add rex feature

Author: evgeni

.github/workflows/test.yml

@@ -117,9 +117,9 @@ jobs:
       - name: Add optional feature - foreman-proxy
         run: |
           ./foremanctl deploy --add-feature foreman-proxy
-      - name: Add optional features - azure-rm, google
+      - name: Add optional features - azure-rm, google and remote-execution
         run: |
-          ./foremanctl deploy --add-feature azure-rm --add-feature google
+          ./foremanctl deploy --add-feature azure-rm --add-feature google --add-feature remote-execution
       - name: Run tests
         run: |
           ./forge test --pytest-args="--certificate-source=${{ matrix.certificate_source }} --database-mode=${{ matrix.database }}"
@@ -226,9 +226,9 @@ jobs:
       - name: Add optional feature - foreman-proxy
         run: |
           ./foremanctl deploy --add-feature foreman-proxy
-      - name: Add optional features - azure-rm, google
+      - name: Add optional features - azure-rm, google and remote-execution
         run: |
-          ./foremanctl deploy --add-feature azure-rm --add-feature google
+          ./foremanctl deploy --add-feature azure-rm --add-feature google --add-feature remote-execution
       - name: Stop services
         run:
           vagrant ssh quadlet -- sudo systemctl stop foreman.target

src/features.yaml

@@ -11,3 +11,15 @@ azure-rm:
   description: Azure Resource Manager plugin for Foreman
   foreman:
     plugin_name: foreman_azure_rm
+remote-execution:
+  description: Remote Execution plugin for Foreman
+  foreman:
+    plugin_name: foreman_remote_execution
+  foreman_proxy:
+    plugin_name: remote_execution_ssh
+  dependencies:
+    - dynflow
+dynflow:
+  internal: true
+  foreman_proxy:
+    plugin_name: dynflow

src/roles/foreman_proxy/tasks/feature/remote_execution_ssh.yaml

@@ -0,0 +1,36 @@
+---
+- name: Create SSH Key
+  community.crypto.openssh_keypair:
+    path: "/root/foreman-proxy-ssh"
+
+- name: Create SSH Key podman secret
+  containers.podman.podman_secret:
+    state: present
+    name: foreman-proxy-remote_execution_ssh-ssh-key
+    path: "/root/foreman-proxy-ssh"
+  notify:
+    - Restart Foreman Proxy
+    - Refresh Foreman Proxy
+
+- name: Create SSH Pub podman secret
+  containers.podman.podman_secret:
+    state: present
+    name: foreman-proxy-remote_execution_ssh-ssh-pub
+    path: "/root/foreman-proxy-ssh.pub"
+  notify:
+    - Restart Foreman Proxy
+    - Refresh Foreman Proxy
+
+- name: Mount SSH secrets
+  ansible.builtin.copy:
+    dest: /etc/containers/systemd/foreman-proxy.container.d/remote_execution_ssh-keys.conf
+    content: |
+      [Container]
+      Secret=foreman-proxy-remote_execution_ssh-ssh-key,type=mount,target=/usr/share/foreman-proxy/.ssh/id_rsa_foreman_proxy
+      Secret=foreman-proxy-remote_execution_ssh-ssh-pub,type=mount,target=/usr/share/foreman-proxy/.ssh/id_rsa_foreman_proxy.pub
+    mode: '0644'
+    owner: root
+    group: root
+  notify:
+    - Restart Foreman Proxy
+    - Refresh Foreman Proxy

src/roles/foreman_proxy/templates/settings.d/dynflow.yml.j2

@@ -0,0 +1,10 @@
+---
+:enabled: {{ feature_enabled }}
+:database:
+
+# Require a valid cert to access Dynflow console
+# :console_auth: true
+
+# Maximum age of execution plans to keep before having them cleaned
+# by the execution plan cleaner (in seconds), defaults to 30 minutes
+# :execution_plan_cleaner_age: 1800

src/roles/foreman_proxy/templates/settings.d/remote_execution_ssh.yml.j2

@@ -0,0 +1,46 @@
+---
+:enabled: {{ feature_enabled }}
+:ssh_identity_key_file: '~/.ssh/id_rsa_foreman_proxy'
+:local_working_dir: '/var/tmp'
+:remote_working_dir: '/var/tmp'
+:socket_working_dir: '/var/tmp'
+# :kerberos_auth: false
+
+# :cockpit_integration: true
+
+# Mode of operation, one of ssh, pull, pull-mqtt
+:mode: ssh
+
+# Enables the use of SSH certificate for smart proxy authentication
+# The file should contain an SSH CA public key that the SSH public key of smart proxy is signed by
+# :ssh_user_ca_public_key_file:
+
+# Enables the use of SSH host certificates for host authentication
+# The file should contain a list of trusted SSH CA authorities that the host certs can be signed by
+# Example file content: @cert-authority * <SSH CA public key>
+# :ssh_ca_known_hosts_file:
+
+# Defines how often (in seconds) should the runner check
+# for new data leave empty to use the runner's default
+# :runner_refresh_interval: 1
+
+# Defines the verbosity of logging coming from ssh command
+# one of :debug, :info, :error, :fatal
+# must be lower than general log level
+# :ssh_log_level: error
+
+# Remove working directories on job completion
+# :cleanup_working_dirs: true
+
+# MQTT configuration, need to be set if mode is set to pull-mqtt
+# :mqtt_broker: localhost
+# :mqtt_port: 1883
+
+# Use of SSL can be forced either way by explicitly setting mqtt_tls setting. If
+# unset, SSL gets used if smart-proxy's foreman_ssl_cert, foreman_ssl_key and
+# foreman_ssl_ca settings are set available.
+# :mqtt_tls:
+
+# The notification is sent over mqtt every $mqtt_resend_interval seconds, until
+# the job is picked up by the host or cancelled
+# :mqtt_resend_interval: 900

tests/client_test.py

@@ -1,10 +1,19 @@
 def test_foreman_content_view(client_environment, activation_key, organization, foremanapi, client):
     client.run('dnf install -y subscription-manager')
-    rcmd = foremanapi.create('registration_commands', {'organization_id': organization['id'], 'insecure': True, 'activation_keys': [activation_key['name']]})
+    rcmd = foremanapi.create('registration_commands', {'organization_id': organization['id'], 'insecure': True, 'activation_keys': [activation_key['name']], 'force': True})
     client.run_test(rcmd['registration_command'])
     client.run('subscription-manager repos --enable=*')
     client.run_test('dnf install -y bear')
     assert client.package('bear').is_installed
     client.run('dnf remove -y bear')
     client.run('subscription-manager unregister')
     client.run('subscription-manager clean')
+
+def test_foreman_rex(client_environment, activation_key, organization, foremanapi, client, client_fqdn):
+    client.run('dnf install -y subscription-manager')
+    rcmd = foremanapi.create('registration_commands', {'organization_id': organization['id'], 'insecure': True, 'activation_keys': [activation_key['name']], 'force': True})
+    client.run_test(rcmd['registration_command'])
+    job = foremanapi.create('job_invocations', {'feature': 'run_script', 'inputs': {'command': 'uptime'}, 'search_query': f'name = {client_fqdn}', 'targeting_type': 'static_query'})
+    task = foremanapi.wait_for_task(job['task'])
+    assert task['result'] == 'success'
+    foremanapi.delete('hosts', {'id': client_fqdn})

tests/foreman_proxy_test.py

@@ -7,6 +7,8 @@ def test_foreman_proxy_features(server, certificates, server_fqdn):
     assert cmd.succeeded
     features = json.loads(cmd.stdout)
     assert "logs" in features
+    assert "script" in features
+    assert "dynflow" in features
 
 def test_foreman_proxy_service(server):
     foreman_proxy = server.service("foreman-proxy")