transfer oauth creds as part of certificate bundle by arvind4501 · Pull Request #698 · theforeman/foremanctl

arvind4501 · 2026-07-23T08:42:26Z

Why are you introducing these changes? (Problem description, related links)

Proxy deployment currently requires passing --oauth-consumer-key and --oauth-consumer-secret manually with deploy-proxy command. Those credentials already exist on the Foreman server and are required for the proxy to communicate with Foreman.
With these changes oauth credentials will travel with the bundle instead of being supplied as extra CLI parameters.

What are the changes introduced in this pull request?

Include Foreman OAuth consumer key/secret in the tarball produced by certificate-bundle
During deploy-proxy, read OAuth credentials from the extracted bundle (/var/lib/foremanctl/certs/) when flavor == foreman-proxy-content
Remove --oauth-consumer-key / --oauth-consumer-secret from deploy-proxy

How to test this pull request

Steps to reproduce:

Deploy Foreman, then generate a proxy bundle:
./foremanctl auth-bundle proxy.example.com
Confirm the tarball includes OAuth files:
tar -tzvf /var/lib/foremanctl/certs/bundles/proxy.example.com.tar.gz | grep oauth
Deploy the proxy without OAuth CLI flags:
./foremanctl deploy-proxy --flavor foreman-proxy-content --auth-bundle <bundle> --foreman-fqdn <foreman-fqdn>
Confirm extracted files exist on the proxy:
/var/lib/foremanctl/certs/foreman-oauth-consumer-key

Checklist

Tests added/updated (if applicable)
Documentation updated (if applicable)

ehelms · 2026-07-23T21:04:46Z

I think it would be nice to combine the extraction into a single extraction step of the bundle for everything in it, getting placed in the right locations.

ehelms · 2026-07-23T21:09:25Z

@@ -0,0 +1,27 @@
+---
+- name: Load OAuth credential from certificate bundle - {{ oauth_from_bundle_credential }}


The way I wanted to design the bundle was for it to be "throw away" after initial use. Can the oauth be loaded into files in the state directory and stored for reading like it is in the deploy Foreman case?

The way it's implemented right now, the bundle.tar.gz is throw away. The reading here happens from a file on disk after extraction from a sub-folder of our state directory on the target node.

Emphasis on "target node", as that breaks the "can it be the same as Foreman" case.
In the Foreman case we store the data on the control node (lookups run on the control node), not the target node.

We could "double extract" the bundle: once the certs part on the target, and the oauth part on the controller, but I'm not sure that complexity is worth it?

Sounds like what you are really saying is that the certificates should exist on the control node, and normalize that everything in /var/lib/foremanctl should be state?

maaaaaaaaaaybe. (it's friday afternoon)

is that something we need to tackle now?

ehelms · 2026-07-24T13:18:42Z

We could switch from certificate_bundle to auth_bundle but that's an idle thought :)

ehelms · 2026-07-24T13:19:34Z

 certificate_bundle_output_directory: "{{ certificates_ca_directory }}/bundles"
 certificate_bundle_server_ca_certificate: "{{ certificate_bundle_ca_certificate }}"
+certificate_bundle_oauth_consumer_key_file: # noqa: no-empty-defaults
+certificate_bundle_oauth_consumer_secret_file: # noqa: no-empty-defaults


Should we just omit these if they are empty? What's the value of having empty defaults?

Removed them. The empty defaults only had value when paired with the when: ... is exists guards on the copy tasks, the empty value helped to safely skip tasks when caller did not provide these vars, but in our case certificate-bundle playbook always sends these vars so good to remove

ehelms · 2026-07-24T13:20:25Z

+        src: "{{ certificate_bundle_oauth_consumer_key_file }}"
+        dest: "{{ certificate_bundle_build_directory.path }}/certs/oauth/foreman-oauth-consumer-key"
+        mode: '0440'
+      when: certificate_bundle_oauth_consumer_key_file is exists


If this file doesn't exist should we skip over that? Or let it error? Seems fairly serious if it doesn't exist.

arvind4501 · 2026-07-27T05:56:41Z

We could switch from certificate_bundle to auth_bundle but that's an idle thought :)

maybe, with that do we want to change the command from foremanctl certificate-bundle <hostname> to foremanctl auth-bundle <hostname>, or just the role name? i think it boils down to what command name we want to expose to users :)

evgeni · 2026-07-27T06:27:36Z

We could switch from certificate_bundle to auth_bundle but that's an idle thought :)

maybe, with that do we want to change the command from foremanctl certificate-bundle <hostname> to foremanctl auth-bundle <hostname>, or just the role name? i think it boils down to what command name we want to expose to users :)

Given the bundle now has more than certificates, I think changing the command name makes sense.

evgeni · 2026-07-27T09:36:10Z

+      - name: Generate auth bundle on quadlet
        run: |
-          ./foremanctl certificate-bundle proxy.example.com \
+          ./foremanctl auth-bundle proxy.example.com \


This will require updates to

Add containerized proxy installation foreman-documentation#5097

https://github.com/SatelliteQE/robottelo/blob/11ba2027ae74a1f905b6fc9b56e9b13ca1b0b7e5/tests/foreman/foremanctl/test_install_foremanctl.py#L568

SatelliteQE/robottelo#22277
for doc PR, i hope to get this PR in before that 😄

Gauravtalreja1

ACK, Tested with foremanctl-3.0.0.develop-3.20260724120313055342.pr698.143.g745e9f5.el9.noarch 🍏

Steps: deployed Foreman server → generated auth bundle → verified OAuth files in tarball → deployed proxy without --oauth-consumer-key/secret → verified OAuth files extracted on proxy with correct permissions → confirmed proxy registered with Foreman and features refresh works → verified old CLI flags are rejected.

One minor issue found: the fail-early check for missing OAuth files doesn't trigger when using a bundle generated before this PR (old certificate-bundle), since the extraction step excludes files outside certs/ and private/, which isn't properly handled in Ansible stdout as shown below:

TASK [certificates : Extract OAuth credentials from bundle] ***********************************************************************************************************************************
fatal: [localhost]: FAILED! =>
    changed: false
    msg: |-
        Failed to find handler for "/root/.ansible/tmp/ansible-tmp-1785238624.9872594-1828915-110760222717154/source". Make sure the required command to extract the file is installed.
        Command "/usr/bin/gtar" could not handle archive: Unable to list files in the archive: tar (child): bzip2: Cannot exec: No such file or directory
        tar (child): Error is not recoverable: exiting now
        /usr/bin/gtar: Child returned status 2
        /usr/bin/gtar: Error is not recoverable: exiting now

        Command "/usr/bin/unzip" could not handle archive:   End-of-central-directory signature not found.  Either this file is not
          a zipfile, or it constitutes one disk of a multi-part archive.  In the
          latter case the central directory and zipfile comment will be found on
          the last disk(s) of this archive.
        note:  /root/.ansible/tmp/ansible-tmp-1785238624.9872594-1828915-110760222717154/source may be a plain executable, not an archive
        unzip:  cannot find zipfile directory in one of /root/.ansible/tmp/ansible-tmp-1785238624.9872594-1828915-110760222717154/source or
                /root/.ansible/tmp/ansible-tmp-1785238624.9872594-1828915-110760222717154/source.zip, and cannot find /root/.ansible/tmp/ansible-tmp-1785238624.9872594-1828915-110760222717154/source.ZIP, period.

        Command "/usr/bin/gtar" could not handle archive: Unable to list files in the archive: tar (child): zstd: Cannot exec: No such file or directory
        tar (child): Error is not recoverable: exiting now
        /usr/bin/gtar: Child returned status 2
        /usr/bin/gtar: Error is not recoverable: exiting now

        Command "/usr/bin/gtar" found no files in archive. Empty archive files are not supported.
        Command "/usr/bin/gtar" could not handle archive: Unable to list files in the archive: xz: (stdin): File format not recognized
        /usr/bin/gtar: Child returned status 1
        /usr/bin/gtar: Error is not recoverable: exiting now

But this is a minor edge case which I discussed with @arvind4501 ; users won't have old auth-bundles in practice so we can safely ignore this.

LGTM 🍏

stejskalleos · 2026-07-28T13:02:57Z

 Both flags are **not persisted** in foremanctl’s answers file (one-shot).

-### Certificate Bundle for Secondary Systems
+### Auth Bundle for Secondary Systems


In the parameters.md, we still show --foreman-proxy-oauth-consumer-key & --foreman-proxy-oauth-consumer-secret in the Undetermined section. Should we update that as well?

good catch, in which section should we add droped parameters which existed on foreman-installer but not in foremanctl? or just remove them from undetermined

In #532 I used "unmapped" to explicitly call them out. how about that?

perfect, thanks

arvind4501 · 2026-07-28T13:58:41Z

One minor issue found: the fail-early check for missing OAuth files doesn't trigger when using a bundle generated before this PR (old certificate-bundle), since the extraction step excludes files outside certs/ and private/, which isn't properly handled in Ansible stdout as shown below:

IMHO, since bundle generation changes are not released in any version, we won't need to handle upgrades. also i expect generated bundle to have oauth/ in it and we are validating that after extraction

evgeni · 2026-07-28T14:42:19Z

+| `--foreman-proxy-oauth-consumer-key` | OAuth consumer key for Smart Proxy | Not supported |
+| `--foreman-proxy-oauth-consumer-secret` | OAuth consumer secret for Smart Proxy | Not supported |


Technically "Not required, automated", right?

ekohl · 2026-07-28T16:55:52Z

maybe, with that do we want to change the command from foremanctl certificate-bundle <hostname> to foremanctl auth-bundle <hostname>, or just the role name? i think it boils down to what command name we want to expose to users :)

Bike shedding a bit: proxy-identity-bundle perhaps? This makes it clear it's for a proxy, not for the Foreman server itself.

arvind4501 · 2026-07-29T06:07:55Z

maybe, with that do we want to change the command from foremanctl certificate-bundle <hostname> to foremanctl auth-bundle <hostname>, or just the role name? i think it boils down to what command name we want to expose to users :)

Bike shedding a bit: proxy-identity-bundle perhaps? This makes it clear it's for a proxy, not for the Foreman server itself.

when i see proxy-identity-bundle i wonder is there any certificate bundle we need for foreman server(i guess no?). as if no other entity(except proxy) needs auth-bundle we might not need to add proxy-*, also we generate bundle from server, i am happy to update. opinions?

evgeni · 2026-07-29T06:24:53Z

I like the current auth-bundle.
(Also, technically, there is nothing proxy-specific in the bundle, you could use it to setup another Foreman [without Canldepin] too)

ekohl · 2026-07-29T08:42:46Z

That's fair. Given long term I'd love to get rid of the bundle anyway I can live the auth-bundle name.

pr-processor Bot added the Not yet reviewed label Jul 23, 2026

Gauravtalreja1 reviewed Jul 23, 2026

View reviewed changes

Comment thread src/roles/foreman_proxy/tasks/oauth_from_bundle.yml Outdated

Comment thread tests/flavor/foreman-proxy-content/oauth_test.py

Comment thread src/roles/foreman_proxy/tasks/oauth_from_bundle.yml Outdated

Comment thread src/roles/certificate_bundle/tasks/main.yml Outdated

pr-processor Bot removed the Not yet reviewed label Jul 23, 2026

arvind4501 force-pushed the oauth branch 2 times, most recently from 287645f to ae9ce9c Compare July 23, 2026 12:43

ehelms reviewed Jul 23, 2026

View reviewed changes

arvind4501 force-pushed the oauth branch from 2ba9d39 to 400bbb1 Compare July 24, 2026 05:43

evgeni reviewed Jul 24, 2026

View reviewed changes

Comment thread tests/flavor/foreman-proxy-content/oauth_test.py Outdated

evgeni reviewed Jul 24, 2026

View reviewed changes

Comment thread src/roles/certificates/tasks/extract.yml

arvind4501 force-pushed the oauth branch from 6e6f7c7 to 2fe9cdd Compare July 24, 2026 11:23

evgeni reviewed Jul 24, 2026

View reviewed changes

Comment thread src/roles/certificates/tasks/extract.yml Outdated

arvind4501 force-pushed the oauth branch from 2fe9cdd to 3c741fe Compare July 24, 2026 11:59

ehelms reviewed Jul 24, 2026

View reviewed changes

arvind4501 force-pushed the oauth branch from 3c741fe to 57e5dca Compare July 27, 2026 05:38

stejskalleos self-assigned this Jul 27, 2026

evgeni approved these changes Jul 27, 2026

View reviewed changes

arvind4501 mentioned this pull request Jul 27, 2026

Move certificate bundle to auth bundle SatelliteQE/robottelo#22277

Open

Gauravtalreja1 reviewed Jul 27, 2026

View reviewed changes

Comment thread src/playbooks/certificate-bundle/certificate-bundle.yaml

Gauravtalreja1 mentioned this pull request Jul 27, 2026

Support capsule deploy via foremanctl with dedicated test and fixture updates SatelliteQE/robottelo#22278

Open

arvind4501 force-pushed the oauth branch from bab1f19 to f1447ba Compare July 28, 2026 05:38

Arvind Jangir added 4 commits July 28, 2026 15:07

transfer oauth creds as part of certificate bundle

55358e9

add new role for oauth creds

97d2aa1

store and extract oauth credentials to /var/lib/foremanctl/oauth

f10a973

Change certificate-bundle to auth-bundle

41fc3c8

arvind4501 force-pushed the oauth branch from f1447ba to 41fc3c8 Compare July 28, 2026 09:42

Gauravtalreja1 approved these changes Jul 28, 2026

View reviewed changes

stejskalleos reviewed Jul 28, 2026

View reviewed changes

evgeni reviewed Jul 28, 2026

View reviewed changes

update parameters

584f8ec

arvind4501 force-pushed the oauth branch from 9fb7f0a to 584f8ec Compare July 28, 2026 15:02

stejskalleos approved these changes Jul 29, 2026

View reviewed changes

stejskalleos merged commit 99da444 into theforeman:master Jul 29, 2026
27 of 29 checks passed

arvind4501 mentioned this pull request Jul 29, 2026

Add containerized proxy installation theforeman/foreman-documentation#5097

Open

8 tasks

arvind4501 deleted the oauth branch July 30, 2026 06:46

arvind4501 mentioned this pull request Jul 30, 2026

prepare proxy before deployment #644

Closed

2 tasks

		@@ -0,0 +1,27 @@
		---
		- name: Load OAuth credential from certificate bundle - {{ oauth_from_bundle_credential }}

		\| `--foreman-proxy-oauth-consumer-key` \| OAuth consumer key for Smart Proxy \| Not supported \|
		\| `--foreman-proxy-oauth-consumer-secret` \| OAuth consumer secret for Smart Proxy \| Not supported \|

Uh oh!

Conversation

arvind4501 commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why are you introducing these changes? (Problem description, related links)

What are the changes introduced in this pull request?

How to test this pull request

Checklist

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ehelms commented Jul 23, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ehelms commented Jul 24, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

arvind4501 commented Jul 27, 2026

Uh oh!

evgeni commented Jul 27, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Gauravtalreja1 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

arvind4501 Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

arvind4501 commented Jul 28, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ekohl commented Jul 28, 2026

Uh oh!

arvind4501 commented Jul 29, 2026

Uh oh!

evgeni commented Jul 29, 2026

Uh oh!

ekohl commented Jul 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

arvind4501 commented Jul 23, 2026 •

edited

Loading

arvind4501 Jul 28, 2026 •

edited

Loading

ekohl commented Jul 29, 2026 •

edited

Loading