Network rules to use mock on RHEL8

[Emmanuel Seyman]

Hello, all.

Wanting to promote RPM packages, I'm trying to use mock on an RHEL8 VM
that does not have unrestricted access to the internet. This fails
miserably, as you would expect it to.

I've already established that I need access to:
* registry.access.redhat.com on port 443
* cdn.redhat.com on port 443

Is there anything else I need to ask? Opening ports on internal VMs is a
lengthy process and I would really appreciate any help here.

Regards,
Emmanuel

[Miroslav Suchý]

Dne 03. 12. 23 v 20:46 Emmanuel Seyman napsal(a):
> Hello, all.
>
> Wanting to promote RPM packages, I'm trying to use mock on an RHEL8 VM
> that does not have unrestricted access to the internet. This fails
> miserably, as you would expect it to.
>
> I've already established that I need access to:
> registry.access.redhat.com on port 443
> cdn.redhat.com on port 443
>
> Is there anything else I need to ask? Opening ports on internal VMs is a
> lengthy process and I would really appreciate any help here.

It depends what you want to build. You have to check configs you want to use. E.g. Building Fedoras may requires access 
to registry.fedoraproject.org

https://github.com/rpm-software-management/mock/blob/main/mock-core-configs/...

If you want to build in rhel chroots you may need to add hostnames from this KB:
   https://access.redhat.com/solutions/65300

If you are building on top of Alma you may want to add

https://github.com/rpm-software-management/mock/blob/main/mock-core-configs/...

https://github.com/rpm-software-management/mock/blob/main/mock-core-configs/... or 
rather use specific mirror.

And similarly for EPEL

https://github.com/rpm-software-management/mock/blob/main/mock-core-configs/...

Beside that, that should be all.

Miroslav Suchy, RHCA
Red Hat, Manager, Packit and CPT, #brno, #fedora-buildsys

[Stephen Smoogen]

On Sun, 3 Dec 2023 at 14:46, Emmanuel Seyman  wrote:
> Hello, all.
>
> Wanting to promote RPM packages, I'm trying to use mock on an RHEL8 VM
> that does not have unrestricted access to the internet. This fails
> miserably, as you would expect it to.
>
> I've already established that I need access to:
> registry.access.redhat.com on port 443
> cdn.redhat.com on port 443
>
> Is there anything else I need to ask? Opening ports on internal VMs is a
> lengthy process and I would really appreciate any help here.
>
> Regards,
> Emmanuel

Depending on the network rules and other resources, it may be easier to do
the following:

1. Make changes or additional specific template changes to use specific
servers which will limit failover (aka dl.fedoraproject.org for epel and
fedora packages)
2. Mirror the distro and other resources you need inside of the network.
(optional)