Grafana RPM repository metadata fails GPG signature check

[Jason Anderson]

Packagecloud has force-migrated older repositories to use per-project GPG signing keys as of January 7[1]. It is unclear if this is the root cause of the issue, or if it's a coincidence.

Kolla currently imports https://grafanarel.s3.amazonaws.com/RPM-GPG-KEY-grafana as the signing key for the RPM package. This is no longer valid, it seems. The correct stable link is https://packagecloud.io/grafana/stable/gpgkey.

Example output:

INFO:kolla.common.utils.base:Retrieving key from https://grafanarel.s3.amazonaws.com/RPM-GPG-KEY-grafana
INFO:kolla.common.utils.base:https://packagecloud.io/grafana/stable/el/7/x86_64/repodata/repomd.xml: [Errno -1] repomd.xml signature could not be verified for grafana
INFO:kolla.common.utils.base:
INFO:kolla.common.utils.base:Trying other mirror.
INFO:kolla.common.utils.base:
INFO:kolla.common.utils.base:
INFO:kolla.common.utils.base: One of the configured repositories failed (grafana),
INFO:kolla.common.utils.base: and yum doesn't have enough cached data to continue. At this point the only
INFO:kolla.common.utils.base: safe thing yum can do is fail. There are a few ways to work "fix" this:
INFO:kolla.common.utils.base: 1. Contact the upstream for the repository and get them to fix the problem.
INFO:kolla.common.utils.base: 2. Reconfigure the baseurl/etc. for the repository, to point to a working
INFO:kolla.common.utils.base: upstream. This is most often useful if you are using a newer
INFO:kolla.common.utils.base: distribution release than is supported by the repository (and the
INFO:kolla.common.utils.base: packages for the previous distribution release still work).
INFO:kolla.common.utils.base: 3. Run the command with the repository temporarily disabled
INFO:kolla.common.utils.base: yum --disablerepo=grafana ...
INFO:kolla.common.utils.base: 4. Disable the repository permanently, so yum won't use it by default. Yum
INFO:kolla.common.utils.base: will then just ignore the repository until you permanently enable it
INFO:kolla.common.utils.base: again or use --enablerepo for temporary usage:
INFO:kolla.common.utils.base: yum-config-manager --disable grafana
INFO:kolla.common.utils.base: or
INFO:kolla.common.utils.base: subscription-manager repos --disable=grafana
INFO:kolla.common.utils.base: 5. Configure the failing repository to be skipped, if it is unavailable.
INFO:kolla.common.utils.base: Note that yum will try to contact the repo. when it runs most commands,
INFO:kolla.common.utils.base: so will have to try and fail each time (and thus. yum will be be much
INFO:kolla.common.utils.base: slower). If it is a very temporary problem though, this is often a nice
INFO:kolla.common.utils.base: compromise:
INFO:kolla.common.utils.base: yum-config-manager --save --setopt=grafana.skip_if_unavailable=true
INFO:kolla.common.utils.base:failure: repodata/repomd.xml from grafana: [Errno 256] No more mirrors to try.
INFO:kolla.common.utils.base:https://packagecloud.io/grafana/stable/el/7/x86_64/repodata/repomd.xml: [Errno -1] repomd.xml signature could not be verified for grafana
INFO:kolla.common.utils.base:

[1]: https://blog.packagecloud.io/eng/2018/10/17/gpg-key-migration/

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/rocky
Review: https://review.openstack.org/629072

[Florian Faltermeier (florianfa)]

Note:
This site (http://docs.grafana.org/installation/rpm/) mentions to use the following repository:

grafana.repo

[grafana]
name=grafana
baseurl=https://packages.grafana.com/oss/rpm
repo_gpgcheck=1
enabled=1
gpgcheck=1
gpgkey=https://packages.grafana.com/gpg.key
sslverify=1
sslcacert=/etc/pki/tls/certs/ca-bundle.crt

Florian

[Jeffrey Zhang (jeffrey4l)]

Fix for master is pushed at https://review.openstack.org/#/c/629380/

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/629380
Committed: https://git.openstack.org/cgit/openstack/kolla/commit/?id=ae883440255b02478bc3bd5cdcaf23a26869c5f1
Submitter: Zuul
Branch: master

commit ae883440255b02478bc3bd5cdcaf23a26869c5f1
Author: Jeffrey Zhang <email address hidden>
Date: Wed Jan 9 13:04:54 2019 +0800

    Fix grafana repo

    Grafana repository is moved from packagecloud to
    packages.grafana.com[0]. Based on new grafana install guide[1], update
    the grafana.repo

    [0] https://grafana.com/blog/2019/01/05/moving-to-packages.grafana.com/
    [1] http://docs.grafana.org/installation/rpm/#install-via-yum-repository

    Closes-Bug: #1810867
    Change-Id: Ib065fdc561b72fc013b952b3df41ee83b083194e

[OpenStack Infra (hudson-openstack)]

Change abandoned by Jason Anderson (<email address hidden>) on branch: stable/rocky
Review: https://review.openstack.org/629072

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/629445
Committed: https://git.openstack.org/cgit/openstack/kolla/commit/?id=0c5fa8208e21e41dfd4f20189aec5f00033d22d5
Submitter: Zuul
Branch: stable/pike

commit 0c5fa8208e21e41dfd4f20189aec5f00033d22d5
Author: Jeffrey Zhang <email address hidden>
Date: Wed Jan 9 13:04:54 2019 +0800

    Fix grafana repo

    Grafana repository is moved from packagecloud to
    packages.grafana.com[0]. Based on new grafana install guide[1], update
    the grafana.repo

    [0] https://grafana.com/blog/2019/01/05/moving-to-packages.grafana.com/
    [1] http://docs.grafana.org/installation/rpm/#install-via-yum-repository

    Closes-Bug: #1810867
    Change-Id: Ib065fdc561b72fc013b952b3df41ee83b083194e
    (cherry picked from commit ae883440255b02478bc3bd5cdcaf23a26869c5f1)

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/629442
Committed: https://git.openstack.org/cgit/openstack/kolla/commit/?id=d4464fa4d9c7e2ab7826bf7224cd7a15506acaf3
Submitter: Zuul
Branch: stable/queens

commit d4464fa4d9c7e2ab7826bf7224cd7a15506acaf3
Author: Jeffrey Zhang <email address hidden>
Date: Wed Jan 9 13:04:54 2019 +0800

    Fix grafana repo

    Grafana repository is moved from packagecloud to
    packages.grafana.com[0]. Based on new grafana install guide[1], update
    the grafana.repo

    [0] https://grafana.com/blog/2019/01/05/moving-to-packages.grafana.com/
    [1] http://docs.grafana.org/installation/rpm/#install-via-yum-repository

    Closes-Bug: #1810867
    Change-Id: Ib065fdc561b72fc013b952b3df41ee83b083194e
    (cherry picked from commit ae883440255b02478bc3bd5cdcaf23a26869c5f1)

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/629440
Committed: https://git.openstack.org/cgit/openstack/kolla/commit/?id=2b9b7901a2bca5a5b9449f90211542b8c4ad1c51
Submitter: Zuul
Branch: stable/rocky

commit 2b9b7901a2bca5a5b9449f90211542b8c4ad1c51
Author: Jeffrey Zhang <email address hidden>
Date: Wed Jan 9 13:04:54 2019 +0800

    Fix grafana repo

    Grafana repository is moved from packagecloud to
    packages.grafana.com[0]. Based on new grafana install guide[1], update
    the grafana.repo

    [0] https://grafana.com/blog/2019/01/05/moving-to-packages.grafana.com/
    [1] http://docs.grafana.org/installation/rpm/#install-via-yum-repository

    Closes-Bug: #1810867
    Change-Id: Ib065fdc561b72fc013b952b3df41ee83b083194e
    Depends-On: https://review.openstack.org/629560
    (cherry picked from commit ae883440255b02478bc3bd5cdcaf23a26869c5f1)

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/kolla 6.2.0 release.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/kolla 8.0.0.0rc1 release candidate.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/kolla 7.0.2 release.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/kolla 5.0.5 release.