remove superfluous --certs-update-server option

[dschlenk]

This option is both unnecessary and causes the command to fail

• I am okay with my commits getting squashed when you merge this PR.
• I am familiar with the contributing guidelines.

Please cherry-pick my commits into:

• Foreman 3.11/Katello 4.13
• Foreman 3.10/Katello 4.12
• Foreman 3.9/Katello 4.11 (Satellite 6.15; orcharhino 6.8/6.9)
• Foreman 3.8/Katello 4.10
• Foreman 3.7/Katello 4.9 (Satellite 6.14)
• Foreman 3.6/Katello 4.8
• Foreman 3.5/Katello 4.7 (Satellite 6.13; orcharhino 6.6/6.7)
• We do not accept PRs for Foreman older than 3.5.

[github-actions]

The PR preview for d13b5a9 is available at theforeman-foreman-documentation-preview-pr-3136.surge.sh

The following output files are affected by this PR:

• Installing_Proxy/index-katello.html
• Installing_Proxy/index-satellite.html

show diff

show diff as HTML

[ehelms]

@dschlenk Do you have the error handy?

[ekohl]

Do you have a specific error message when you see it fail?

Looking at the code (https://github.com/theforeman/foreman-installer/blob/e4fc6826b87177e7629258ea8b0499ebc0b559ea/hooks/pre/20-certs_update.rb#L7-L26) I can imagine it fails if the build directory doesn't exist yet.

Having said that, I've been wanting to get rid of the whole parameter anyway. IMHO our code should detect if it needs an update and behave accordingly. It's always been a hack, but I don't know if our code is now robust enough to not need it anymore.

The way it works is that we force a generation if the update file exists and afterwards remove it:
https://github.com/theforeman/puppet-certs/blob/94b2b3ecf3a2365f8db2ae965c84b3d2462359bc/lib/puppet/provider/katello_ssl_tool.rb#L43
https://github.com/theforeman/puppet-certs/blob/94b2b3ecf3a2365f8db2ae965c84b3d2462359bc/lib/puppet/provider/katello_ssl_tool.rb#L37

It looks like we simply look for the existence of the files, not the actual content.

So I'd say it's safe to drop in this procedure.

And we can make the code more robust: theforeman/foreman-installer#952

[dschlenk]

@ehelms yup:

/usr/share/ruby/fileutils.rb:1150:in `initialize': No such file or directory @ rb_sysopen - /root/ssl-build/<fqdn>/<fqdn>-apache.update (Errno::ENOENT)
        from /usr/share/ruby/fileutils.rb:1150:in `open'
        from /usr/share/ruby/fileutils.rb:1150:in `rescue in block in touch'
        from /usr/share/ruby/fileutils.rb:1146:in `block in touch'
        from /usr/share/ruby/fileutils.rb:1144:in `each'
        from /usr/share/ruby/fileutils.rb:1144:in `touch'
        from /usr/share/foreman-installer/katello-certs/hooks/pre/20-certs_update.rb:13:in `mark_for_update'
        from /usr/share/foreman-installer/katello-certs/hooks/pre/20-certs_update.rb:24:in `block (4 levels) in load'
        from /usr/share/gems/gems/kafo-7.4.0/lib/kafo/hooking.rb:36:in `instance_eval'
        from /usr/share/gems/gems/kafo-7.4.0/lib/kafo/hooking.rb:36:in `block (4 levels) in load'
        from /usr/share/gems/gems/kafo-7.4.0/lib/kafo/hook_context.rb:19:in `instance_eval'
        from /usr/share/gems/gems/kafo-7.4.0/lib/kafo/hook_context.rb:19:in `execute'
        from /usr/share/gems/gems/kafo-7.4.0/lib/kafo/hooking.rb:67:in `block in execute'
        from /usr/share/gems/gems/kafo-7.4.0/lib/kafo/hooking.rb:65:in `each'
        from /usr/share/gems/gems/kafo-7.4.0/lib/kafo/hooking.rb:65:in `execute'
        from /usr/share/gems/gems/kafo-7.4.0/lib/kafo/kafo_configure.rb:488:in `run_installation'
        from /usr/share/gems/gems/kafo-7.4.0/lib/kafo/kafo_configure.rb:220:in `execute'
        from /usr/share/gems/gems/clamp-1.3.2/lib/clamp/command.rb:66:in `run'
        from /usr/share/gems/gems/kafo-7.4.0/lib/kafo/kafo_configure.rb:184:in `run'
        from /usr/share/gems/gems/clamp-1.3.2/lib/clamp/command.rb:140:in `run'
        from /usr/share/gems/gems/kafo-7.4.0/lib/kafo/kafo_configure.rb:54:in `run'
        from /usr/sbin/foreman-proxy-certs-generate:54:in `<main>'
/usr/share/ruby/fileutils.rb:1147:in `utime': No such file or directory @ apply2files - /root/ssl-build/<fqdn>/<fqdn>.com-apache.update (Errno::ENOENT)
        from /usr/share/ruby/fileutils.rb:1147:in `block in touch'
        from /usr/share/ruby/fileutils.rb:1144:in `each'
        from /usr/share/ruby/fileutils.rb:1144:in `touch'
        from /usr/share/foreman-installer/katello-certs/hooks/pre/20-certs_update.rb:13:in `mark_for_update'
        from /usr/share/foreman-installer/katello-certs/hooks/pre/20-certs_update.rb:24:in `block (4 levels) in load'
        from /usr/share/gems/gems/kafo-7.4.0/lib/kafo/hooking.rb:36:in `instance_eval'
        from /usr/share/gems/gems/kafo-7.4.0/lib/kafo/hooking.rb:36:in `block (4 levels) in load'
        from /usr/share/gems/gems/kafo-7.4.0/lib/kafo/hook_context.rb:19:in `instance_eval'
        from /usr/share/gems/gems/kafo-7.4.0/lib/kafo/hook_context.rb:19:in `execute'
        from /usr/share/gems/gems/kafo-7.4.0/lib/kafo/hooking.rb:67:in `block in execute'
        from /usr/share/gems/gems/kafo-7.4.0/lib/kafo/hooking.rb:65:in `each'
        from /usr/share/gems/gems/kafo-7.4.0/lib/kafo/hooking.rb:65:in `execute'
        from /usr/share/gems/gems/kafo-7.4.0/lib/kafo/kafo_configure.rb:488:in `run_installation'
        from /usr/share/gems/gems/kafo-7.4.0/lib/kafo/kafo_configure.rb:220:in `execute'
        from /usr/share/gems/gems/clamp-1.3.2/lib/clamp/command.rb:66:in `run'
        from /usr/share/gems/gems/kafo-7.4.0/lib/kafo/kafo_configure.rb:184:in `run'
        from /usr/share/gems/gems/clamp-1.3.2/lib/clamp/command.rb:140:in `run'
        from /usr/share/gems/gems/kafo-7.4.0/lib/kafo/kafo_configure.rb:54:in `run'
        from /usr/sbin/foreman-proxy-certs-generate:54:in `<main>'

FWIW the instructions for a default TLS certificate do not have this option in the corresponding command. The help text for the option is This option will enforce an update of the HTTPS certificates (default: false) which doesn't seem to be something that would be needed if the goal is just building the tarball that the smart proxy will use.

[ehelms]

If we drop this option, and the certs do change, I'm not convinced the new certificates will get deployed into the bundle. I think that is why we always had that option included, to make sure it always ensures the latest version of the custom SSL certificates gets laid down and thus in the bundle.

[dschlenk]

@ehelms the command in the certificate renewal section retains the option.
https://github.com/dschlenk/foreman-documentation/blob/d13b5a9874801be79eb98ba657e7a5a873e7b287/guides/common/modules/proc_renewing-a-custom-ssl-certificate-on-smart-proxy.adoc?plain=1#L29C1-L29C24

[maximiliankolb]

Thanks for your contribution; diff LGTM.

[maximiliankolb]

Merged to "master" and cherry-picked:
9fe90a4..f53b9f2 3.11 -> 3.11
93baffd..63deb1f 3.10 -> 3.10
6800b51..85876cc 3.9 -> 3.9