Add foreman-rake wrapper

Author: ShimShtein

src/roles/foreman/defaults/main.yaml

@@ -1,6 +1,7 @@
 ---
 foreman_container_image: "quay.io/foreman/foreman"
 foreman_container_tag: "nightly"
+foreman_container_name: foreman
 
 foreman_database_name: foreman
 foreman_database_user: foreman

src/roles/foreman/tasks/main.yaml

@@ -109,7 +109,7 @@
 
 - name: Deploy Foreman Container
   containers.podman.podman_container:
-    name: "foreman"
+    name: "{{ foreman_container_name }}"
     image: foreman.image
     state: quadlet
     sdnotify: true
@@ -150,6 +150,14 @@
         After=foreman-db-migrate.service
   notify: Restart foreman
 
+- name: Install foreman-rake wrapper
+  ansible.builtin.template:
+    src: foreman-rake.j2
+    dest: /usr/sbin/foreman-rake
+    owner: root
+    group: root
+    mode: '0755'
+
 - name: Deploy Dynflow Container
   containers.podman.podman_container:
     name: "dynflow-sidekiq-%i"

src/roles/foreman/templates/foreman-rake.j2

@@ -0,0 +1,60 @@
+#!/bin/bash
+
+validate_actions() {
+    # This list is generated by running:
+    # rg '# foreman-rake' | awk '{ print $3 }' | sort -u
+    # against the foreman documentation repository (https://github.com/theforeman/foreman-documentation).
+    # The intention is to have a list of tasks that were mentioned explicitly in the documentation.
+    local allowed_actions=(
+        "audits:anonymize"
+        "audits:expire"
+        "audits:list_attributes"
+        "console"
+        "facts:clean"
+        "foreman_openscap:bulk_upload:default"
+        "foreman_tasks:cleanup"
+        "interfaces:clean"
+        "katello:delete_orphaned_content"
+        "katello:migrate_deb_content_attributes_to_pulp3"
+        "katello:upgrade_check"
+        "ldap:refresh_usergroups"
+        "orchestration:dhcp:add_missing"
+        "orchestration:dhcp:remove_offending"
+        "permissions:reset"
+        "reports:daily"
+        "reports:expire"
+        "reports:monthly"
+        "reports:weekly"
+        "telemetry:metrics"
+        "templates:cleanup"
+    )
+
+    local joined_pattern
+    joined_pattern=$(IFS="|"; echo "${allowed_actions[*]}")
+
+    local pattern="(^|[[:space:]])($joined_pattern)([[:space:]]|$)"
+
+    if [[ ! "$*" =~ $pattern ]]; then
+        if [ "${ALLOW_UNSUPPORTED}" != "true" ]; then
+            echo "ERROR: Unsupported action detected." >&2
+            exit 1
+        else
+            echo "WARNING: Unsupported action detected. Please use with caution." >&2
+        fi
+    fi
+}
+
+if [ "$(id -u)" -ne 0 ]; then
+    echo "This script must be run as root" >&2
+    exit 1
+fi
+
+validate_actions "$@"
+
+# Use an array to avoid shell expansion issues
+TTY_ARGS=()
+if [ -t 0 ]; then
+    TTY_ARGS=(-it)
+fi
+
+exec podman exec "${TTY_ARGS[@]}" {{ foreman_container_name }} foreman-rake "$@"

tests/feature/foreman/foreman_rake_test.py

@@ -0,0 +1,21 @@
+def test_foreman_rake_wrapper_exists(server):
+    wrapper = server.file('/usr/sbin/foreman-rake')
+    assert wrapper.exists
+    assert wrapper.mode == 0o755
+
+
+def test_foreman_rake_list_tasks(server):
+    result = server.run('ALLOW_UNSUPPORTED=true foreman-rake -T')
+    assert result.succeeded
+    assert 'WARNING: Unsupported action detected' in result.stderr
+    assert 'rake cron:daily' in result.stdout
+
+
+def test_foreman_rake_rejects_unsupported_action(server):
+    result = server.run_expect([1], 'foreman-rake unsupported:task')
+    assert 'ERROR: Unsupported action detected' in result.stderr
+
+
+def test_foreman_rake_supported_action(server):
+    result = server.run('foreman-rake facts:clean')
+    assert result.succeeded