Refactor service networking onto Podman bridge networks - #29
Open
pablomh wants to merge 35 commits into
Open
Conversation
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
--------- Co-authored-by: Cursor <cursoragent@cursor.com>
pablomh
force-pushed
the
pr403-networks-rebase-20260724-ci
branch
from
July 25, 2026 14:22
1e838f1 to
7dbee4c
Compare
Co-Authored-By: Claude <noreply@anthropic.com>
* Add Templates feature to foreman-proxy Signed-off-by: Shubham Ganar <shubhamsg123m@gmail.com> * Fix templates deploy on content proxy by setting templates-url Signed-off-by: Shubham Ganar <shubhamsg123m@gmail.com> --------- Signed-off-by: Shubham Ganar <shubhamsg123m@gmail.com>
* add vex tarball downloader for IoP * iop vex: add offline mode * add tests for vex * IoP vex: edit script * IoP vex script: use full curl options * IoP vex: fix test path * IoP vex: fix script name in tests * IoP vex: add trap for deleting tmp files * IoP vex: rm stored checksum * IoP vex downloader: fix shellcheck * IoP vex: download only when content is changed * IoP vex: create folder by ansible, run job every day * IoP vex: add test for existence of download directory * IoP vex: mv iop-vex-downloader.sh.j2 -> iop-vex-downloader.sh * IoP vex: fix linting * IoP vex: more verbose script * IoP vex: fix script name * IoP vex: create archive_latest.txt file * IoP vex: fix tests * IoP vex: fix linting * IoP vex: more verbosity, mv script to files * IoP vex: more verbose script * IoP vex: reorder tasks, update script
Add a foremanctl test that discovers all running containers using podman ps and validates their configured user with podman inspect. Fail when Config.User is empty, root, or UID 0, and report all non-compliant containers with their image details.
Move production services off host networking so internal traffic uses bridge DNS and isolated networks while keeping development and remote-database workflows on localhost-compatible settings. Update certificates, service defaults, tests, and deployment docs to match the current Foreman, Pulp, Candlepin, PostgreSQL, and Valkey architecture. Co-authored-by: Cursor <cursoragent@cursor.com>
Cover the remaining CI failures by issuing an internal Candlepin cert in custom-server deployments, normalizing migrated internal DB hosts to container DNS, and creating the bridge networks required by proxy deployments. Co-authored-by: Cursor <cursoragent@cursor.com>
Log the deploy_network role inputs, Podman runtime details, and relevant package versions around network creation so CI captures enough context to diagnose isolate option failures. Co-authored-by: Cursor <cursoragent@cursor.com>
Route isolated network creation through an explicit Podman CLI fallback on newer Podman/netavark stacks so the role stays compatible until the fixed containers.podman release lands. Co-authored-by: Cursor <cursoragent@cursor.com>
Adjust the compatibility task naming and command change reporting so the isolate fallback stays ansible-lint clean without changing behavior. Co-authored-by: Cursor <cursoragent@cursor.com>
Parameterize the Candlepin healthcheck hostname so normal deployments continue to use the bridged service identity while the development path keeps its existing localhost-based behavior. Co-authored-by: Cursor <cursoragent@cursor.com>
Keep Foreman off the isolated IoP mesh while dual-homing the gateway onto both networks so smart proxy registration, certificate SANs, and integration coverage match the deployed topology. Co-authored-by: Cursor <cursoragent@cursor.com>
Scope IoP gateway registration defaults under iop_core, restart the gateway when its quadlet changes, and move IoP database consumers to the internal PostgreSQL bridge and local socket paths so green deployments complete successfully. Co-authored-by: Cursor <cursoragent@cursor.com>
Wait for proxy and IOP smart proxy endpoints from Foreman's network context before registration, scope gateway defaults within their consuming roles, and restore container host-file seeding while simplifying the related resolution tests to match Podman's startup-time behavior. Co-authored-by: Cursor <cursoragent@cursor.com>
Keep the smart proxy registered under its public hostname while allowing the integrated Foreman container to reach it through the internal foreman-proxy DNS name, and scope the Foreman-side readiness probe to that colocated deployment path. Co-authored-by: Cursor <cursoragent@cursor.com>
Keep the integrated Foreman-side readiness probe scoped to colocated deployments while using the certificate-valid public proxy URL for readiness and registration, and fix the related proxy test import ordering for ruff. Co-authored-by: Cursor <cursoragent@cursor.com>
Keep the smart proxy public name separate from the operational URL Foreman stores for integrated deployments, and make certificate handling deterministic so the internal foreman-proxy alias is either issued automatically or rejected early for custom server certificates. Co-authored-by: Cursor <cursoragent@cursor.com>
Define the server SAN helper variables at the task-block level so the alias check and renewal logic share the same values during certificate issuance. Co-authored-by: Cursor <cursoragent@cursor.com>
Propagate server aliases through the forge custom-certs helper and request the integrated foreman-proxy alias in the custom_server proxy CI path so the fixture certificate matches the branch proxy registration contract. Co-authored-by: Cursor <cursoragent@cursor.com>
Generate the custom_server fixture certificate with the integrated foreman-proxy SAN and reuse the same explicit custom certificate arguments on the follow-up deploy that enables foreman-proxy so custom_server CI exercises a consistent TLS identity. Co-authored-by: Cursor <cursoragent@cursor.com>
Make internal backups use the PostgreSQL host socket instead of container-only DNS when running from the host, and gate the Valkey-from-Foreman resolution test on the foreman feature so proxy-only deployments exercise only the topology they actually run. Co-authored-by: Cursor <cursoragent@cursor.com>
Keep internal-database backups working in proxy-only deployments even when PostgreSQL role defaults are not loaded into the backup playbook scope. Co-authored-by: Cursor <cursoragent@cursor.com>
pablomh
force-pushed
the
pr403-networks-rebase-20260724-ci
branch
from
July 30, 2026 21:16
057fefb to
308a415
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
11 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Move production services off host networking so internal traffic uses bridge DNS and isolated networks while keeping development and remote-database workflows on localhost-compatible settings. Update certificates, service defaults, tests, and deployment docs to match the current Foreman, Pulp, Candlepin, PostgreSQL, and Valkey architecture.
Why are you introducing these changes? (Problem description, related links)
What are the changes introduced in this pull request?
How to test this pull request
Steps to reproduce:
Checklist