Validate required deploy-proxy connection options

[jakduch]

Why are you introducing these changes? (Problem description, related links)

deploy-proxy currently starts the playbook without a Foreman FQDN and validates a missing or invalid authentication bundle only after unrelated deployment work has begun. The bundle is required for the first deployment, but must remain optional for subsequent convergent runs once the proxy authentication state exists.

Fixes #803
Fixes #614

What are the changes introduced in this pull request?

• require an explicit or persisted --foreman-fqdn at the CLI boundary
• add an early proxy-auth validation role before pre-install work
• reject a provided bundle path that does not exist on the control node
• require a bundle only while the target proxy authentication files are absent
• preserve bundle-free repeated deployments and restores after initialization
• add parser and executable Ansible regression coverage for every path

How to test this pull request

• /tmp/foremanctl-846-venv/bin/python -m pytest --noconftest tests/unit/deploy_proxy_test.py -v
• /tmp/foremanctl-846-venv/bin/ruff check tests/unit/deploy_proxy_test.py
• run ansible-lint on src/roles/validate_proxy_auth

Checklist

• Tests added/updated
• Documentation updated (not applicable; the existing parameter contract is now enforced)

This pull request was created with assistance from OpenAI Codex.

[coderabbitai]

Warning

Review limit reached

Next included review available in 43 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Advanced

Run ID: 416b51c2-50be-4cf5-8431-18b1358ce0b8

📥 Commits

Reviewing files that changed from the base of the PR and between 6c79648 and 2037fd2.

📒 Files selected for processing (5)

• src/playbooks/deploy-proxy/deploy-proxy.yaml
• src/playbooks/deploy-proxy/metadata.obsah.yaml
• src/roles/validate_proxy_auth/defaults/main.yml
• src/roles/validate_proxy_auth/tasks/main.yml
• tests/unit/deploy_proxy_test.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[jakduch]

The two early CI failures are unrelated dependency-download failures, before any deployment or changed validation logic ran:

• core FIPS/CentOS 9: Ansible Galaxy failed with Temporary failure in name resolution while installing the forklift dependency set
• proxy FIPS/CentOS 10: Ansible Galaxy failed with Connection reset by peer while downloading community.crypto

The later missing forklift sos_report role in each log is only a consequence of the incomplete dependency setup. I will rerun the failed jobs once the matrix finishes.

[jakduch]

The failing deployment jobs are caused by the shared development-memory issue, not by the proxy-option validation: Candlepin is killed by the OOM killer. #865 contains the fix and has passed the complete CI matrix.

[ehelms]

A couple of ideas before we have to go this route which is not my favorite way to validate input parameters:

• Did you look into a way to support this in Obsah as a parameter validation?
• Did you consider using the installed flag to identify the situation? (https://github.com/theforeman/foremanctl/blob/master/src/roles/post_install/tasks/main.yaml#L8)

[jakduch]

Yes, --foreman-fqdn is already handled by the Obsah required_one_of constraint. --auth-bundle cannot be unconditionally required because later runs use the persisted authentication state. I replaced the per-file probe with the existing .installed flag in 344ee47: an initial deployment still requires the bundle, while an initialized proxy does not. All eight focused tests pass.