From be4f177018d13818ff0630825d38dbc909bb30e4 Mon Sep 17 00:00:00 2001 From: Arvind Jangir Date: Fri, 10 Jul 2026 16:03:37 +0530 Subject: [PATCH 1/2] prepare proxy before deployment --- .github/workflows/test.yml | 4 +- docs/developer/deployment.md | 19 ++++-- .../deploy-proxy/metadata.obsah.yaml | 6 -- .../prepare-proxy/metadata.obsah.yaml | 8 +++ .../prepare-proxy/prepare-proxy.yaml | 67 +++++++++++++++++++ .../tasks/foreman-proxy-content.yaml | 19 ++++++ src/roles/pre_install/tasks/katello.yaml | 0 src/roles/pre_install/tasks/main.yaml | 3 + 8 files changed, 112 insertions(+), 14 deletions(-) create mode 100644 src/playbooks/prepare-proxy/metadata.obsah.yaml create mode 100644 src/playbooks/prepare-proxy/prepare-proxy.yaml create mode 100644 src/roles/pre_install/tasks/foreman-proxy-content.yaml create mode 100644 src/roles/pre_install/tasks/katello.yaml diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 0918f4ca8..2ca7828f5 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -449,9 +449,9 @@ jobs: ./foremanctl certificate-bundle proxy.example.com \ --certificate-source=${{ matrix.certificate_source }} \ ${{ matrix.certificate_source == 'custom_server' && '--certificate-server-certificate /root/custom-certificates/certs/proxy.example.com.crt --certificate-server-key /root/custom-certificates/private/proxy.example.com.key' || '' }} - - name: Fetch certificates bundle from quadlet + - name: Prepare proxy host run: | - ./forge fetch-bundle proxy.example.com + ./foremanctl prepare-proxy proxy.example.com - name: Deploy content proxy run: | ./foremanctl deploy-proxy \ diff --git a/docs/developer/deployment.md b/docs/developer/deployment.md index cc8f67bc2..636c2f62c 100644 --- a/docs/developer/deployment.md +++ b/docs/developer/deployment.md @@ -15,9 +15,9 @@ Deploys a Foreman server. This is the primary deployment type and the default en ### Proxy -Deploys a Foreman Proxy node that connects to a Foreman server. +Deploys a Foreman Proxy server that connects to a Foreman server. -Before running the proxy deployment, a certificate bundle must be generated on the Foreman server and copied to the proxy VM: +Before running the proxy deployment, a certificate bundle must be generated on the Foreman server: 1. On the **Foreman server**, generate a certificate bundle for the proxy hostname: @@ -27,18 +27,25 @@ Before running the proxy deployment, a certificate bundle must be generated on t This produces a tar archive at a path like `/var/lib/foremanctl/certs/bundles/.tar.gz`. -2. Copy the bundle to the **proxy VM**: - ```bash - scp /var/lib/foremanctl/certs/bundles/proxy.example.com.tar.gz root@proxy.example.com:/root/proxy.example.com.tar.gz +2. On the **Foreman server**, run following command to prepare proxy server for deployment. + + ```bash + ./foremanctl prepare-proxy proxy.example.com ``` + This transfers generated certificate bundle and oauth credentials on proxy server. + +> [!NOTE] +> `prepare-proxy` connects to the proxy server over SSH. Ensure key-based SSH access from the Foreman server to the proxy server is working before proceeding (e.g. `ssh root@proxy.example.com) + + 3. On the **proxy VM**, run the deployment: ```bash ./foremanctl deploy-proxy \ --flavor foreman-proxy-content \ - --certificate-bundle /root/proxy.example.com.tar.gz \ + --certificate-bundle /var/lib/foremanctl/proxy.example.com.tar.gz \ --foreman-fqdn quadlet.example.com ``` diff --git a/src/playbooks/deploy-proxy/metadata.obsah.yaml b/src/playbooks/deploy-proxy/metadata.obsah.yaml index c2772050b..836a2f5f9 100644 --- a/src/playbooks/deploy-proxy/metadata.obsah.yaml +++ b/src/playbooks/deploy-proxy/metadata.obsah.yaml @@ -15,12 +15,6 @@ variables: foreman_name: parameter: --foreman-fqdn help: FQDN of the Foreman server this proxy connects to. - foreman_proxy_oauth_consumer_key: - parameter: --oauth-consumer-key - help: OAuth key to be used for communication with Foreman. - foreman_proxy_oauth_consumer_secret: - parameter: --oauth-consumer-secret - help: OAuth secret to be used for communication with Foreman. include: - _flavor_features diff --git a/src/playbooks/prepare-proxy/metadata.obsah.yaml b/src/playbooks/prepare-proxy/metadata.obsah.yaml new file mode 100644 index 000000000..60801774c --- /dev/null +++ b/src/playbooks/prepare-proxy/metadata.obsah.yaml @@ -0,0 +1,8 @@ +--- +help: | + Prepare a proxy host for deployment. + +variables: + hostname: + parameter: hostname + help: FQDN of the proxy host to prepare. diff --git a/src/playbooks/prepare-proxy/prepare-proxy.yaml b/src/playbooks/prepare-proxy/prepare-proxy.yaml new file mode 100644 index 000000000..e04858780 --- /dev/null +++ b/src/playbooks/prepare-proxy/prepare-proxy.yaml @@ -0,0 +1,67 @@ +--- +- name: Validate and fetch proxy prerequisites + hosts: quadlet + become: true + vars_files: + - "../../vars/certificates.yml" + - "../../vars/foreman.yml" + tasks: + - name: Check certificate bundle exists + ansible.builtin.stat: + path: "{{ certificates_ca_directory }}/bundles/{{ hostname }}.tar.gz" + register: _bundle_stat + + - name: Fail if certificate bundle does not exist + ansible.builtin.fail: + msg: >- + Certificate bundle for {{ hostname }} not found at + {{ certificates_ca_directory }}/bundles/{{ hostname }}.tar.gz. + Run 'foremanctl certificate-bundle --hostname {{ hostname }}' first. + when: not _bundle_stat.stat.exists + + - name: Fetch certificate bundle to controller + ansible.builtin.fetch: + src: "{{ certificates_ca_directory }}/bundles/{{ hostname }}.tar.gz" + dest: "{{ obsah_state_path }}/{{ hostname }}.tar.gz" + flat: true + + - name: Add proxy host to inventory + ansible.builtin.add_host: + name: "{{ hostname }}" + groups: proxy + ansible_connection: ssh + ansible_host: "{{ hostname }}" + inventory_dir: "{{ inventory_dir }}" + +- name: Transfer proxy certificate bundle and oauth credentials to proxy host + hosts: proxy + become: true + vars_files: + - "../../vars/foreman.yml" + tasks: + - name: Check SSH connectivity and authentication to proxy + ansible.builtin.ping: + + - name: Copy certificate bundle to proxy + ansible.builtin.copy: + src: "{{ obsah_state_path }}/{{ hostname }}.tar.gz" + dest: "{{ obsah_state_path }}/{{ hostname }}.tar.gz" + mode: "0600" + owner: root + group: root + + - name: Copy OAuth consumer key to proxy + ansible.builtin.copy: + src: "{{ foreman_oauth_consumer_key_file }}" + dest: "{{ obsah_state_path }}/foreman-oauth-consumer-key" + mode: "0600" + owner: root + group: root + + - name: Copy OAuth consumer secret to proxy + ansible.builtin.copy: + src: "{{ foreman_oauth_consumer_secret_file }}" + dest: "{{ obsah_state_path }}/foreman-oauth-consumer-secret" + mode: "0600" + owner: root + group: root diff --git a/src/roles/pre_install/tasks/foreman-proxy-content.yaml b/src/roles/pre_install/tasks/foreman-proxy-content.yaml new file mode 100644 index 000000000..08a18236c --- /dev/null +++ b/src/roles/pre_install/tasks/foreman-proxy-content.yaml @@ -0,0 +1,19 @@ +--- +- name: Read OAuth consumer key from file + ansible.builtin.slurp: + src: "{{ obsah_state_path }}/foreman-oauth-consumer-key" + register: _oauth_key_file + +- name: Set OAuth consumer key + ansible.builtin.set_fact: + foreman_proxy_oauth_consumer_key: "{{ _oauth_key_file.content | b64decode | trim }}" + +- name: Read OAuth consumer secret from file + ansible.builtin.slurp: + src: "{{ obsah_state_path }}/foreman-oauth-consumer-secret" + register: _oauth_secret_file + +- name: Set OAuth consumer secret + ansible.builtin.set_fact: + foreman_proxy_oauth_consumer_secret: "{{ _oauth_secret_file.content | b64decode | trim }}" + diff --git a/src/roles/pre_install/tasks/katello.yaml b/src/roles/pre_install/tasks/katello.yaml new file mode 100644 index 000000000..e69de29bb diff --git a/src/roles/pre_install/tasks/main.yaml b/src/roles/pre_install/tasks/main.yaml index 2a241a8b1..bc43bb87c 100644 --- a/src/roles/pre_install/tasks/main.yaml +++ b/src/roles/pre_install/tasks/main.yaml @@ -1,4 +1,7 @@ --- +- name: Include flavor tasks + ansible.builtin.include_tasks: "{{ flavor }}.yaml" + - name: Deploy debug_tools ansible.builtin.include_role: name: debug_tools From b18713711e22f44a6f90bf24e31a1d94ee6bd53d Mon Sep 17 00:00:00 2001 From: Arvind Jangir Date: Mon, 20 Jul 2026 12:31:08 +0530 Subject: [PATCH 2/2] don't run prepare-proxy in CI --- .github/workflows/test.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 2ca7828f5..0918f4ca8 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -449,9 +449,9 @@ jobs: ./foremanctl certificate-bundle proxy.example.com \ --certificate-source=${{ matrix.certificate_source }} \ ${{ matrix.certificate_source == 'custom_server' && '--certificate-server-certificate /root/custom-certificates/certs/proxy.example.com.crt --certificate-server-key /root/custom-certificates/private/proxy.example.com.key' || '' }} - - name: Prepare proxy host + - name: Fetch certificates bundle from quadlet run: | - ./foremanctl prepare-proxy proxy.example.com + ./forge fetch-bundle proxy.example.com - name: Deploy content proxy run: | ./foremanctl deploy-proxy \