New Satellite certificate activation fails with "You do not have enough unused virtualization_host/virtualization_host_platform entitlements"

Environment

• Red Hat Satellite 5.4 and later
• New subscriptions activated in account (based on new entitlements)

Issue

• New Satellite certificate activation fails with "You do not have enough unused virtualization_host/virtualization_host_platform entitlements"

    # rhn-satellite-activate --rhn-cert=/tmp/new.cert
    RHN_PARENT: satellite.rhn.redhat.com
    Error: You do not have enough unused virtualization_host entitlements in the base org. You will need at least 25 free entitlements, based on your current consumption. Please un-entitle the remaining systems for the activation to proceed.
  

• Satellite activation produces errors for renewal certificates when suborganizations contain allocated virtualization_host entitlements that do not match or exceed amount in certificate

Resolution

1). Try to remove Virtualization Host entitlements from Xen/KVM hosts one by one and follow below command to convert to flex entitlements:

    # cd /etc/sysconfig/rhn/satellite-upgrade/scripts/ 
    # ./entitlement-check.py

Or

Follow steps in "Convert a virtual guest from using a regular entitlement to using a virtual entitlement".

2). If some systems are not listed on above page or not converted then need to check what RHEL release they are on. (Flex entitlement can be consumed by RHEL 5.4 and RHEL 4.8 onwards only)

If systems are not updated then update at least yum* rhn* packages on system and run "rhn-profile-sync" and follow step 1 to convert systems to Flex.

3). If there are still systems consuming virtualization_host entitlement, run the following perl api script to unallocate sub-organization system entitlements for virtualization_host:

#!/usr/bin/perl -w 

use strict;
use Frontier::Client;

my $HOST = '';
my $USER = '';
my $PASS = '';

my $client = new Frontier::Client(url => "http://$HOST/rpc/api");
my $session = $client->call('auth.login', $USER, $PASS);
my $systems = $client->call('system.listSystems',$session);

for (@{$systems}) {
  my $status = $client->call('system.getEntitlements',$session,$_->{id});
  if( grep(/virtualization_host/, @$status)) {
     my $status = $client->call('system.removeEntitlements',
                                 $session, $_->{id}, ['virtualization_host']);
     print "Removing virt from $_->{id}\n";
  }
}

• The USER and PASSWORD will need to be changed for each organization that contains virtualization_host entitlements
• The HOST should be the fully qualified domain name of the satellite

4). Once all hosts have their Virtualization_host entitlement removed then activate the new Satellite certificate.

Root Cause

• With the new virtualization entitlement model, new subscriptions do not provide  Virtualization / Virtualization Platform entitlements but rather provide Flex guest entitlements which are reflected in the new Satellite certificate. For more details see Overview - How to migrate client systems to the new RHEL 6 Flex Entitlement Model. As of the spacewalk-java 121 rpm version. The Virtualization tab will be available for all Virtualized hosts with the need for a virtualzation_host entitlement.

• Satellelite activation will fail when system entitlements allocated amount exceed the amount on the renewal certificate, see This content is not included.Satellite returns activation error: "You do not have enough entitlements in the base org."

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.