version 27.3: on unattached machines update_status_timer incorrectly pings contracts.canonical.com/v1/resources

[Chad Smith]

Version 27.3 introduced a new systemd timer which runs a job named update_status_timer every 12 hours to update the status of supported UA services on machines which are attached to an Ubuntu Advantage licese.

This job should not be run on machines without an active Ubuntu Advantage license attached because
"unattached" Ubuntu machines no need to request available or applicable UA resources for the machine.

In order to update_status information of UA services, this call results in GET against contracts.canonical.com/v1/resources providing the following data as querystring parameters:
 - kernel
 - ubuntu release name
 - architecture

This ephemeral data is only used by the contract service to properly report what services are available or applicable to that running kernel, Ubuntu release and CPU architecture and is not logged or persisted.

This bug is currently fixed and committed upstream to avoid calling this endpoint on unattached Ubuntu machines and queued for release to Xenial, Bionic, Focal, Hirsute and Jammy as version 27.4.1. Expected published fix within a week.

[Chad Smith (chad.smith)]

Upstream commit landed to avoid this network egress on unattached machines. https://github.com/canonical/ubuntu-advantage-client/commit/ab01ce2f68b32fd2702f947a408c58d2435f1c47

Already undergoing SRU release verification and queued as version 27.4.1. The fixed version is currently in xenial-proposed, bionic-proposed, focal-proposed, hirsute-proposed and impish-proposed pockets. Expected release next week once verification completes.

[Renan Rodrigo (renanrodrigo)]

Those are steps to assure that the status job does not call the contracts
server on an unattached machine

1. Launch a lxd instance of (xenial|bionic|focal)
2. Install a version of ubuntu-advantage-tools containing the change (> 27.4.1).
3. Disable all jobs but the status job:
`sudo ua config set metering_timer=0`
`sudo ua config set update_messaging_timer=0`
4. Start Wireshark on a separate terminal, looking for calls to the Contracts Server
`sudo tcpdump -i eth0 -A | grep contracts`
5. Run `sudo ua status`
6. Verify:
    a. The status output shows the machine as unnatached
    b. Wireshark captured the call to the contracts server
7. Remove jobs-status.json
`sudo rm -f /var/lib/ubuntu-advantage/jobs-status.json`
6. Run the timer script
`sudo python3 /usr/lib/ubuntu-advantage/timer.py`
7. Verify that no call to contracts.canonical.com is shown in the terminal with
Wireshark (after the previous one)
8. Verify that the job was actually processed by the timer
`sudo cat /var/lib/ubuntu-advantage/jobs-status.json`
"update_status" should be the only job there.

[Grant Orndorff (orndorffgrant)]

I've verified that this bug is fixed in all releases by version 27.4.1 currently in -proposed.

I'm attaching the script I used (based on Renan's comment above) and the output for each release.

[Chad Smith (chad.smith)]

Marking this bug as closed as the fix has now published in version 27.4.1 to Xenial, Bionic, Focal, Hirsute and Impish -updates pockets on Nov 17th.