CLOS-4056: clarify CLN detection — package channel vs registration

The first commit on this branch named the helper is_cln_configured()
and the actor comments said things like 'CLN is not configured here'.
That conflated two separate concerns and was misleading: CLN registration
is still in use on no-auth (SWNG) systems for licensing and inventory —
what the no-auth migration changes is only the package channel (the
spacewalk DNF plugin no longer delivers packages from a CLN channel).

Rename:

  is_cln_configured()  ->  is_cln_package_channel_active()

so the function name reflects what the actors actually need to gate on,
and rewrite its docstring + module header to spell out the package-channel
vs registration distinction.

Update each of the five actor comments accordingly. The detection logic
itself is unchanged — registration state plus a non-disabled spacewalk
plugin remains the right heuristic for 'CLN is delivering packages'.
Tests updated to match the new name and to phrase scenarios in terms of
the channel rather than 'CLN configured'.

Author: prilr

repos/system_upgrade/cloudlinux/actors/checkrhnversionoverride/actor.py

@@ -4,7 +4,7 @@
 from leapp.reporting import Report
 from leapp.tags import ChecksPhaseTag, IPUWorkflowTag
 from leapp.libraries.common.cllaunch import run_on_cloudlinux
-from leapp.libraries.common.cln_detect import is_cln_configured
+from leapp.libraries.common.cln_detect import is_cln_package_channel_active
 
 
 class CheckRhnVersionOverride(Actor):
@@ -19,8 +19,12 @@ class CheckRhnVersionOverride(Actor):
 
     @run_on_cloudlinux
     def process(self):
-        if not is_cln_configured():
-            # CLOS-4056: no-auth systems have no CLN config to inspect.
+        if not is_cln_package_channel_active():
+            # CLOS-4056: versionOverride only matters when CLN is delivering
+            # packages — the upgrade rewrites it to drive channel selection.
+            # On no-auth (SWNG) systems the package channel is cl-channel,
+            # not CLN, so there is nothing to inspect or warn about even if
+            # /etc/sysconfig/rhn/up2date is still present from registration.
             return
 
         up2date_config = '/etc/sysconfig/rhn/up2date'

repos/system_upgrade/cloudlinux/actors/pinclnmirror/actor.py

@@ -4,7 +4,7 @@
 from leapp.actors import Actor
 from leapp.libraries.stdlib import api
 from leapp.libraries.common.cllaunch import run_on_cloudlinux
-from leapp.libraries.common.cln_detect import is_cln_configured
+from leapp.libraries.common.cln_detect import is_cln_package_channel_active
 from leapp.libraries.common.cln_switch import get_target_userspace_path
 from leapp.tags import DownloadPhaseTag, IPUWorkflowTag
 from leapp.libraries.common.config.version import get_target_major_version
@@ -26,10 +26,13 @@ class PinClnMirror(Actor):
     @run_on_cloudlinux
     def process(self):
         """Pin CLN mirror"""
-        if not is_cln_configured():
-            # CLOS-4056: no-auth systems don't use CLN mirrors; skip cleanly.
+        if not is_cln_package_channel_active():
+            # CLOS-4056: pinning the CLN mirror is only meaningful when CLN
+            # is delivering packages. On no-auth (SWNG) systems packages come
+            # from cl-channel via mirrorlist, so there is nothing to pin —
+            # registration may still be in place but is irrelevant here.
             api.current_logger().info(
-                "CLN is not configured on this system; skipping mirror pinning"
+                "CLN is not the active package channel; skipping mirror pinning"
             )
             return
 

repos/system_upgrade/cloudlinux/actors/resetrhnversionoverride/actor.py

@@ -2,7 +2,7 @@
 from leapp.libraries.stdlib import api
 from leapp.tags import FinalizationPhaseTag, IPUWorkflowTag
 from leapp.libraries.common.cllaunch import run_on_cloudlinux
-from leapp.libraries.common.cln_detect import is_cln_configured
+from leapp.libraries.common.cln_detect import is_cln_package_channel_active
 
 
 class ResetRhnVersionOverride(Actor):
@@ -17,8 +17,11 @@ class ResetRhnVersionOverride(Actor):
 
     @run_on_cloudlinux
     def process(self):
-        if not is_cln_configured():
-            # CLOS-4056: no-auth systems have no CLN config to reset.
+        if not is_cln_package_channel_active():
+            # CLOS-4056: versionOverride is only set/used by the CLN package
+            # channel flow. If the system isn't on CLN for packages, leave
+            # /etc/sysconfig/rhn/up2date alone — registration metadata there
+            # is not ours to touch.
             return
 
         up2date_config = '/etc/sysconfig/rhn/up2date'

repos/system_upgrade/cloudlinux/actors/switchclnchannel/actor.py

@@ -3,7 +3,7 @@
 from leapp.tags import FirstBootPhaseTag, IPUWorkflowTag
 from leapp.libraries.stdlib import CalledProcessError
 from leapp.libraries.common.cllaunch import run_on_cloudlinux
-from leapp.libraries.common.cln_detect import is_cln_configured
+from leapp.libraries.common.cln_detect import is_cln_package_channel_active
 from leapp.libraries.common.cln_switch import cln_switch
 from leapp import reporting
 from leapp.reporting import Report
@@ -23,22 +23,24 @@ class SwitchClnChannel(Actor):
 
     @run_on_cloudlinux
     def process(self):
-        if not is_cln_configured():
-            # CLOS-4056: No-auth (SWNG) systems have no CLN plumbing. Skipping
-            # the channel switch here is correct — the system receives CL9
-            # packages via cl-channel / cloudlinux9-baseos instead.
+        if not is_cln_package_channel_active():
+            # CLOS-4056: CLN is no longer the package channel here (no-auth /
+            # SWNG mode). Skipping the channel switch is correct — packages
+            # come from cl-channel / cloudlinux9-baseos instead. The system
+            # may still be CLN-registered for licensing; that is a separate
+            # concern this actor does not need to manage.
             api.current_logger().info(
-                "CLN is not configured on this system; skipping channel switch"
+                "CLN is not the active package channel; skipping channel switch"
             )
             return
 
         try:
             cln_switch(target=int(get_target_major_version()))
         except CalledProcessError as e:
-            # CLOS-4056: Do not inhibit. CLN may be partially configured (legacy
-            # registration files present but no working registration) on systems
-            # transitioning to the no-auth scheme, and a failed channel switch
-            # there is expected — the no-auth repos still serve CL9 packages.
+            # CLOS-4056: Do not inhibit. Even on systems that ARE using CLN
+            # as the package channel, a transient CLN-server reachability
+            # problem at FirstBoot (DNS/network not up yet) shouldn't block
+            # the upgrade — the no-auth fallback repos still serve packages.
             reporting.create_report(
                 [
                     reporting.Title(

repos/system_upgrade/cloudlinux/actors/unpinclnmirror/actor.py

@@ -2,7 +2,7 @@
 
 from leapp.actors import Actor
 from leapp.libraries.common.cllaunch import run_on_cloudlinux
-from leapp.libraries.common.cln_detect import is_cln_configured
+from leapp.libraries.common.cln_detect import is_cln_package_channel_active
 from leapp.libraries.common.cln_switch import get_target_userspace_path
 from leapp.tags import FirstBootPhaseTag, IPUWorkflowTag
 
@@ -20,8 +20,10 @@ class UnpinClnMirror(Actor):
 
     @run_on_cloudlinux
     def process(self):
-        if not is_cln_configured():
-            # CLOS-4056: pinclnmirror was skipped on no-auth systems, nothing to unpin.
+        if not is_cln_package_channel_active():
+            # CLOS-4056: pinclnmirror skipped its work for the same reason
+            # (CLN is not the package channel here), so there is nothing
+            # for us to unpin.
             return
 
         target_userspace = get_target_userspace_path()

repos/system_upgrade/cloudlinux/libraries/cln_detect.py

@@ -1,18 +1,27 @@
-"""Detection helpers for CLN (CloudLinux Network / Spacewalk) state.
+"""Detection helpers for the CloudLinux Network (CLN) package channel.
 
-A system is considered to have CLN *configured* when it has registration
-state plus the spacewalk DNF/YUM plugin installed and not explicitly
-disabled. Systems that have been migrated to the no-auth (SWNG mirrorlist)
-scheme have either:
+CLN has historically combined two concerns:
 
-  - no `/etc/sysconfig/rhn/systemid` (never registered or deregistered),
-  - no spacewalk plugin installed (rhn-client-tools >= 3.0.1 removes it), or
-  - the plugin's `enabled = 0` in its config.
+  1. **Registration / identity** — the system is registered with the CLN
+     server (`/etc/sysconfig/rhn/systemid`, JWT token), used for licensing
+     and inventory regardless of how packages are delivered.
 
-CLOS-4056: several CloudLinux-specific actors were written when CLN was the
-only scheme and assume it is always active. They need to gate their
-behavior on `is_cln_configured()` so systems on the no-auth scheme pass
-through without bogus inhibitors or crashes.
+  2. **Package delivery** — the system pulls CloudLinux packages through
+     the spacewalk DNF/YUM plugin against the CLN-side channel
+     (`cloudlinux-x86_64-server-N`).
+
+The no-auth (SWNG) transition decouples these. New CL8 and CL9 systems
+keep CLN **registration** but no longer use CLN as the **package
+channel** — packages come from the SWNG mirrorlist via
+`/etc/yum.repos.d/cl.repo` (`cl-channel`) instead. `rhn-client-tools
+>= 3.0.1` disables the spacewalk plugin to enforce this.
+
+The CLN-touching actors in this repo only care about the second concern:
+they exist to make the CLN package channel work during ELevate. On
+systems where the channel has been switched off they should stand down
+even though registration may still be present and valid.
+
+CLOS-4056: gate those actors on `is_cln_package_channel_active()`.
 """
 
 import os
@@ -38,16 +47,27 @@ def _plugin_explicitly_disabled(conf_path):
     return False
 
 
-def is_cln_configured():
-    """Return True if CLN plumbing is present and not disabled on this system."""
+def is_cln_package_channel_active():
+    """Return True when CLN is the active package channel for this system.
+
+    A True result means the spacewalk DNF/YUM plugin is installed, not
+    explicitly disabled, and the system has CLN registration state for
+    the plugin to authenticate with. A False result means the system is
+    either deregistered or has been moved to the no-auth (SWNG) scheme,
+    so CLN-targeting actions (channel switch, mirror pinning, version
+    overrides) are not meaningful and should be skipped.
+
+    This is a deliberately heuristic check — it asks "is CLN going to
+    serve packages here", not "is the system registered with CLN" (the
+    two were the same thing pre-no-auth and have since diverged).
+    """
     if not os.path.exists(RHN_SYSTEMID):
         return False
 
     configs = [p for p in (SPACEWALK_DNF_CONF, SPACEWALK_YUM_CONF) if os.path.exists(p)]
     if not configs:
         return False
 
-    # If any plugin config explicitly disables the plugin, treat as no-auth.
     for conf in configs:
         if _plugin_explicitly_disabled(conf):
             return False

repos/system_upgrade/cloudlinux/libraries/tests/test_cln_detect.py

@@ -21,48 +21,49 @@ def _touch(path, content=""):
     path.write_text(content)
 
 
-def test_no_systemid_means_no_cln(clean_paths):
-    # Without /etc/sysconfig/rhn/systemid the system is not registered with CLN.
-    assert cln_detect.is_cln_configured() is False
+def test_no_systemid_means_channel_inactive(clean_paths):
+    # Without registration the spacewalk plugin can't authenticate, so even
+    # if the plugin is installed it is not the active package channel.
+    assert cln_detect.is_cln_package_channel_active() is False
 
 
-def test_systemid_but_no_plugin_means_no_cln(clean_paths):
+def test_systemid_but_no_plugin_means_channel_inactive(clean_paths):
     _touch(clean_paths["systemid"])
-    assert cln_detect.is_cln_configured() is False
+    assert cln_detect.is_cln_package_channel_active() is False
 
 
-def test_systemid_and_enabled_dnf_plugin_means_cln(clean_paths):
+def test_systemid_and_enabled_dnf_plugin_means_channel_active(clean_paths):
     _touch(clean_paths["systemid"])
     _touch(clean_paths["dnf_conf"], "[main]\nenabled = 1\n")
-    assert cln_detect.is_cln_configured() is True
+    assert cln_detect.is_cln_package_channel_active() is True
 
 
-def test_explicit_disabled_dnf_plugin_means_no_cln(clean_paths):
+def test_explicit_disabled_dnf_plugin_means_channel_inactive(clean_paths):
     _touch(clean_paths["systemid"])
     _touch(clean_paths["dnf_conf"], "[main]\nenabled = 0\n")
-    assert cln_detect.is_cln_configured() is False
+    assert cln_detect.is_cln_package_channel_active() is False
 
 
-def test_explicit_disabled_yum_plugin_means_no_cln(clean_paths):
+def test_explicit_disabled_yum_plugin_means_channel_inactive(clean_paths):
     _touch(clean_paths["systemid"])
     _touch(clean_paths["yum_conf"], "[main]\nenabled=0\n")
-    assert cln_detect.is_cln_configured() is False
+    assert cln_detect.is_cln_package_channel_active() is False
 
 
-def test_one_plugin_disabled_one_not_means_no_cln(clean_paths):
-    # If either plugin config disables it, CLN is not usable.
+def test_one_plugin_disabled_one_not_means_channel_inactive(clean_paths):
+    # If either plugin config disables the plugin, treat the channel as off.
     _touch(clean_paths["systemid"])
     _touch(clean_paths["dnf_conf"], "[main]\nenabled = 1\n")
     _touch(clean_paths["yum_conf"], "[main]\nenabled = 0\n")
-    assert cln_detect.is_cln_configured() is False
+    assert cln_detect.is_cln_package_channel_active() is False
 
 
-def test_plugin_conf_without_enabled_key_means_cln(clean_paths):
-    # A plugin config that doesn't mention `enabled` defaults to enabled upstream,
-    # so we must treat it as CLN active.
+def test_plugin_conf_without_enabled_key_means_channel_active(clean_paths):
+    # A plugin config that does not mention `enabled` defaults to enabled
+    # upstream, so we must treat the channel as active.
     _touch(clean_paths["systemid"])
     _touch(clean_paths["dnf_conf"], "[main]\ntimeout = 120\n")
-    assert cln_detect.is_cln_configured() is True
+    assert cln_detect.is_cln_package_channel_active() is True
 
 
 def test_comments_and_blank_lines_ignored(clean_paths):
@@ -71,4 +72,4 @@ def test_comments_and_blank_lines_ignored(clean_paths):
         clean_paths["dnf_conf"],
         "# some comment\n\n[main]\n# enabled = 0\nenabled = 1\n",
     )
-    assert cln_detect.is_cln_configured() is True
+    assert cln_detect.is_cln_package_channel_active() is True