Support non-root Candlepin by running as tomcat with owned secrets by Alleny244 · Pull Request #651 · theforeman/foremanctl

Alleny244 · 2026-07-13T15:55:15Z

Why are you introducing these changes? (Problem description, related links)

Candlepin is moving to a non-root container user (tomcat). By default, Podman mounts secrets as root:root with mode 0440, which prevents the tomcat user from reading the mounted certificates and configuration files unless it is added to the root group inside the container.

This PR updates foremanctl to run Candlepin as tomcat and sets the ownership of secret mounts to the same user, enabling the companion candlepin-oci-images change (USER tomcat, no root group membership).

What are the changes introduced in this pull request?

Add candlepin_container_user: tomcat as the default.
Configure the Candlepin Quadlet to run with User=tomcat.
Add user.yml to determine the tomcat UID/GID from the container image at deploy time (podman run ... id -u/-g).
Set the uid/gid on all Candlepin secret mounts so the mounted files are owned by tomcat (mode 0440).
Add test_candlepin_runs_as_tomcat to verify Candlepin runs as tomcat and can read the mounted secrets.

How to test this pull request

Deploy

Use a Candlepin image built with the companion candlepin-oci-images change (USER tomcat):

./foremanctl deploy --foreman-initial-admin-password=changeme --tuning development

Verify

podman exec candlepin id -un
# tomcat

podman exec candlepin ls -l /etc/candlepin/candlepin.conf

podman exec candlepin ls -l /etc/candlepin/certs/

podman exec candlepin test -r /etc/candlepin/certs/tomcat.key

curl -k https://localhost:23443/candlepin/status
# HTTP 200

Run automated tests

./forge test --pytest-args="tests/candlepin_test.py -vv"

Note: The non-root behavior is fully validated only with the companion candlepin-oci-images PR. Deployments continue to work with the current image, but the container will still run as the existing image user.

Checklist

Tests added/updated (if applicable)
Documentation updated (if applicable)

evgeni · 2026-07-14T07:30:21Z

+        [Container]
+        User={{ candlepin_container_user }}


Should we set this in https://github.com/theforeman/candlepin-oci-images/blob/master/images/candlepin/Containerfile, so all users of the container benefit from it?

(Not blocking, we can change it here, see it works, change it in the container and then remove the two lines here again)

Hah, just realized you already have theforeman/candlepin-oci-images#52 open. Nice!

If the image change is merged, this should be dropped, right?

okay, got it. Can I drop it then, assuming the other pr would be merged first?

But we're using foreman-nightly, not nightly in

foremanctl/src/vars/images.yml

Lines 4 to 6 in 688d3da

container_tag_stream: "nightly"

candlepin_container_image: quay.io/foreman/candlepin

candlepin_container_tag: "foreman-{{ container_tag_stream }}"

What updates the foreman-nightly tag?

Any merge that you do on foreman-nightly the image is built and published by Konflux right after.

This is the tag that we are using now https://gitlab.com/fedora/infrastructure/konflux/tenants-config/-/blob/main/clusters/kflux-fedora-01/tenants/theforeman-org-tenant/candlepin/releaseplans/develop/kustomization.yaml?ref_type=heads#L30

Should we also add foreman-nightly alongside nightly as tag?

Just added here https://gitlab.com/fedora/infrastructure/konflux/tenants-config/-/merge_requests/212, I'll make sure it's there in one hour after everything syncs

You can now use quay.io/foreman/candlepin:foreman-nightly

podman pull quay.io/foreman/candlepin:foreman-nightly Trying to pull quay.io/foreman/candlepin:foreman-nightly... Getting image source signatures Copying blob 0a3d34aa24dc done | Copying blob 452eff874a29 done | Copying config f7a84f58b6 done | Writing manifest to image destination f7a84f58b60c2c0a002523d70594e708264d17d5b3c652d9357d49028202592d

I don't necessarily say this needs to be updated at the same time you tag a new candlepin (or pulp!) nightly. More when there is a new candlepin (or pulp) that should go with foreman nightly (e.g. after a pipeline run that verifies those are compatible, or whatever).

archanaserver

LGTM

evgeni · 2026-07-15T08:17:15Z

"migration" test failure unrelated, explanation and possible fix in #661

Odilhao · 2026-07-15T14:46:47Z

@@ -11,6 +11,7 @@ candlepin_ciphers:
  - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
 candlepin_container_image: quay.io/foreman/candlepin
 candlepin_container_tag: "4.4.14"


Right now our container on nightly is built with 4.8.2, do we need to update it here?

ekohl · 2026-07-15T15:10:10Z

#657 was merged and introduced a merge conflict. My apologies.

pr-processor Bot added the Not yet reviewed label Jul 13, 2026

Alleny244 mentioned this pull request Jul 13, 2026

Run Candlepin container as tomcat non-root user theforeman/candlepin-oci-images#52

Merged

8 tasks

Alleny244 force-pushed the fix/candlepin-nonroot-user branch 2 times, most recently from dec888e to b050bfe Compare July 13, 2026 16:48

ehelms reviewed Jul 13, 2026

View reviewed changes

Comment thread src/roles/candlepin/tasks/user.yml Outdated

pr-processor Bot removed the Not yet reviewed label Jul 13, 2026

Alleny244 force-pushed the fix/candlepin-nonroot-user branch from b050bfe to bd0e421 Compare July 14, 2026 07:03

archanaserver approved these changes Jul 14, 2026

View reviewed changes

Comment thread tests/feature/katello/candlepin_test.py

evgeni reviewed Jul 14, 2026

View reviewed changes

Alleny244 force-pushed the fix/candlepin-nonroot-user branch from bd0e421 to 3e320ee Compare July 14, 2026 07:43

archanaserver approved these changes Jul 14, 2026

View reviewed changes

ekohl reviewed Jul 14, 2026

View reviewed changes

Comment thread src/roles/candlepin/defaults/main.yml Outdated

Alleny244 force-pushed the fix/candlepin-nonroot-user branch from 3e320ee to d01bc67 Compare July 15, 2026 06:29

evgeni mentioned this pull request Jul 15, 2026

Add foremanctl integration workflow for Candlepin image changes theforeman/candlepin-oci-images#55

Merged

evgeni force-pushed the fix/candlepin-nonroot-user branch from d01bc67 to 27ad2c8 Compare July 15, 2026 13:36

evgeni enabled auto-merge (rebase) July 15, 2026 13:49

Odilhao reviewed Jul 15, 2026

View reviewed changes

Support non-root Candlepin by running as tomcat with owned secrets

1a89427

auto-merge was automatically disabled July 15, 2026 15:27
Head branch was pushed to by a user without write access

Alleny244 force-pushed the fix/candlepin-nonroot-user branch from 27ad2c8 to 1a89427 Compare July 15, 2026 15:27

evgeni merged commit 856029f into theforeman:master Jul 15, 2026
12 of 15 checks passed

	container_tag_stream: "nightly"
	candlepin_container_image: quay.io/foreman/candlepin
	candlepin_container_tag: "foreman-{{ container_tag_stream }}"

Uh oh!

Conversation

Alleny244 commented Jul 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why are you introducing these changes? (Problem description, related links)

What are the changes introduced in this pull request?

Related

How to test this pull request

Deploy

Verify

Run automated tests

Checklist

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

archanaserver left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

evgeni commented Jul 15, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ekohl commented Jul 15, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Alleny244 commented Jul 13, 2026 •

edited

Loading