Remove instructions to place GCE key in /etc/foreman

[ekohl]

What changes are you introducing?

Remove the instructions to place the key in /etc/foreman.

Why are you introducing these changes? (Explanation, links to references, issues, etc.)

Hammer uploads the key to Foreman (just like in the UI procedure) and never read again. This means there's no point in storing the file in /etc/foreman with specific permissions.

It was introduced in 40b1180 (#1949).

Anything else to add? (Considerations, potential downsides, alternative solutions you have explored, etc.)

I changed the Hammer command to run as root for two reasons: the scp command also uses root and the installer sets up Hammer for root by default. 1137d3a changed it to non-root and this goes against that.

An alternative is to change the instruction to a prerequisite to have Hammer set up and the key file present. Then you only need to list the Hammer command.

Checklists

• I am okay with my commits getting squashed when you merge this PR.
• I am familiar with the contributing guidelines.

Please cherry-pick my commits into:

• Foreman 3.14/Katello 4.16
• Foreman 3.13/Katello 4.15 (EL9 only)
• Foreman 3.12/Katello 4.14 (Satellite 6.16; orcharhino 7.2 on EL9 only)
• Foreman 3.11/Katello 4.13 (orcharhino 6.11 on EL8 only; orcharhino 7.0 on EL8+EL9; orcharhino 7.1 with Leapp)
• Foreman 3.10/Katello 4.12
• Foreman 3.9/Katello 4.11 (Satellite 6.15; orcharhino 6.8/6.9/6.10)
• Foreman 3.8/Katello 4.10
• Foreman 3.7/Katello 4.9 (Satellite 6.14)
• We do not accept PRs for Foreman older than 3.7.

[github-actions]

The PR preview for a759109 is available at theforeman-foreman-documentation-preview-pr-3841.surge.sh

The following output files are affected by this PR:

• Provisioning_Hosts/index-foreman-deb.html
• Provisioning_Hosts/index-foreman-el.html
• Provisioning_Hosts/index-katello.html
• Provisioning_Hosts/index-orcharhino.html
• Provisioning_Hosts/index-satellite.html

show diff

show diff as HTML

[maximiliankolb]

One instance of "GCE_KEY" in the rendered docs is not italic:

You might need double underscores. @ekohl

[ekohl]

@maximiliankolb did you have a look at my thoughts on whether we need the scp command at all and the run hammer as root or non-root option?

[maximiliankolb]

@maximiliankolb did you have a look at my thoughts on whether we need the scp command at all and the run hammer as root or non-root option?

I had a glance and did not really have any input on it.

On second though: Maybe we should make it more explicit by prefixing the file name with /root/? This would indicate that a) the key is in the home dir of the root user and therefore not readable by others, and b) that you need to run the Hammer CLI command as root.

[ekohl]

Should we drop the scp instruction and make it a prerequisite? Perhaps also add a recommendation to remove the file after uploading it?

[maximiliankolb]

Maybe a prerequisite to create the JSON file on *.google.com and then in the procedure to either upload it via browser or scp it to Foreman Server?

[ekohl]

Perhaps maybe this is good enough now and we can iterate on it when we feel the need to?

[maximiliankolb]

@ekohl This suggestion is still open: #3841 (comment) But I can also look into this after merging this PR.

[Lennonka]

I'm wondering if we could suggest an alternative path to the user that would promote a good practice where to put the key. Consider this optional for this PR.

[Lennonka]

And I think it might be a good idea for some to test the new procedure.

[maximiliankolb]

triage: kindly asking for a test from team rocket. cc @Lennonka

[ekohl]

I'm wondering if we could suggest an alternative path to the user that would promote a good practice where to put the key. Consider this optional for this PR.

I'd prefer if others can take over. This PR was more of an out-of-hand bug report.

Some notes, in case it wasn't clear. Perhaps we can add a step to remove the key afterwards because it's not used. That's the whole point of this PR: it's only read by Hammer and then uploaded to Foreman where it's stored in the database.

This also means the user can run the Hammer command from their own desktop (if they have Hammer installed & configured). They can drop the scp command too then.

[Lennonka]

Oh, I missed that. Thank you. Adding a step to remove the key would make it clearer.

[Lennonka]

In that case, the location of the key is irrelevant and this probably doesn't need testing.

[Lennonka]

@ekohl Friendly reminder to add the step to remove the key

[ekohl]

I've dropped the scp step.