Warn about unrecognized smart proxy features by adamruzicka · Pull Request #554 · theforeman/foremanctl

adamruzicka · 2026-06-10T14:31:59Z

Why are you introducing these changes? (Problem description, related links)

Currently if the proxy offers more features than Foreman knows, those would go silently ignored (unless all of the proxy's features are unknown to Foreman), which makes it hard to spot misconfigured deployments.

What are the changes introduced in this pull request?

After registering a proxy, fctl will check if all the proxy's features are recognized by Foreman and warn if not.

How to test this pull request

Steps to reproduce:

Somehow force a deployment where the proxy has features which Foreman doesn't know
See the warning

Checklist

Tests added/updated (if applicable)
- figure out how to do this
Documentation updated (if applicable)
- this doesn't really need docs

adamruzicka · 2026-06-15T11:55:13Z

figure out how to do this [tests]

This would require a test that would intentionally break things just to check that this would then emit a warning. I'm open to idea, but at this point I'm leaning towards not having tests for this here.

ehelms · 2026-06-15T15:16:29Z

+    msg: >-
+      Proxy {{ foreman_proxy_name }} has features not recognized by Foreman:
+      {{ _foreman_proxy_registration.entity.smart_proxies[0].unrecognized_features | join(', ') }}.
+      If these features come from a Smart Proxy plugin, make sure Foreman has the plugin installed too.


I don't think a user can act on this cleanly. Plugins are not a thing we expose here in foremanctl. We present the user with features. I like the general idea of where you are going with this, but it feels like a post_install check that should happen once at the end of deploy.

Done. The only thing I'm not exactly happy about is that right now it checks all the proxies, not just those that were registered (or affected) during this installation run. Probably not a problem right now, but it could become somewhat confusing later

ehelms · 2026-06-30T12:09:26Z

Generally looks good now, you'll have to deal with the variables that are not scoped to the role name.

adamruzicka · 2026-06-30T13:59:16Z

🍏

ehelms · 2026-07-01T23:06:40Z

+    server_url: "{{ foreman_server_url }}"
+    oauth1_consumer_key: "{{ foreman_oauth_consumer_key }}"
+    oauth1_consumer_secret: "{{ foreman_oauth_consumer_secret }}"
+    ca_path: "{{ foreman_ca_path }}"


To follow our rules, all of the variables in this role need to be role scoped (e.g. post_intsall_foreman_ca_path). Yes, I realize that creates a lot of overhead for this particular case, however, thems the rules currently.

I was under the impression there was a lint that was enforcing this? Anyway, added

I think it's enforcing role variables being namespaced but not the use of variables which I realize might sound like the same thing but it's not.

ehelms · 2026-07-02T11:28:11Z

+- name: Check for unrecognized Smart Proxy features
+  ansible.builtin.include_tasks: smart_proxy_features_check.yaml
+  vars:
+    post_install_foreman_server_url: "{{ foreman_url }}"


This is effectively the same issue -- these are variables not scoped to the current role. These would need to be passed into post_install role when it's declared in the deploy playbook for example.

Would we benefit from global variables? Perhaps. I think that should be a broader discussion.

So the use of foreman_url on L8 is also wrong?

ehelms · 2026-07-02T14:21:45Z

-    _post_install_url_msg: "Foreman is running at {{ foreman_url }}"
-    _post_install_cred_msg: "Admin credentials: {{ foreman_initial_admin_username }}:{{ foreman_initial_admin_password }}"
+    _post_install_url_msg: "Foreman is running at {{ post_install_foreman_server_url }}"
+    _post_install_cred_msg: "Admin credentials: {{ post_install_foreman_initial_admin_username }}:{{ post_install_foreman_initial_admin_password }}"


Thanks for handling those!

ehelms · 2026-07-02T14:22:32Z

@adamruzicka rebase needed -- I merged a big set of changes with the deploy-proxy command

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Previously, warnings about unrecognized Smart Proxy features were displayed inline during installation as each proxy was registered. Production deployments now check all Smart Proxies in the post_install role using resource_info to query for unrecognized_features. Development deployments check Smart Proxies in a post_task in the deploy-dev playbook. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

In production deployments, move the Smart Proxy feature check from inline (immediately after registration) to post-deployment checks. This provides a comprehensive view of all proxy features across all registered proxies. For development deployments, keep the inline checks since the Foreman server is stopped before post-deployment tasks run. The post-deployment check uses OAuth authentication to query the Foreman API, fetching all registered Smart Proxies and checking for unrecognized features in a single consolidated check.

Reword the warning to use foremanctl terminology and provide both resolution paths: enable matching features in foremanctl or disable them on the proxy. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Variables used in smart_proxy_features_check.yaml must follow the role-scoped naming convention (post_install_*) per project rules. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

evgeni · 2026-07-09T15:10:17Z

This now creates a rather huge skipped block at the end of every run:

TASK [post_install : Warn about unrecognized Smart Proxy features] ********************************************************************************************************************************************************************
skipping: [proxy] => (item={'created_at': '2026-07-09 15:08:02 UTC', 'updated_at': '2026-07-09 15:08:02 UTC', 'hosts_count': 0, 'unrecognized_features': [], 'name': 'proxy.example.com', 'id': 3, 'url': 'https://proxy.example.com:8443', 'remote_execution_pubkey': None, 'remote_execution_ca_pubkey': None, 'download_policy': 'on_demand', 'supported_pulp_types': [], 'lifecycle_environments': [], 'features': [{'capabilities': [], 'name': 'Logs', 'id': 13}], 'locations': [{'id': 2, 'name': 'Default Location', 'title': 'Default Location', 'description': None}], 'organizations': [{'id': 1, 'name': 'Default Organization', 'title': 'Default Organization', 'description': None}]}) 
skipping: [proxy] => (item={'created_at': '2026-07-09 15:07:32 UTC', 'updated_at': '2026-07-09 15:07:32 UTC', 'hosts_count': 0, 'unrecognized_features': [], 'name': 'proxy.example.com-pulp', 'id': 2, 'url': 'https://proxy.example.com/pulp/api/v3/smart_proxy', 'remote_execution_pubkey': None, 'remote_execution_ca_pubkey': None, 'download_policy': 'on_demand', 'supported_pulp_types': ['ansible_collection', 'deb', 'docker', 'file', 'python', 'yum'], 'lifecycle_environments': [], 'features': [{'capabilities': ['core', 'certguard', 'file', 'ansible', 'python', 'deb', 'smart_proxy', 'container', 'rpm'], 'name': 'Pulpcore', 'id': 3}], 'locations': [{'id': 2, 'name': 'Default Location', 'title': 'Default Location', 'description': None}], 'organizations': [{'id': 1, 'name': 'Default Organization', 'title': 'Default Organization', 'description': None}]}) 
skipping: [proxy] => (item={'created_at': '2026-07-09 14:56:46 UTC', 'updated_at': '2026-07-09 14:56:46 UTC', 'hosts_count': 0, 'unrecognized_features': [], 'name': 'quadlet.example.com-pulp', 'id': 1, 'url': 'https://quadlet.example.com/pulp/api/v3/smart_proxy', 'remote_execution_pubkey': None, 'remote_execution_ca_pubkey': None, 'download_policy': 'on_demand', 'supported_pulp_types': ['ansible_collection', 'deb', 'docker', 'file', 'python', 'yum'], 'lifecycle_environments': [{'id': 1, 'name': 'Library', 'description': None, 'library': True, 'organization_id': 1, 'created_at': '2026-07-09 14:53:46 UTC', 'updated_at': '2026-07-09 14:53:46 UTC', 'label': 'Library', 'registry_name_pattern': None, 'registry_unauthenticated_pull': False, 'prior': None, 'prior_id': None, 'organization': 'Default Organization'}], 'features': [{'capabilities': ['core', 'certguard', 'file', 'ansible', 'python', 'deb', 'smart_proxy', 'container', 'rpm'], 'name': 'Pulpcore', 'id': 3}], 'locations': [{'id': 2, 'name': 'Default Location', 'title': 'Default Location', 'description': None}], 'organizations': [{'id': 1, 'name': 'Default Organization', 'title': 'Default Organization', 'description': None}]}) 
skipping: [proxy]

especially: it makes the post_install message we have not the last thing printed.

TASK [post_install : Admin credentials] **********************************************
ok: [quadlet] => 
    msg:
    - Foreman is running at https://quadlet.example.com

Could Claude come up with a better solution for our users?

ehelms · 2026-07-09T15:13:45Z

This now creates a rather huge skipped block at the end of every run:

How does one avoid this with Ansible?

especially: it makes the post_install message we have not the last thing printed.

That's fair, it was not obvious from the code that the "message" part is tied into the flavor element. We could make that code more obvious.

ehelms · 2026-07-09T15:33:06Z

I took a shot at both through a re-factor of the post_install role: #641

pr-processor Bot added the Not yet reviewed label Jun 10, 2026

adamruzicka force-pushed the unknown-proxy-features branch from 540d0d5 to a2f7446 Compare June 10, 2026 15:46

ehelms reviewed Jun 15, 2026

View reviewed changes

pr-processor Bot removed the Not yet reviewed label Jun 15, 2026

ehelms reviewed Jun 16, 2026

View reviewed changes

Comment thread src/roles/post_install/tasks/smart_proxy_features_check.yaml Outdated

ehelms reviewed Jun 16, 2026

View reviewed changes

Comment thread src/roles/post_install/tasks/smart_proxy_features_check.yaml Outdated

adamruzicka force-pushed the unknown-proxy-features branch 2 times, most recently from f234c85 to fd35f7b Compare June 17, 2026 09:41

adamruzicka force-pushed the unknown-proxy-features branch from b04015b to 0362373 Compare June 30, 2026 12:12

adamruzicka marked this pull request as ready for review June 30, 2026 13:59

ehelms reviewed Jul 1, 2026

View reviewed changes

adamruzicka force-pushed the unknown-proxy-features branch from 6d7ff5b to 04b7a6a Compare July 2, 2026 08:38

ehelms reviewed Jul 2, 2026

View reviewed changes

adamruzicka force-pushed the unknown-proxy-features branch from 0e8e74e to 4057e10 Compare July 2, 2026 11:59

ehelms reviewed Jul 2, 2026

View reviewed changes

ehelms approved these changes Jul 2, 2026

View reviewed changes

adamruzicka force-pushed the unknown-proxy-features branch 2 times, most recently from 8123cec to cc2b8e3 Compare July 3, 2026 09:49

ehelms reviewed Jul 3, 2026

View reviewed changes

Comment thread src/roles/foreman/tasks/main.yaml Outdated

adamruzicka force-pushed the unknown-proxy-features branch 2 times, most recently from 617576a to 1efd7f0 Compare July 7, 2026 07:18

adamruzicka and others added 5 commits July 9, 2026 10:06

Warn about unrecognized smart proxy features

7a758ab

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Improve Smart Proxy feature warning message

e6c1cbf

Reword the warning to use foremanctl terminology and provide both resolution paths: enable matching features in foremanctl or disable them on the proxy. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Scope post_install role variables properly

efe28b0

Variables used in smart_proxy_features_check.yaml must follow the role-scoped naming convention (post_install_*) per project rules. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

adamruzicka added 4 commits July 9, 2026 10:06

Scope post_install role variables properly, vol. 2

7ec071c

Scope post_install role variables properly, vol. 3

c1614b3

Omit ca path if unknown

72bb8a0

Fallback to foreman_proxy_*

2ea41cf

adamruzicka force-pushed the unknown-proxy-features branch from 1efd7f0 to 2ea41cf Compare July 9, 2026 08:06

adamruzicka and others added 2 commits July 9, 2026 11:23

Pass post_install vars in deploy-proxy playbook

e685649

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Remove unnecessary fallbacks in deploy playbook post_install vars

07a7388

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

adamruzicka force-pushed the unknown-proxy-features branch from 255023a to 07a7388 Compare July 9, 2026 12:14

ehelms approved these changes Jul 9, 2026

View reviewed changes

ehelms merged commit 99670e3 into theforeman:master Jul 9, 2026
16 checks passed

adamruzicka deleted the unknown-proxy-features branch July 9, 2026 13:42

Uh oh!

Conversation

adamruzicka commented Jun 10, 2026

Why are you introducing these changes? (Problem description, related links)

What are the changes introduced in this pull request?

How to test this pull request

Checklist

Uh oh!

adamruzicka commented Jun 15, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

ehelms commented Jun 30, 2026

Uh oh!

adamruzicka commented Jun 30, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ehelms commented Jul 2, 2026

Uh oh!

Uh oh!

Uh oh!

evgeni commented Jul 9, 2026

Uh oh!

ehelms commented Jul 9, 2026

Uh oh!

ehelms commented Jul 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants