CLOS-4056: gate CLN-assuming actors on is_cln_configured()

Systems migrated to the no-auth (SWNG) scheme no longer have CLN as a
package source. Several CL-specific actors assumed CLN was always active
and either crashed on missing files or produced spurious inhibitors.

Add cln_detect.is_cln_configured() — True when the CLN plumbing is
present and not explicitly disabled (registration file exists + spacewalk
plugin installed + plugin enabled). Gate these actors on it:

- switch_cln_channel: skip the cln-switch-channel call on no-auth systems.
  Also downgrade the failed-switch inhibitor to a MEDIUM report, since a
  failure on a transitional system where CLN plumbing lingers but is no
  longer usable should not block the upgrade — CL9 packages come from
  cl-channel / cloudlinux9-baseos instead.
- pin_cln_mirror / unpin_cln_mirror: no-op on no-auth systems; also wrap
  the up2date update in try/except in pin_cln_mirror in case the file was
  not shipped on the target.
- check_rhn_version_override / reset_rhn_version_override: skip on no-auth
  systems and fall back cleanly when /etc/sysconfig/rhn/up2date is
  missing. reset_rhn_version_override: also fix a pre-existing bug where
  rebinding  inside the loop did not update config_data, so the
  reset was silently a no-op.

enable_yum_spacewalk_plugin is not touched here — CLOS-3960 has concurrent
work on it.

Author: prilr

repos/system_upgrade/cloudlinux/actors/checkrhnversionoverride/actor.py

@@ -1,8 +1,10 @@
 from leapp.actors import Actor
 from leapp import reporting
+from leapp.libraries.stdlib import api
 from leapp.reporting import Report
 from leapp.tags import ChecksPhaseTag, IPUWorkflowTag
 from leapp.libraries.common.cllaunch import run_on_cloudlinux
+from leapp.libraries.common.cln_detect import is_cln_configured
 
 
 class CheckRhnVersionOverride(Actor):
@@ -17,23 +19,35 @@ class CheckRhnVersionOverride(Actor):
 
     @run_on_cloudlinux
     def process(self):
+        if not is_cln_configured():
+            # CLOS-4056: no-auth systems have no CLN config to inspect.
+            return
+
         up2date_config = '/etc/sysconfig/rhn/up2date'
-        with open(up2date_config, 'r') as f:
-            config_data = f.readlines()
-            for line in config_data:
-                if line.startswith('versionOverride='):
-                    stripped_line = line.strip().split("=")
-                    versionOverrideValue = stripped_line[1]
-                    # If the version is being overriden to 8, we can continue as is.
-                    if versionOverrideValue not in ['', '8']:
-                        title = 'RHN up2date: versionOverride overwritten by the upgrade'
-                        summary = ("The RHN config file up2date has a set value of the versionOverride option: {}."
-                                " This value will get overwritten by the upgrade process, and reset to an empty"
-                                " value once it's complete.".format(versionOverrideValue))
-                        reporting.create_report([
-                            reporting.Title(title),
-                            reporting.Summary(summary),
-                            reporting.Severity(reporting.Severity.MEDIUM),
-                            reporting.Groups([reporting.Groups.OS_FACTS]),
-                            reporting.RelatedResource('file', '/etc/sysconfig/rhn/up2date')
-                        ])
+        try:
+            with open(up2date_config, 'r') as f:
+                config_data = f.readlines()
+        except (OSError, IOError):
+            api.current_logger().info(
+                "RHN up2date config %s not present; skipping versionOverride check",
+                up2date_config,
+            )
+            return
+
+        for line in config_data:
+            if line.startswith('versionOverride='):
+                stripped_line = line.strip().split("=")
+                versionOverrideValue = stripped_line[1]
+                # If the version is being overriden to 8, we can continue as is.
+                if versionOverrideValue not in ['', '8']:
+                    title = 'RHN up2date: versionOverride overwritten by the upgrade'
+                    summary = ("The RHN config file up2date has a set value of the versionOverride option: {}."
+                            " This value will get overwritten by the upgrade process, and reset to an empty"
+                            " value once it's complete.".format(versionOverrideValue))
+                    reporting.create_report([
+                        reporting.Title(title),
+                        reporting.Summary(summary),
+                        reporting.Severity(reporting.Severity.MEDIUM),
+                        reporting.Groups([reporting.Groups.OS_FACTS]),
+                        reporting.RelatedResource('file', '/etc/sysconfig/rhn/up2date')
+                    ])

repos/system_upgrade/cloudlinux/actors/pinclnmirror/actor.py

@@ -4,6 +4,7 @@
 from leapp.actors import Actor
 from leapp.libraries.stdlib import api
 from leapp.libraries.common.cllaunch import run_on_cloudlinux
+from leapp.libraries.common.cln_detect import is_cln_configured
 from leapp.libraries.common.cln_switch import get_target_userspace_path
 from leapp.tags import DownloadPhaseTag, IPUWorkflowTag
 from leapp.libraries.common.config.version import get_target_major_version
@@ -25,6 +26,13 @@ class PinClnMirror(Actor):
     @run_on_cloudlinux
     def process(self):
         """Pin CLN mirror"""
+        if not is_cln_configured():
+            # CLOS-4056: no-auth systems don't use CLN mirrors; skip cleanly.
+            api.current_logger().info(
+                "CLN is not configured on this system; skipping mirror pinning"
+            )
+            return
+
         target_userspace = get_target_userspace_path()
         api.current_logger().info("Pin CLN mirror: target userspace=%s", target_userspace)
 
@@ -54,6 +62,11 @@ def process(self):
         api.current_logger().info("Pin CLN mirror %s in %s", mirror_url, mirrorlist_path)
 
         up2date_path = os.path.join(target_userspace, 'etc/sysconfig/rhn/up2date')
-        with open(up2date_path, 'a+') as file:
-            file.write('\nmirrorURL[comment]=Set mirror URL to /etc/mirrorlist\nmirrorURL=file:///etc/mirrorlist\n')
-        api.current_logger().info("Updated up2date_path %s", up2date_path)
+        try:
+            with open(up2date_path, 'a+') as file:
+                file.write('\nmirrorURL[comment]=Set mirror URL to /etc/mirrorlist\nmirrorURL=file:///etc/mirrorlist\n')
+            api.current_logger().info("Updated up2date_path %s", up2date_path)
+        except (OSError, IOError) as e:
+            api.current_logger().info(
+                "Could not update %s: %s", up2date_path, e,
+            )

repos/system_upgrade/cloudlinux/actors/resetrhnversionoverride/actor.py

@@ -1,6 +1,8 @@
 from leapp.actors import Actor
+from leapp.libraries.stdlib import api
 from leapp.tags import FinalizationPhaseTag, IPUWorkflowTag
 from leapp.libraries.common.cllaunch import run_on_cloudlinux
+from leapp.libraries.common.cln_detect import is_cln_configured
 
 
 class ResetRhnVersionOverride(Actor):
@@ -15,11 +17,26 @@ class ResetRhnVersionOverride(Actor):
 
     @run_on_cloudlinux
     def process(self):
+        if not is_cln_configured():
+            # CLOS-4056: no-auth systems have no CLN config to reset.
+            return
+
         up2date_config = '/etc/sysconfig/rhn/up2date'
-        with open(up2date_config, 'r') as f:
-            config_data = f.readlines()
-            for line in config_data:
-                if line.startswith('versionOverride='):
-                    line = 'versionOverride='
+        try:
+            with open(up2date_config, 'r') as f:
+                config_data = f.readlines()
+        except (OSError, IOError):
+            api.current_logger().info(
+                "RHN up2date config %s not present; skipping versionOverride reset",
+                up2date_config,
+            )
+            return
+
+        new_data = []
+        for line in config_data:
+            if line.startswith('versionOverride='):
+                new_data.append('versionOverride=\n')
+            else:
+                new_data.append(line)
         with open(up2date_config, 'w') as f:
-            f.writelines(config_data)
+            f.writelines(new_data)

repos/system_upgrade/cloudlinux/actors/switchclnchannel/actor.py

@@ -3,7 +3,8 @@
 from leapp.tags import FirstBootPhaseTag, IPUWorkflowTag
 from leapp.libraries.stdlib import CalledProcessError
 from leapp.libraries.common.cllaunch import run_on_cloudlinux
-from leapp.libraries.common.cln_switch import cln_switch, get_target_userspace_path
+from leapp.libraries.common.cln_detect import is_cln_configured
+from leapp.libraries.common.cln_switch import cln_switch
 from leapp import reporting
 from leapp.reporting import Report
 from leapp.libraries.common.config.version import get_target_major_version
@@ -22,9 +23,22 @@ class SwitchClnChannel(Actor):
 
     @run_on_cloudlinux
     def process(self):
+        if not is_cln_configured():
+            # CLOS-4056: No-auth (SWNG) systems have no CLN plumbing. Skipping
+            # the channel switch here is correct — the system receives CL9
+            # packages via cl-channel / cloudlinux9-baseos instead.
+            api.current_logger().info(
+                "CLN is not configured on this system; skipping channel switch"
+            )
+            return
+
         try:
             cln_switch(target=int(get_target_major_version()))
         except CalledProcessError as e:
+            # CLOS-4056: Do not inhibit. CLN may be partially configured (legacy
+            # registration files present but no working registration) on systems
+            # transitioning to the no-auth scheme, and a failed channel switch
+            # there is expected — the no-auth repos still serve CL9 packages.
             reporting.create_report(
                 [
                     reporting.Title(
@@ -33,17 +47,20 @@ def process(self):
                     reporting.Summary(
                         "Command {} failed with exit code {}."
                         " The most probable cause of that is a problem with this system's"
-                        " CloudLinux Network registration.".format(e.command, e.exit_code)
+                        " CloudLinux Network registration. If this system now uses the"
+                        " no-auth (SWNG) repository scheme, this failure is harmless —"
+                        " CL9 packages come from cl-channel / cloudlinux9-baseos instead"
+                        " of CLN.".format(e.command, e.exit_code)
                     ),
                     reporting.Remediation(
-                        hint="Check the state of this system's registration with \'rhn_check\'."
-                        " Attempt to re-register the system with \'rhnreg_ks --force\'."
+                        hint="If you rely on CLN: check registration with 'rhn_check' and"
+                        " re-register with 'rhnreg_ks --force'. If you have migrated to"
+                        " no-auth repos, this message can be ignored."
                     ),
-                    reporting.Severity(reporting.Severity.HIGH),
+                    reporting.Severity(reporting.Severity.MEDIUM),
                     reporting.Groups(
                         [reporting.Groups.OS_FACTS, reporting.Groups.AUTHENTICATION]
                     ),
-                    reporting.Groups([reporting.Groups.INHIBITOR]),
                 ]
             )
         except OSError as e:

repos/system_upgrade/cloudlinux/actors/unpinclnmirror/actor.py

@@ -2,6 +2,7 @@
 
 from leapp.actors import Actor
 from leapp.libraries.common.cllaunch import run_on_cloudlinux
+from leapp.libraries.common.cln_detect import is_cln_configured
 from leapp.libraries.common.cln_switch import get_target_userspace_path
 from leapp.tags import FirstBootPhaseTag, IPUWorkflowTag
 
@@ -19,6 +20,10 @@ class UnpinClnMirror(Actor):
 
     @run_on_cloudlinux
     def process(self):
+        if not is_cln_configured():
+            # CLOS-4056: pinclnmirror was skipped on no-auth systems, nothing to unpin.
+            return
+
         target_userspace = get_target_userspace_path()
 
         mirrorlist_path = os.path.join(target_userspace, 'etc/mirrorlist')

repos/system_upgrade/cloudlinux/libraries/cln_detect.py

@@ -0,0 +1,55 @@
+"""Detection helpers for CLN (CloudLinux Network / Spacewalk) state.
+
+A system is considered to have CLN *configured* when it has registration
+state plus the spacewalk DNF/YUM plugin installed and not explicitly
+disabled. Systems that have been migrated to the no-auth (SWNG mirrorlist)
+scheme have either:
+
+  - no `/etc/sysconfig/rhn/systemid` (never registered or deregistered),
+  - no spacewalk plugin installed (rhn-client-tools >= 3.0.1 removes it), or
+  - the plugin's `enabled = 0` in its config.
+
+CLOS-4056: several CloudLinux-specific actors were written when CLN was the
+only scheme and assume it is always active. They need to gate their
+behavior on `is_cln_configured()` so systems on the no-auth scheme pass
+through without bogus inhibitors or crashes.
+"""
+
+import os
+
+
+RHN_SYSTEMID = '/etc/sysconfig/rhn/systemid'
+SPACEWALK_DNF_CONF = '/etc/dnf/plugins/spacewalk.conf'
+SPACEWALK_YUM_CONF = '/etc/yum/pluginconf.d/spacewalk.conf'
+
+
+def _plugin_explicitly_disabled(conf_path):
+    try:
+        with open(conf_path) as f:
+            for line in f:
+                stripped = line.strip().lower()
+                if not stripped or stripped.startswith('#') or stripped.startswith('['):
+                    continue
+                if stripped.startswith('enabled') and '=' in stripped:
+                    value = stripped.split('=', 1)[1].strip()
+                    return value == '0'
+    except (OSError, IOError):
+        pass
+    return False
+
+
+def is_cln_configured():
+    """Return True if CLN plumbing is present and not disabled on this system."""
+    if not os.path.exists(RHN_SYSTEMID):
+        return False
+
+    configs = [p for p in (SPACEWALK_DNF_CONF, SPACEWALK_YUM_CONF) if os.path.exists(p)]
+    if not configs:
+        return False
+
+    # If any plugin config explicitly disables the plugin, treat as no-auth.
+    for conf in configs:
+        if _plugin_explicitly_disabled(conf):
+            return False
+
+    return True

repos/system_upgrade/cloudlinux/libraries/tests/test_cln_detect.py

@@ -0,0 +1,74 @@
+import os
+
+import pytest
+
+from leapp.libraries.common import cln_detect
+
+
+@pytest.fixture
+def clean_paths(monkeypatch, tmp_path):
+    """Point cln_detect at a clean tmp dir so each test starts from no state."""
+    systemid = tmp_path / "systemid"
+    dnf_conf = tmp_path / "dnf_spacewalk.conf"
+    yum_conf = tmp_path / "yum_spacewalk.conf"
+    monkeypatch.setattr(cln_detect, "RHN_SYSTEMID", str(systemid))
+    monkeypatch.setattr(cln_detect, "SPACEWALK_DNF_CONF", str(dnf_conf))
+    monkeypatch.setattr(cln_detect, "SPACEWALK_YUM_CONF", str(yum_conf))
+    return {"systemid": systemid, "dnf_conf": dnf_conf, "yum_conf": yum_conf}
+
+
+def _touch(path, content=""):
+    path.write_text(content)
+
+
+def test_no_systemid_means_no_cln(clean_paths):
+    # Without /etc/sysconfig/rhn/systemid the system is not registered with CLN.
+    assert cln_detect.is_cln_configured() is False
+
+
+def test_systemid_but_no_plugin_means_no_cln(clean_paths):
+    _touch(clean_paths["systemid"])
+    assert cln_detect.is_cln_configured() is False
+
+
+def test_systemid_and_enabled_dnf_plugin_means_cln(clean_paths):
+    _touch(clean_paths["systemid"])
+    _touch(clean_paths["dnf_conf"], "[main]\nenabled = 1\n")
+    assert cln_detect.is_cln_configured() is True
+
+
+def test_explicit_disabled_dnf_plugin_means_no_cln(clean_paths):
+    _touch(clean_paths["systemid"])
+    _touch(clean_paths["dnf_conf"], "[main]\nenabled = 0\n")
+    assert cln_detect.is_cln_configured() is False
+
+
+def test_explicit_disabled_yum_plugin_means_no_cln(clean_paths):
+    _touch(clean_paths["systemid"])
+    _touch(clean_paths["yum_conf"], "[main]\nenabled=0\n")
+    assert cln_detect.is_cln_configured() is False
+
+
+def test_one_plugin_disabled_one_not_means_no_cln(clean_paths):
+    # If either plugin config disables it, CLN is not usable.
+    _touch(clean_paths["systemid"])
+    _touch(clean_paths["dnf_conf"], "[main]\nenabled = 1\n")
+    _touch(clean_paths["yum_conf"], "[main]\nenabled = 0\n")
+    assert cln_detect.is_cln_configured() is False
+
+
+def test_plugin_conf_without_enabled_key_means_cln(clean_paths):
+    # A plugin config that doesn't mention `enabled` defaults to enabled upstream,
+    # so we must treat it as CLN active.
+    _touch(clean_paths["systemid"])
+    _touch(clean_paths["dnf_conf"], "[main]\ntimeout = 120\n")
+    assert cln_detect.is_cln_configured() is True
+
+
+def test_comments_and_blank_lines_ignored(clean_paths):
+    _touch(clean_paths["systemid"])
+    _touch(
+        clean_paths["dnf_conf"],
+        "# some comment\n\n[main]\n# enabled = 0\nenabled = 1\n",
+    )
+    assert cln_detect.is_cln_configured() is True