prepare proxy before deployment

Author: Arvind Jangir

.github/workflows/test.yml

@@ -449,14 +449,14 @@ jobs:
           ./foremanctl certificate-bundle proxy.example.com \
             --certificate-source=${{ matrix.certificate_source }} \
             ${{ matrix.certificate_source == 'custom_server' && '--certificate-server-certificate /root/custom-certificates/certs/proxy.example.com.crt --certificate-server-key /root/custom-certificates/private/proxy.example.com.key' || '' }}
-      - name: Fetch certificates bundle from quadlet
+      - name: Prepare proxy host
         run: |
-          ./forge fetch-bundle proxy.example.com
+          ./foremanctl prepare-proxy proxy.example.com
       - name: Deploy content proxy
         run: |
           ./foremanctl deploy-proxy \
             --flavor foreman-proxy-content \
-            --certificate-bundle $(pwd)/.var/lib/foremanctl/proxy.example.com.tar.gz \
+            --certificate-bundle /root/proxy.example.com.tar.gz \
             --foreman-fqdn quadlet.example.com
       - name: Run tests
         run: |

src/playbooks/deploy-proxy/metadata.obsah.yaml

@@ -15,12 +15,6 @@ variables:
   foreman_name:
     parameter: --foreman-fqdn
     help: FQDN of the Foreman server this proxy connects to.
-  foreman_proxy_oauth_consumer_key:
-    parameter: --oauth-consumer-key
-    help: OAuth key to be used for communication with Foreman.
-  foreman_proxy_oauth_consumer_secret:
-    parameter: --oauth-consumer-secret
-    help: OAuth secret to be used for communication with Foreman.
 
 include:
   - _flavor_features

src/playbooks/prepare-proxy/metadata.obsah.yaml

@@ -0,0 +1,9 @@
+---
+help: |
+  Prepare a proxy host for deployment.
+
+variables:
+  hostname:
+    parameter: hostname
+    help: FQDN of the proxy host to prepare.
+    required: true

src/playbooks/prepare-proxy/prepare-proxy.yaml

@@ -0,0 +1,68 @@
+---
+- name: Validate and fetch proxy prerequisites
+  hosts: quadlet
+  become: true
+  vars_files:
+    - "../../vars/certificates.yml"
+    - "../../vars/foreman.yml"
+  tasks:
+    - name: Check certificate bundle exists
+      ansible.builtin.stat:
+        path: "{{ certificates_ca_directory }}/bundles/{{ hostname }}.tar.gz"
+      register: _bundle_stat
+
+    - name: Fail if certificate bundle does not exist
+      ansible.builtin.fail:
+        msg: >-
+          Certificate bundle for {{ hostname }} not found at
+          {{ certificates_ca_directory }}/bundles/{{ hostname }}.tar.gz.
+          Run 'foremanctl certificate-bundle --hostname {{ hostname }}' first.
+      when: not _bundle_stat.stat.exists
+
+    - name: Fetch certificate bundle to controller
+      ansible.builtin.fetch:
+        src: "{{ certificates_ca_directory }}/bundles/{{ hostname }}.tar.gz"
+        dest: "{{ obsah_state_path }}/{{ hostname }}.tar.gz"
+        flat: true
+
+    - name: Add proxy host to inventory
+      ansible.builtin.add_host:
+        name: "{{ hostname }}"
+        groups: proxy
+        ansible_connection: ssh
+        ansible_host: "{{ hostname }}"
+        ansible_user: "{{ proxy_ssh_user | default('root') }}"
+        inventory_dir: "{{ inventory_dir }}"
+
+- name: Transfer proxy certificate bundle and oauth credentials to proxy host
+  hosts: proxy
+  become: true
+  vars_files:
+    - "../../vars/foreman.yml"
+  tasks:
+    - name: Check SSH connectivity and authentication to proxy
+      ansible.builtin.ping:
+
+    - name: Copy certificate bundle to proxy
+      ansible.builtin.copy:
+        src: "{{ obsah_state_path }}/{{ hostname }}.tar.gz"
+        dest: "/root/{{ hostname }}.tar.gz"
+        mode: "0600"
+        owner: root
+        group: root
+
+    - name: Copy OAuth consumer key to proxy
+      ansible.builtin.copy:
+        src: "{{ foreman_oauth_consumer_key_file }}"
+        dest: "/root/foreman-oauth-consumer-key"
+        mode: "0600"
+        owner: root
+        group: root
+
+    - name: Copy OAuth consumer secret to proxy
+      ansible.builtin.copy:
+        src: "{{ foreman_oauth_consumer_secret_file }}"
+        dest: "/root/foreman-oauth-consumer-secret"
+        mode: "0600"
+        owner: root
+        group: root

src/roles/pre_install/tasks/foreman-proxy-content.yaml

@@ -0,0 +1,19 @@
+---
+- name: Read OAuth consumer key from file
+  ansible.builtin.slurp:
+    src: /root/foreman-oauth-consumer-key
+  register: _oauth_key_file
+
+- name: Set OAuth consumer key
+  ansible.builtin.set_fact:
+    foreman_proxy_oauth_consumer_key: "{{ _oauth_key_file.content | b64decode | trim }}"
+
+- name: Read OAuth consumer secret from file
+  ansible.builtin.slurp:
+    src: /root/foreman-oauth-consumer-secret
+  register: _oauth_secret_file
+
+- name: Set OAuth consumer secret
+  ansible.builtin.set_fact:
+    foreman_proxy_oauth_consumer_secret: "{{ _oauth_secret_file.content | b64decode | trim }}"
+

src/roles/pre_install/tasks/katello.yaml

@@ -1,4 +1,7 @@
 ---
+- name: Include flavor tasks
+  ansible.builtin.include_tasks: "{{ flavor }}.yaml"
+
 - name: Deploy debug_tools
   ansible.builtin.include_role:
     name: debug_tools