Repository sync or Content import action fails with error "The path <> does not start with any of the allowed import paths" in disconnected Red Hat Satellite 6.10 and later

Solution Verified - Updated 13 Jun 2024

Environment

Red Hat Satellite 6.10 and later

Issue

After upgrading the disconnected Satellite server to Red Hat Satellite 6.10, the repository sync tasks are always failing with the following error.
```
 The path '/path/to/content' does not start with any of the allowed import paths (Katello::Errors::Pulp3Error)
```
A similar problem has been observed with content-import tasks as well.

Resolution

The correct method to set a custom import path for a Satellite is to use the installer option --foreman-proxy-content-pulpcore-additional-import-paths followed by the path where the content will be import
1. Create a custom location or edit one that exists where the repository content has been stored after extracting the Content ISOs or copying the exported content from the connected satellite.
  
  NOTE: Do not use symlinks in the path. The allowed path MUST BE a real path on the filesystem.
2. Once the custom directory has been created, use the following command to set this custom location on the Satellite: (Using /var/www/html/pub/sat-import/ as an example )
```
 # satellite-installer --foreman-proxy-content-pulpcore-additional-import-paths /var/www/html/pub/sat-import/
```
3. Verify the updated list of allowed import paths which is declared by the ALLOWED_IMPORT_PATHS parameter in /etc/pulp/settings.py
```
 # cat /etc/pulp/settings.py | grep ALLOWED_IMPORT_PATHS
 ALLOWED_IMPORT_PATHS = ["/var/lib/pulp/sync_imports", "/var/lib/pulp/imports", "/var/www/html/pub/sat-import/"]
```
4. Attempt to re-import the data or re-synchronize the repositories and observe their progress.

In case of any further concerns or assistance required, please reach out to This content is not included.Red Hat Technical Support.

For more KB articles/solutions related to Red Hat Satellite 6.x Repository Issues, please refer to the Red Hat Satellite Consolidated Troubleshooting Article for Red Hat Satellite 6.x Repository Issues.

Root Cause

For a Disconnected Satellite 6.10 and later, if the locally stored repository content is in a location that is not part of the ALLOWED_IMPORT_PATHS settings of pulp, The sync or import attempt of the content from that path will be rejected by pulp and raise the error.

Diagnostic Steps

The following errors were observed in the /var/log/foreman/production.log file of Red Hat Satellite server.

   2021-11-29T12:39:27 [I|bac|7020a242] Task {label: Actions::Katello::Repository::Sync, id: 2354e371-900c-490c-bf3b-6edaec69df8e, execution_plan_id: 1bb2a6f2-b67b-4516-9b11-dc01192675c1} state changed: planning 
2021-11-29T12:39:27 [E|bac|7020a242] The path '/path/to/content/My_Org/Library/content/dist/rhel/server/7/7Server/x86_64/highavailability/os' does not start with any of the allowed import paths (Katello::Errors::Pulp3Error)
7020a242 | /opt/theforeman/tfm/root/usr/share/gems/gems/katello-4.1.1.39/app/services/katello/pulp3/repository.rb:110:in `rescue in reformat_api_exception'
7020a242 | /opt/theforeman/tfm/root/usr/share/gems/gems/katello-4.1.1.39/app/services/katello/pulp3/repository.rb:105:in `reformat_api_exception'
7020a242 | /opt/theforeman/tfm/root/usr/share/gems/gems/katello-4.1.1.39/app/services/katello/pulp3/repository.rb:78:in `create_remote'
7020a242 | /opt/theforeman/tfm/root/usr/share/gems/gems/katello-4.1.1.39/app/services/katello/pulp3/repository.rb:124:in `update_remote'
7020a242 | /opt/theforeman/tfm/root/usr/share/gems/gems/katello-4.1.1.39/app/lib/actions/pulp3/repository/refresh_remote.rb:12:in `invoke_external_task'
..
2021-11-29T12:39:27 [E|bac|7020a242] The path '/path/to/content/My_Org/Library/content/dist/rhel/server/7/7Server/x86_64/os' does not start with any of the allowed import paths (Katello::Errors::Pulp3Error)
7020a242 | /opt/theforeman/tfm/root/usr/share/gems/gems/katello-4.1.1.39/app/services/katello/pulp3/repository.rb:110:in `rescue in reformat_api_exception'
7020a242 | /opt/theforeman/tfm/root/usr/share/gems/gems/katello-4.1.1.39/app/services/katello/pulp3/repository.rb:105:in `reformat_api_exception'
7020a242 | /opt/theforeman/tfm/root/usr/share/gems/gems/katello-4.1.1.39/app/services/katello/pulp3/repository.rb:78:in `create_remote'
7020a242 | /opt/theforeman/tfm/root/usr/share/gems/gems/katello-4.1.1.39/app/services/katello/pulp3/repository.rb:124:in `update_remote'
7020a242 | /opt/theforeman/tfm/root/usr/share/gems/gems/katello-4.1.1.39/app/lib/actions/pulp3/repository/refresh_remote.rb:12:in `invoke_external_task'

As per the configuration of pulp, only /var/lib/pulp/sync_imports and /var/lib/pulp/imports locations are allowed to import\sync content from by default.
```
# cat /etc/pulp/settings.py | grep ALLOWED_IMPORT_PATHS
ALLOWED_IMPORT_PATHS = ["/var/lib/pulp/sync_imports", "/var/lib/pulp/imports"]
```

SBR

SysMgmt

Product(s)

Red Hat Satellite

Components

pulp

Category

Troubleshoot

Tags

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.