dockerfile.konflux.cuda b/jupyter/tensorflow/ubi9-python-3.12/Dockerfile.konflux.cuda
@@ -44,7 +44,7 @@ COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo
 RUN /bin/bash <<'EOF'
 set -Eeuxo pipefail
 if command -v subscription-manager &> /dev/null; then
-  subscription-manager identity &>/dev/null && subscription-manager refresh || echo "Not registered, skipping refresh."
+  subscription-manager identity &>/dev/null && subscription-manager refresh || echo "No identity, skipping refresh."
 fi
 EOF
 
diff --git a/jupyter/trustyai/ubi9-python-3.12/Dockerfile.konflux.cpu b/jupyter/trustyai/ubi9-python-3.12/Dockerfile.konflux.cpu
@@ -67,7 +67,7 @@ COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo
 RUN /bin/bash <<'EOF'
 set -Eeuxo pipefail
 if command -v subscription-manager &> /dev/null; then
-  subscription-manager identity &>/dev/null && subscription-manager refresh || echo "Not registered, skipping refresh."
+  subscription-manager identity &>/dev/null && subscription-manager refresh || echo "No identity, skipping refresh."
 fi
 EOF
 
diff --git a/rstudio/rhel9-python-3.12/Dockerfile.konflux.cpu b/rstudio/rhel9-python-3.12/Dockerfile.konflux.cpu
@@ -24,19 +24,12 @@ USER root
 COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo
 COPY --from=ubi-repos /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
 
-RUN /bin/bash <<'EOF'
-set -Eeuxo pipefail
-if command -v subscription-manager &> /dev/null; then
-  subscription-manager identity &>/dev/null && subscription-manager refresh || echo "Not registered, skipping refresh."
-fi
-EOF
-
 ### BEGIN upgrade first to avoid fixable vulnerabilities
 # If we have a Red Hat subscription prepared, refresh it
 RUN /bin/bash <<'EOF'
 set -Eeuxo pipefail
 if command -v subscription-manager &> /dev/null; then
-  subscription-manager identity &>/dev/null && subscription-manager refresh || echo "Not registered, skipping refresh."
+  subscription-manager identity &>/dev/null && subscription-manager refresh || echo "No identity, skipping refresh."
 fi
 EOF
 
@@ -95,30 +88,6 @@ LABEL name="rhoai/odh-workbench-rstudio-minimal-cpu-py312-rhel9" \
 
 USER 0
 
-# TODO THIS SHOULD BE REMOVED in favor of: https://issues.redhat.com/browse/RHOAIENG-32541
-# uncomment the below line if you fall on this error: subscription-manager is disabled when running inside a container. Please refer to your host system for subscription management.
-#RUN sed -i 's/\(def in_container():\)/\1\n    return False/g' /usr/lib64/python*/*-packages/rhsm/config.py
-
-# If necessary, run the subscription manager command using the provided credentials. Only include --serverurl and --baseurl if they are provided
-RUN /bin/bash <<'EOF'
-set -Eeuxo pipefail
-if [ -d "${SECRET_DIR}" ]; then
-    SERVERURL=$(cat ${SECRET_DIR}/SERVERURL 2>/dev/null || echo ${SERVERURL_DEFAULT})
-    BASEURL=$(cat ${SECRET_DIR}/BASEURL 2>/dev/null || echo ${BASEURL_DEFAULT})
-    USERNAME=$(cat ${SECRET_DIR}/USERNAME)
-    PASSWORD=$(cat ${SECRET_DIR}/PASSWORD)
-    subscription-manager register \
-    ${SERVERURL:+--serverurl=$SERVERURL} \
-    ${BASEURL:+--baseurl=$BASEURL} \
-    --username=$USERNAME \
-    --password=$PASSWORD \
-    --force \
-    --auto-attach
-fi
-EOF
-
-# TILL HERE
-
 ENV R_VERSION=4.5.1
 
 # Install R
@@ -267,17 +236,6 @@ WORKDIR /opt/app-root/bin
 COPY ${RSTUDIO_SOURCE_CODE}/utils utils/
 COPY ${RSTUDIO_SOURCE_CODE}/run-rstudio.sh ${RSTUDIO_SOURCE_CODE}/setup_rstudio.py ${RSTUDIO_SOURCE_CODE}/rsession.sh ${RSTUDIO_SOURCE_CODE}/run-nginx.sh ./
 
-# TODO THIS SHOULD BE REMOVED in favor of: https://issues.redhat.com/browse/RHOAIENG-32541
-# Unregister the system
-RUN /bin/bash <<'EOF'
-set -Eeuxo pipefail
-if [ -d "${SECRET_DIR}" ]; then
-    subscription-manager remove --all && subscription-manager unregister && subscription-manager clean
-fi
-EOF
-
-# TILL HERE
-
 USER 1001
 
 COPY ${RSTUDIO_SOURCE_CODE}/pylock.toml ./
diff --git a/rstudio/rhel9-python-3.12/Dockerfile.konflux.cuda b/rstudio/rhel9-python-3.12/Dockerfile.konflux.cuda
@@ -24,19 +24,12 @@ USER root
 COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo
 COPY --from=ubi-repos /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
 
-RUN /bin/bash <<'EOF'
-set -Eeuxo pipefail
-if command -v subscription-manager &> /dev/null; then
-  subscription-manager identity &>/dev/null && subscription-manager refresh || echo "Not registered, skipping refresh."
-fi
-EOF
-
 ### BEGIN upgrade first to avoid fixable vulnerabilities
 # If we have a Red Hat subscription prepared, refresh it
 RUN /bin/bash <<'EOF'
 set -Eeuxo pipefail
 if command -v subscription-manager &> /dev/null; then
-  subscription-manager identity &>/dev/null && subscription-manager refresh || echo "Not registered, skipping refresh."
+  subscription-manager identity &>/dev/null && subscription-manager refresh || echo "No identity, skipping refresh."
 fi
 EOF
 
@@ -109,30 +102,6 @@ EOF
 WORKDIR /opt/app-root/src
 # TILL HERE
 
-# TODO THIS SHOULD BE REMOVED in favor of: https://issues.redhat.com/browse/RHOAIENG-32541
-# uncomment the below line if you fall on this error: subscription-manager is disabled when running inside a container. Please refer to your host system for subscription management.
-#RUN sed -i 's/\(def in_container():\)/\1\n    return False/g' /usr/lib64/python*/*-packages/rhsm/config.py
-
-# If necessary, run the subscription manager command using the provided credentials. Only include --serverurl and --baseurl if they are provided
-RUN /bin/bash <<'EOF'
-set -Eeuxo pipefail
-if [ -d "${SECRET_DIR}" ]; then
-    SERVERURL=$(cat ${SECRET_DIR}/SERVERURL 2>/dev/null || echo ${SERVERURL_DEFAULT})
-    BASEURL=$(cat ${SECRET_DIR}/BASEURL 2>/dev/null || echo ${BASEURL_DEFAULT})
-    USERNAME=$(cat ${SECRET_DIR}/USERNAME)
-    PASSWORD=$(cat ${SECRET_DIR}/PASSWORD)
-    subscription-manager register \
-    ${SERVERURL:+--serverurl=$SERVERURL} \
-    ${BASEURL:+--baseurl=$BASEURL} \
-    --username=$USERNAME \
-    --password=$PASSWORD \
-    --force \
-    --auto-attach
-fi
-EOF
-
-# TILL HERE
-
 ENV R_VERSION=4.5.1
 
 # Install R
@@ -281,17 +250,6 @@ WORKDIR /opt/app-root/bin
 COPY ${RSTUDIO_SOURCE_CODE}/utils utils/
 COPY ${RSTUDIO_SOURCE_CODE}/run-rstudio.sh ${RSTUDIO_SOURCE_CODE}/setup_rstudio.py ${RSTUDIO_SOURCE_CODE}/rsession.sh ${RSTUDIO_SOURCE_CODE}/run-nginx.sh ./
 
-# TODO THIS SHOULD BE REMOVED in favor of: https://issues.redhat.com/browse/RHOAIENG-32541
-# Unregister the system
-RUN /bin/bash <<'EOF'
-set -Eeuxo pipefail
-if [ -d "${SECRET_DIR}" ]; then
-    subscription-manager remove --all && subscription-manager unregister && subscription-manager clean
-fi
-EOF
-
-# TILL HERE
-
 USER 1001
 
 COPY ${RSTUDIO_SOURCE_CODE}/pylock.toml ./
diff --git a/runtimes/datascience/ubi9-python-3.12/Dockerfile.konflux.cpu b/runtimes/datascience/ubi9-python-3.12/Dockerfile.konflux.cpu
@@ -30,7 +30,7 @@ ARG TARGETARCH
 RUN /bin/bash <<'EOF'
 set -Eeuxo pipefail
 if command -v subscription-manager &> /dev/null; then
-  subscription-manager identity &>/dev/null && subscription-manager refresh || echo "Not registered, skipping refresh."
+  subscription-manager identity &>/dev/null && subscription-manager refresh || echo "No identity, skipping refresh."
 fi
 EOF
 
diff --git a/runtimes/minimal/ubi9-python-3.12/Dockerfile.konflux.cpu b/runtimes/minimal/ubi9-python-3.12/Dockerfile.konflux.cpu
@@ -26,7 +26,7 @@ COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo
 RUN /bin/bash <<'EOF'
 set -Eeuxo pipefail
 if command -v subscription-manager &> /dev/null; then
-  subscription-manager identity &>/dev/null && subscription-manager refresh || echo "Not registered, skipping refresh."
+  subscription-manager identity &>/dev/null && subscription-manager refresh || echo "No identity, skipping refresh."
 fi
 EOF
 
diff --git a/runtimes/pytorch+llmcompressor/ubi9-python-3.12/Dockerfile.konflux.cuda b/runtimes/pytorch+llmcompressor/ubi9-python-3.12/Dockerfile.konflux.cuda
@@ -28,7 +28,7 @@ COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo
 RUN /bin/bash <<'EOF'
 set -Eeuxo pipefail
 if command -v subscription-manager &> /dev/null; then
-  subscription-manager identity &>/dev/null && subscription-manager refresh || echo "Not registered, skipping refresh."
+  subscription-manager identity &>/dev/null && subscription-manager refresh || echo "No identity, skipping refresh."
 fi
 EOF
 
diff --git a/runtimes/pytorch/ubi9-python-3.12/Dockerfile.konflux.cuda b/runtimes/pytorch/ubi9-python-3.12/Dockerfile.konflux.cuda
@@ -28,7 +28,7 @@ COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo
 RUN /bin/bash <<'EOF'
 set -Eeuxo pipefail
 if command -v subscription-manager &> /dev/null; then
-  subscription-manager identity &>/dev/null && subscription-manager refresh || echo "Not registered, skipping refresh."
+  subscription-manager identity &>/dev/null && subscription-manager refresh || echo "No identity, skipping refresh."
 fi
 EOF
 
diff --git a/runtimes/rocm-pytorch/ubi9-python-3.12/Dockerfile.konflux.rocm b/runtimes/rocm-pytorch/ubi9-python-3.12/Dockerfile.konflux.rocm
@@ -26,7 +26,7 @@ COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo
 RUN /bin/bash <<'EOF'
 set -Eeuxo pipefail
 if command -v subscription-manager &> /dev/null; then
-  subscription-manager identity &>/dev/null && subscription-manager refresh || echo "Not registered, skipping refresh."
+  subscription-manager identity &>/dev/null && subscription-manager refresh || echo "No identity, skipping refresh."
 fi
 EOF
 
diff --git a/runtimes/rocm-tensorflow/ubi9-python-3.12/Dockerfile.konflux.rocm b/runtimes/rocm-tensorflow/ubi9-python-3.12/Dockerfile.konflux.rocm
@@ -26,7 +26,7 @@ COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo
 RUN /bin/bash <<'EOF'
 set -Eeuxo pipefail
 if command -v subscription-manager &> /dev/null; then
-  subscription-manager identity &>/dev/null && subscription-manager refresh || echo "Not registered, skipping refresh."
+  subscription-manager identity &>/dev/null && subscription-manager refresh || echo "No identity, skipping refresh."
 fi
 EOF
 
diff --git a/runtimes/tensorflow/ubi9-python-3.12/Dockerfile.konflux.cuda b/runtimes/tensorflow/ubi9-python-3.12/Dockerfile.konflux.cuda
@@ -30,7 +30,7 @@ COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo
 RUN /bin/bash <<'EOF'
 set -Eeuxo pipefail
 if command -v subscription-manager &> /dev/null; then
-  subscription-manager identity &>/dev/null && subscription-manager refresh || echo "Not registered, skipping refresh."
+  subscription-manager identity &>/dev/null && subscription-manager refresh || echo "No identity, skipping refresh."
 fi
 EOF
 
