prepare proxy before deployment#644
Conversation
7c40ad6 to
23aa65d
Compare
|
The prerequisites for |
|
What's the envisioned user workflow here, given that the current way of storing parameters limits us pretty hard on having "single foremanctl install manages multiple servers and proxies" working? Something like:
|
yes, the goal was to get rid of manually copying certificate bundle and passing oauth creds with deploy-proxy |
| - name: Check SSH connectivity and authentication to proxy | ||
| ansible.builtin.ping: | ||
|
|
||
| - name: Copy certificate bundle to proxy |
There was a problem hiding this comment.
this particular step does behave differently for dev and prod setup, idea was to copy the bundle to proxy machine, but that contradicts with dev workflow where we fetch bundle locally on controller and use it
There was a problem hiding this comment.
on dev and CI , fetching bundle would work but in production we need to copy bundle over to proxy machine
There was a problem hiding this comment.
Try not to think of this as "dev" and "prod". Instead, think of this as control node and target node. See #630
0739407 to
9298e48
Compare
| - name: Copy OAuth consumer secret to proxy | ||
| ansible.builtin.copy: | ||
| src: "{{ foreman_oauth_consumer_secret_file }}" | ||
| dest: "/root/foreman-oauth-consumer-secret" |
There was a problem hiding this comment.
I don't love this. Copying and storing this value at /root. I think these need to go into the state directory or include them in the bundle.
There was a problem hiding this comment.
This causes CI failure, because(in context of controller and target), we have single controller managing both quadlet and proxy targets in Dev and CI. but thats not the case on production, there we have separate proxy machine which itself acts as controller so we need to copy oauth credentials and certificates bundle from foreman machine.
619d463 to
6ba812e
Compare
| - name: Prepare proxy host | ||
| run: | | ||
| ./forge fetch-bundle proxy.example.com | ||
| ./foremanctl prepare-proxy proxy.example.com |
There was a problem hiding this comment.
Instead of introducing a new subcommand just for preparation, could we leverage the existing one — something like foremanctl deploy-proxy --prepare, I'd like to understand the reasoning behind this design, what led us to prefer a new subcommand over extending the existing one?
Adding a separate subcommand for each step feels like unnecessary from the user's perspective.
There was a problem hiding this comment.
my reasoning to pick a separate prepare-proxy command is that it keeps two distinct tasks seprate as below:-
- preparing proxy machine for deployment
- actually deploying proxy
Adding a separate subcommand for each step feels like unnecessary from the user's perspective.
we are not adding subcommand for each task here rather prepare-proxy is the bundle of tasks(copying oauth credentials and certificate bundle) that helps to take care of the whole prepration we need to deploy the proxy.
| - name: Copy OAuth consumer secret to proxy | ||
| ansible.builtin.copy: | ||
| src: "{{ foreman_oauth_consumer_secret_file }}" | ||
| dest: "{{ obsah_state_path }}/foreman-oauth-consumer-secret" | ||
| mode: "0600" | ||
| owner: root | ||
| group: root |
There was a problem hiding this comment.
Once the certificate bundle and OAuth keys are copied, could we also print a ready-to-run foremanctl deploy-proxy.. command to the console? This would mirror the experience users are familiar with from
capsule-certs-generate, which outputs the exact install command with all the necessary parameters filled in.
There was a problem hiding this comment.
we could, yes, but i think after copying we eliminate the need of passing oauth credentianls(directly slurp from copied path) so essentially user only need to pass certificate bundle and foreman fqdn
|
@arvind4501 Could you add docs updates? That would help understand the user flow. |
6ba812e to
be4f177
Compare
4 participants
Why are you introducing these changes? (Problem description, related links)
Deploying a smart proxy requires a certificate bundle and OAuth credentials that live on the Foreman server. Previously there was no dedicated step to transfer these to the proxy host before running deploy-proxy, leaving users to handle that manually.
What are the changes introduced in this pull request?
How to test this pull request
Steps to reproduce:
Checklist