foremanctl deploy --certificate-cname

Author: stejskalleos

tests/foreman/installer/test_install_foremanctl.py

@@ -165,3 +165,59 @@ def test_foremanctl_deploy_reset_parameters(module_sat_ready_rhel):
     parameters_file = module_sat_ready_rhel.load_remote_yaml_file(FOREMANCTL_PARAMETERS_FILE)
     assert 'foreman_puma_workers' not in parameters_file
     assert 'pulp_worker_count' not in parameters_file
+
+
+@pytest.mark.parametrize('module_sat_ready_rhel', ['default'], indirect=True)
+def test_foremanctl_deploy_certificate_cname(module_sat_ready_rhel):
+    """Verify foremanctl deploy --certificate-cname adds CNAME to server certificate SANs
+
+    :id: a5390e11-0e48-4a13-951f-749df8716e0c
+
+    :steps:
+        1. Run foremanctl deploy --certificate-cname with an additional DNS name
+        2. Verify the CNAME is persisted in the foremanctl parameters file
+        3. Inspect the server certificate for the CNAME in Subject Alternative Names
+        4. Add a /etc/hosts entry so the CNAME resolves locally
+        5. Verify HTTPS connectivity using the CNAME with the self-signed CA
+
+    :expectedresults:
+        1. foremanctl deploy completes successfully
+        2. certificates_cnames contains the CNAME in the parameters file
+        3. The server certificate SAN includes DNS:<cname>
+        4. HTTPS request via the CNAME returns HTTP 200 without certificate errors
+    """
+    satellite = module_sat_ready_rhel
+    cname = f'cname.{satellite.hostname}'
+
+    result = satellite.execute(
+        f'foremanctl deploy --certificate-cname {cname}',
+        timeout='10m',
+    )
+    assert result.status == 0, (
+        f'foremanctl deploy with --certificate-cname failed:\n{result.stderr}'
+    )
+
+    parameters_file = satellite.load_remote_yaml_file(FOREMANCTL_PARAMETERS_FILE)
+    assert cname in parameters_file.certificates_cnames
+
+    result = satellite.execute(
+        'openssl x509 -in /root/certificates/certs/$(hostname -f).crt -noout -ext subjectAltName'
+    )
+    assert result.status == 0, f'Failed to read server certificate:\n{result.stderr}'
+    assert f'DNS:{cname}' in result.stdout, (
+        f'CNAME {cname} not found in server certificate SANs:\n{result.stdout}'
+    )
+
+    satellite.execute(
+        f'grep -q {cname} /etc/hosts '
+        f'|| echo "$(hostname -I | awk \'{{print $1}}\') {cname}" >> /etc/hosts'
+    )
+
+    result = satellite.execute(
+        f'curl -s -o /dev/null -w "%{{http_code}}" '
+        f'--cacert /root/certificates/certs/ca.crt '
+        f'https://{cname}/users/login'
+    )
+    assert result.stdout.strip() == '200', (
+        f'HTTPS request to {cname} failed with status {result.stdout.strip()}'
+    )