Add certs command

[ehelms]

The idea here is to introduce a command that can stand-alone generate certificates as is done within the installer using the same logic of puppet-certs module. This intentionally does not cover deployment, it simply allows generation of the certificates. This relies upon theforeman/puppet-certs#449 as it introduces a class that makes this process works and avoids the complication that the individual certificate classes create via their params.

The full design idea is to split generation from deployment and allow generation to happen prior to full puppet apply within the installer and allow the installer part to only handle deployment. This will put us a step closer to allowing users to provider their own certificates by standardizing on the set of certificates as inputs where those inputs can come directly from the user or from the self-generated set.

[ehelms]

@evgeni I updated this with updates from #1016

[ehelms]

This requires theforeman/puppet-certs#449 and will remain in draft until it's merged.

[evgeni]

/packit build

[pablomh]

It seems that theforeman/puppet-certs#449 has been already merged for a while.

I've discovered this because while trying to test foremanctl, I've hit:

TASK [foreman_installer_certs : Enable foreman-installer PR 935 Copr repo] *****
Error: : Task failed: Module failed: Chroot rhel-9-x86_64 does not exist in packit/theforeman-foreman-installer-935

[arvind4501]

/packit build

[packit-as-a-service]

Account arvind4501 has no write access nor is author of PR!

[evgeni]

this needed a rebase to get the updated version after branching, which I just did

[evgeni]

/packit build

[ehelms]

@evgeni at this point, do you think we should just merge this?

[evgeni]

Do/will we need this, outside of CI?

[ehelms]

Originally I had some ideas for this use case, but this is largely for CI purposes and testing of migration from foreman-installer to foremanctl. With the change in design in theforeman/foremanctl#421 we could move to a full foreman-installer run instead of fixtures and partial generation of the certificates.

[evgeni]

I'm not opposed in merging this, but we should see that we don't ship it as part of the regular installer package to not confuse (end) users.