pass in the configured DB ca (if any) to the container by evgeni · Pull Request #345 · theforeman/foremanctl

evgeni · 2025-12-02T14:38:50Z

No description provided.

ehelms · 2025-12-02T15:00:50Z

This looks related to #141 but is not an aspect I have incorporated. I was wanting to get in a version of remote database testing and then harden it with more of the options.

evgeni · 2025-12-02T15:03:05Z

It is, @Gauravtalreja1 ran into this when testing ext db stuff

src/roles/foreman/tasks/main.yaml

ehelms · 2025-12-05T13:30:06Z

src/roles/candlepin/tasks/main.yml

+  containers.podman.podman_secret:
+    state: present
+    name: candlepin-db-ca
+    data: "{{ lookup('ansible.builtin.file', candlepin_database_ssl_ca) if candlepin_database_ssl_ca else 'empty' }}"


This is creating an empty secret if there is no database SSL cert? Why not use a when conditional on the sercret?

Because then I need to also conditionally mount it, and that's painful ;)

I get that, I worry about this being a red herring while debugging.

what kind of red herring? the file being present?

Correct. The file / secret being present but empty raises the "should it be empty? or is it accidentally empty?"

That's why the string is "empty", or should I do "this secret was intentionally left blank"?

ehelms · 2026-02-18T13:30:04Z

What else do you think is needed to take it out of draft?

evgeni · 2026-02-18T13:42:00Z

I wanted to write up some tests to validate it.

evgeni · 2026-02-19T08:09:11Z

.github/workflows/test.yml

          - certificate_source: default
            security: none
            database: external
+          - certificate_source: default
+            security: none
+            database: externalssl


I personally think that users should never run external db without SSL, but I know that today we document and support that, so I added this as another matrix entry instead of repurposing the external one. But do we really need to test both?

If you are proposing that we test external database only with TLS - I agree.

Correct, that's what I wanted to say

Do we intend to drop support for external DB without SSL altogether? If not, we should make sure both cases are covered by tests

I see little chance that non-SSL ext-DB breaks while SSL-enabled continues to work.

and you can still verify that in robotello for formal support, I just don't think it needs to happen here

The internal database scenario should effectively test the non-ssl scenario for us since it's doing the same style connection and handling.

yeah.

I've now pushed a separate commit, flipping the setup to "only ssl" -- we can still drop it if Gaurav strongly disagrees :)

evgeni · 2026-02-19T13:26:19Z

@ehelms look, no draft!

.github/workflows/test.yml

development/playbooks/remote-database/metadata.obsah.yaml

src/roles/check_database_connection/tasks/check.yaml

Gauravtalreja1 · 2026-03-12T08:49:02Z

.github/workflows/test.yml

      - name: Run deployment
        run: |
-          ./foremanctl deploy --certificate-source=${{ matrix.certificate_source }} ${{ matrix.database == 'external' && '--database-mode=external --database-host=database.example.com' || '' }}  --foreman-initial-admin-password=changeme --tuning development
+          ./foremanctl deploy --certificate-source=${{ matrix.certificate_source }} ${{ matrix.database == 'external' && '--database-mode=external --database-host=database.example.com --database-ssl-ca $(pwd)/.var/lib/foremanctl/db-ca.crt --database-ssl-mode verify-full' || '' }} --foreman-initial-admin-password=changeme --tuning development


is this path $(pwd)/.var/.. to ssl-ca correct OR should it be $(pwd)/var/..?
And, I couldn't find, where do we generate this cert for these test?

It's correct, as that's the local, non-root path for foremanctl to store things in (as used in CI)

The certs are generated by the certificates role that was added to development/playbooks/remote-database/remote-database.yaml and is then copied to the path you see here in the Fetch PostgreSQL SSL CA task in the same playbook.

Gauravtalreja1 · 2026-03-12T08:49:21Z

development/playbooks/remote-database/remote-database.yaml

+  vars:
+    certificates_hostnames:
+      - "{{ ansible_facts['fqdn'] }}"
+    certificates_ca_password: "CHANGEME"


Does this passwd needs to be hardcoded here?

given it's a devel playbook for test only, I see no problem with it being hardcoded

Gauravtalreja1 · 2026-03-12T08:56:20Z

src/roles/candlepin/templates/candlepin.conf.j2

 jpa.config.hibernate.connection.password={{ candlepin_database_password }}
 jpa.config.hibernate.connection.driver_class=org.postgresql.Driver
-jpa.config.hibernate.connection.url=jdbc:postgresql://{{ candlepin_database_host }}:{{ candlepin_database_port }}/{{ candlepin_database_name }}?sslmode={{ candlepin_database_ssl_mode }}{% if candlepin_database_ssl_ca is defined %}&sslrootcert={{ candlepin_database_ssl_ca }}{% endif %}
+jpa.config.hibernate.connection.url=jdbc:postgresql://{{ candlepin_database_host }}:{{ candlepin_database_port }}/{{ candlepin_database_name }}?sslmode={{ candlepin_database_ssl_mode }}{% if candlepin_database_ssl_ca is defined %}&sslrootcert=/etc/candlepin/certs/db-ca.crt{% endif %}


Can we move this path to candlepin role defaults instead of hardcoding it here?

We can, but what would be the benefit? It's a path inside the container that shouldn't be changed by the user.

Or do you mean to make it easier to keep consistent between the config here and the secret mount?

Gauravtalreja1 · 2026-03-12T09:11:22Z

src/roles/foreman/tasks/main.yaml

    state: present
    name: foreman-database-url
-    data: "postgresql://{{ foreman_database_user }}:{{ foreman_database_password }}@{{ foreman_database_host }}:{{ foreman_database_port }}/{{ foreman_database_name }}?pool={{ foreman_database_pool }}&sslmode={{ foreman_database_ssl_mode }}{% if foreman_database_ssl_ca is defined %}&sslrootcert={{ foreman_database_ssl_ca }}{% endif %}" # yamllint disable-line rule:line-length
+    data: "postgresql://{{ foreman_database_user }}:{{ foreman_database_password }}@{{ foreman_database_host }}:{{ foreman_database_port }}/{{ foreman_database_name }}?pool={{ foreman_database_pool }}&sslmode={{ foreman_database_ssl_mode }}{% if foreman_database_ssl_ca is defined %}&sslrootcert=/etc/foreman/db-ca.crt{% endif %}" # yamllint disable-line rule:line-length


Can we move this path to sslrootcert in foreman role defaults instead of hardcoding it here?

same as for candlepin

pr-processor bot added the Not yet reviewed label Dec 2, 2025

evgeni force-pushed the ssldb branch from b1d465d to 5e68ace Compare December 2, 2025 14:48

evgeni force-pushed the ssldb branch from 5e68ace to b2dd049 Compare December 2, 2025 15:01

evgeni force-pushed the ssldb branch 5 times, most recently from f8a1e26 to 1ba7910 Compare December 2, 2025 17:37

evgeni commented Dec 3, 2025

View reviewed changes

src/roles/foreman/tasks/main.yaml Outdated Show resolved Hide resolved

pr-processor bot removed the Not yet reviewed label Dec 3, 2025

evgeni force-pushed the ssldb branch 4 times, most recently from 921e621 to 7355577 Compare December 5, 2025 08:39

ehelms reviewed Dec 5, 2025

View reviewed changes

evgeni force-pushed the ssldb branch from 7355577 to 372e4e2 Compare February 18, 2026 11:13

evgeni force-pushed the ssldb branch 2 times, most recently from 46aeafa to 3a61d77 Compare February 19, 2026 08:06

evgeni commented Feb 19, 2026

View reviewed changes

evgeni force-pushed the ssldb branch 7 times, most recently from 481ca09 to d157f1a Compare February 19, 2026 10:55

evgeni force-pushed the ssldb branch 3 times, most recently from a0572e5 to 9adce9d Compare February 19, 2026 13:12

evgeni marked this pull request as ready for review February 19, 2026 13:26

Gauravtalreja1 reviewed Feb 20, 2026

View reviewed changes

.github/workflows/test.yml Outdated Show resolved Hide resolved

development/playbooks/remote-database/metadata.obsah.yaml Outdated Show resolved Hide resolved

evgeni commented Feb 23, 2026

View reviewed changes

src/roles/check_database_connection/tasks/check.yaml Show resolved Hide resolved

evgeni commented Feb 27, 2026

View reviewed changes

src/roles/check_database_connection/tasks/check.yaml Show resolved Hide resolved

evgeni force-pushed the ssldb branch from fec9325 to 5316bd8 Compare March 2, 2026 13:29

ehelms approved these changes Mar 2, 2026

View reviewed changes

evgeni force-pushed the ssldb branch from 5316bd8 to 01afd69 Compare March 3, 2026 08:46

Gauravtalreja1 reviewed Mar 12, 2026

View reviewed changes

evgeni added 2 commits March 13, 2026 12:56

pass in the configured DB ca (if any) to the container

6f8fc24

Configure SSL for PostgreSQL server if provided

29a4e1a

evgeni force-pushed the ssldb branch from 01afd69 to 90aa961 Compare March 13, 2026 11:56

evgeni added 2 commits March 13, 2026 12:59

deploy remote database for tests with ssl

7e2786d

Copy CA over to the quadlet box

9ae2c8c

evgeni force-pushed the ssldb branch from 90aa961 to 9ae2c8c Compare March 13, 2026 12:00

Conversation

evgeni commented Dec 2, 2025

Uh oh!

ehelms commented Dec 2, 2025

Uh oh!

evgeni commented Dec 2, 2025

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ehelms commented Feb 18, 2026

Uh oh!

evgeni commented Feb 18, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

evgeni Feb 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

evgeni commented Feb 19, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

evgeni Feb 20, 2026 •

edited

Loading