Refs #37601 - Refresh/deploy CA cert on hosts #3193

Lennonka · 2024-08-06T21:40:16Z

This is for refreshing the self-signed Foreman CA cert on hosts.

Redmine issue: #37601

I am okay with my commits getting squashed when you merge this PR.
I am familiar with the contributing guidelines.

Please cherry-pick my commits into: N/A

Foreman 3.12
Foreman 3.11/Katello 4.13
Foreman 3.10/Katello 4.12
Foreman 3.9/Katello 4.11 (Satellite 6.15; orcharhino 6.8/6.9)
Foreman 3.8/Katello 4.10
Foreman 3.7/Katello 4.9 (Satellite 6.14)
Foreman 3.6/Katello 4.8
Foreman 3.5/Katello 4.7 (Satellite 6.13; orcharhino 6.6/6.7)
We do not accept PRs for Foreman older than 3.5.

github-actions · 2024-08-06T21:42:35Z

The PR preview for 3568f89 is available at theforeman-foreman-documentation-preview-pr-3193.surge.sh

The following output files are affected by this PR:

show diff

show diff as HTML

guides/common/modules/con_refreshing-ca-certificates-on-hosts.adoc

guides/common/modules/proc_deploying-a-ca-certificate-on-a-host-manually.adoc

guides/common/modules/proc_renaming-smart-proxy.adoc

guides/common/modules/con_refreshing-the-ca-certificate-on-hosts.adoc

guides/common/modules/proc_deploying-the-ca-certificate-on-a-host-manually.adoc

guides/common/modules/proc_deploying-the-ca-certificate-on-a-host-by-using-ansible-rex.adoc

guides/common/modules/proc_deploying-the-ca-certificate-on-a-host-by-using-script-rex.adoc

guides/common/modules/proc_deploying-the-ca-certificate-on-a-host-manually.adoc

guides/common/modules/snip_verification-ca-set-correctly.adoc

Co-authored-by: Maximilian Kolb <mail@maximilian-kolb.de>

Lennonka · 2024-08-12T21:25:42Z

Rebased.

guides/common/modules/proc_deploying-the-ca-certificate-on-a-host-manually.adoc

guides/common/modules/proc_planning-for-ca-certificate-renewal.adoc

Co-authored-by: Eric Helms <eric.d.helms@gmail.com>

guides/common/modules/proc_deploying-the-ca-certificate-on-a-host-by-using-ansible-rex.adoc

Lennonka · 2024-08-29T14:14:35Z

@ehelms Since you haven't commented on the Planning section, I'm assuming that it's okay.

guides/common/assembly_refreshing-the-ca-certificate-on-hosts.adoc

guides/common/modules/proc_deploying-the-ca-certificate-on-a-host-by-using-ansible-rex.adoc

guides/common/modules/proc_deploying-the-ca-certificate-on-a-host-manually.adoc

ekohl · 2024-08-29T14:51:39Z

guides/common/modules/proc_deploying-the-ca-certificate-on-a-host-by-using-ansible-rex.adoc

+
+[options="nowrap" subs="+quotes,verbatim,attributes"]
+----
+https://_{foreman-example-com}_/unattended/public/foreman_ca_refresh


If you go this route, you must mention that for isolated hosts this must be retrieved via a Smart Proxy (AKA Capsule) because they may not be able to access Foreman.

It would be better to implement a dedicated REX job template and that the user selects. Then the user doesn't need to input any fields and we can rely on REX to properly transfer the script. Even if the certificate expired (because SSH push mode doesn't need them) and when the host is isolated.

The same goes for the Script REX procedure.

It would be better to implement a dedicated REX job template and that the user selects. Then the user doesn't need to input any fields and we can rely on REX to properly transfer the script. Even if the certificate expired (because SSH push mode doesn't need them) and when the host is isolated.
The same goes for the Script REX procedure.

Created a tracker to properly track it: https://projects.theforeman.org/issues/37773

@ekohl with our dropping of API access in the reverse proxy, will isolated hosts have access to this endpoint? do we need to add this endpoint to our list of allowed endpoints?

@ekohl with our dropping of API access in the reverse proxy, will isolated hosts have access to this endpoint? do we need to add this endpoint to our list of allowed endpoints?

We already have the templates module which proxies the unattended templates (also for kickstarts etc). I think the current API should cover it, but not 100% sure. This needs to be verified.

@ekohl Almost. We are missing get "/:kind/:template" do variant to get it working

PR: theforeman/smart-proxy#904

guides/common/modules/con_refreshing-the-ca-certificate-on-hosts.adoc

Lennonka · 2024-09-03T16:51:37Z

@ShimShtein @ehelms Are we happy now?

Lennonka · 2024-09-04T15:03:44Z

Unless there are further comments within the next 24 hours, I suggest we merge it.

maximiliankolb

Thanks Lena, LGTM.

Lennonka · 2024-09-05T17:05:11Z

The fact that it's for self-signed CA certs only seemed important, so I've added it to the titles of the Planning module and the assembly.

@maximiliankolb Can you please give it one more go?

maximiliankolb

Yes, still LGTM.

Co-authored-by: Maximilian Kolb <mail@maximilian-kolb.de> Co-authored-by: Shimon Shtein <sshtein@redhat.com> Co-authored-by: Eric Helms <eric.d.helms@gmail.com>

Lennonka · 2024-09-06T09:04:07Z

Cherry-picked:

dad55b2..4880f92 3.12 -> 3.12

apinnick · 2024-11-04T13:38:03Z

guides/common/modules/proc_deploying-the-ca-certificate-on-a-host-by-using-script-rex.adoc

+.Procedure
+. In the {ProjectWebUI}, navigate to *Monitor* > *Jobs*.
+. Click *Run Job*.
+. From the *Job category* list, select `Commands`.


@Lennonka I realize that this has already been merged. I found this PR when I was trying to figure out the RN for this feature. UI elements and options should be marked up as bold, not with backticks.

pr-processor bot added the Not yet reviewed label Aug 6, 2024

Lennonka force-pushed the refreshing-ca-certs-on-hosts branch from 45d4922 to c0a0590 Compare August 6, 2024 21:42

Lennonka commented Aug 6, 2024

View reviewed changes

guides/common/modules/con_refreshing-ca-certificates-on-hosts.adoc Outdated Show resolved Hide resolved

pr-processor bot removed the Not yet reviewed label Aug 6, 2024

ShimShtein reviewed Aug 7, 2024

View reviewed changes

Lennonka force-pushed the refreshing-ca-certs-on-hosts branch 4 times, most recently from c06e32f to 484a8ab Compare August 8, 2024 18:45

Lennonka changed the title ~~Refs #37601 - Refresh/deploy SSL certs~~ Refs #37601 - Refresh/deploy CA cert on hosts Aug 8, 2024

Lennonka marked this pull request as ready for review August 8, 2024 18:48

Lennonka force-pushed the refreshing-ca-certs-on-hosts branch from 484a8ab to 661e4c0 Compare August 8, 2024 18:55

Lennonka commented Aug 8, 2024

View reviewed changes

guides/common/modules/con_refreshing-the-ca-certificate-on-hosts.adoc Outdated Show resolved Hide resolved

Lennonka commented Aug 8, 2024

View reviewed changes

guides/common/modules/proc_deploying-the-ca-certificate-on-a-host-manually.adoc Show resolved Hide resolved

Lennonka force-pushed the refreshing-ca-certs-on-hosts branch 2 times, most recently from ff20ab3 to 6b5f7e2 Compare August 8, 2024 19:10

maximiliankolb reviewed Aug 9, 2024

View reviewed changes

Lennonka requested a review from ekohl August 12, 2024 21:11

Lennonka and others added 7 commits August 12, 2024 23:24

Add CA cert refreshing on hosts

b65004d

Snippetize verification

52cc5ed

fixup! Add CA cert refreshing on hosts

bd2b01a

fixup! Add CA cert refreshing on hosts

f5aba4f

Prefix commands with hash char

cb907b4

Reduce command output

d9e355c

Co-authored-by: Maximilian Kolb <mail@maximilian-kolb.de>

Use long argument

2e6e896

Lennonka force-pushed the refreshing-ca-certs-on-hosts branch from 44184de to 2e6e896 Compare August 12, 2024 21:25

Lennonka added 2 commits August 13, 2024 17:57

Refactor renewing certs chapter

3a7de44

Use refreshing to update CA cert

686369d

ehelms reviewed Aug 20, 2024

View reviewed changes

guides/common/modules/proc_deploying-the-ca-certificate-on-a-host-manually.adoc Show resolved Hide resolved

ehelms reviewed Aug 20, 2024

View reviewed changes

guides/common/modules/proc_deploying-the-ca-certificate-on-a-host-manually.adoc Outdated Show resolved Hide resolved

ehelms reviewed Aug 20, 2024

View reviewed changes

guides/common/modules/proc_deploying-the-ca-certificate-on-a-host-manually.adoc Show resolved Hide resolved

ehelms reviewed Aug 20, 2024

View reviewed changes

guides/common/modules/proc_planning-for-ca-certificate-renewal.adoc Outdated Show resolved Hide resolved

Lennonka mentioned this pull request Aug 26, 2024

Configure host for global registration #3242

Merged

10 tasks

Add a missing article

2691633

Co-authored-by: Eric Helms <eric.d.helms@gmail.com>

Lennonka commented Aug 29, 2024

View reviewed changes

guides/common/modules/proc_deploying-the-ca-certificate-on-a-host-by-using-ansible-rex.adoc Outdated Show resolved Hide resolved

Snippetize replace FQDN

0d642e7

ekohl reviewed Aug 29, 2024

View reviewed changes

ekohl requested changes Aug 29, 2024

View reviewed changes

pr-processor bot added the Waiting on contributor Requires an action from the author label Aug 29, 2024

Incorporate suggestions from review

8c97d53

pr-processor bot added Needs re-review and removed Waiting on contributor Requires an action from the author labels Sep 2, 2024

Lennonka commented Sep 2, 2024

View reviewed changes

guides/common/modules/con_refreshing-the-ca-certificate-on-hosts.adoc Outdated Show resolved Hide resolved

pr-processor bot removed the Needs re-review label Sep 2, 2024

Incorporate suggestions from review

8a8ba3c

maximiliankolb approved these changes Sep 5, 2024

View reviewed changes

Add self-signed to module titles

3568f89

maximiliankolb approved these changes Sep 6, 2024

View reviewed changes

Lennonka merged commit 69b0498 into theforeman:master Sep 6, 2024
9 checks passed

Lennonka deleted the refreshing-ca-certs-on-hosts branch September 6, 2024 09:03

Lennonka added a commit that referenced this pull request Sep 6, 2024

Refs #37601 - Refresh/deploy CA cert on hosts (#3193)

4880f92

Co-authored-by: Maximilian Kolb <mail@maximilian-kolb.de> Co-authored-by: Shimon Shtein <sshtein@redhat.com> Co-authored-by: Eric Helms <eric.d.helms@gmail.com>

Lennonka mentioned this pull request Oct 2, 2024

Add missing step to update RHSM cert #3342

Merged

10 tasks

apinnick reviewed Nov 4, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Refs #37601 - Refresh/deploy CA cert on hosts #3193

Refs #37601 - Refresh/deploy CA cert on hosts #3193

Lennonka commented Aug 6, 2024 •

edited

Loading

github-actions bot commented Aug 6, 2024 •

edited

Loading

Lennonka commented Aug 12, 2024

Lennonka commented Aug 29, 2024

ekohl Aug 29, 2024

ShimShtein Aug 29, 2024

ehelms Aug 29, 2024

ekohl Aug 29, 2024

ShimShtein Sep 2, 2024

ShimShtein Sep 2, 2024

Lennonka commented Sep 3, 2024

Lennonka commented Sep 4, 2024

maximiliankolb left a comment

Lennonka commented Sep 5, 2024

maximiliankolb left a comment

Lennonka commented Sep 6, 2024

apinnick Nov 4, 2024 •

edited

Loading

Refs #37601 - Refresh/deploy CA cert on hosts #3193

Refs #37601 - Refresh/deploy CA cert on hosts #3193

Conversation

Lennonka commented Aug 6, 2024 • edited Loading

github-actions bot commented Aug 6, 2024 • edited Loading

Lennonka commented Aug 12, 2024

Lennonka commented Aug 29, 2024

ekohl Aug 29, 2024

Choose a reason for hiding this comment

ShimShtein Aug 29, 2024

Choose a reason for hiding this comment

ehelms Aug 29, 2024

Choose a reason for hiding this comment

ekohl Aug 29, 2024

Choose a reason for hiding this comment

ShimShtein Sep 2, 2024

Choose a reason for hiding this comment

ShimShtein Sep 2, 2024

Choose a reason for hiding this comment

Lennonka commented Sep 3, 2024

Lennonka commented Sep 4, 2024

maximiliankolb left a comment

Choose a reason for hiding this comment

Lennonka commented Sep 5, 2024

maximiliankolb left a comment

Choose a reason for hiding this comment

Lennonka commented Sep 6, 2024

apinnick Nov 4, 2024 • edited Loading

Choose a reason for hiding this comment

Lennonka commented Aug 6, 2024 •

edited

Loading

github-actions bot commented Aug 6, 2024 •

edited

Loading

apinnick Nov 4, 2024 •

edited

Loading