From ec4826d1f226a23017d38f5a6fb78fb853713f62 Mon Sep 17 00:00:00 2001
From: "Eric D. Helms" <ericdhelms@gmail.com>
Date: Tue, 6 Aug 2024 12:50:12 -0400
Subject: [PATCH] Make deploying client bundle certificate optional

---
 manifests/foreman_proxy.pp            |  3 +-
 spec/acceptance/foreman_proxy_spec.rb | 53 +++++++++++++++++++++++++++
 2 files changed, 55 insertions(+), 1 deletion(-)

diff --git a/manifests/foreman_proxy.pp b/manifests/foreman_proxy.pp
index d7b2157e..fe64a8e9 100644
--- a/manifests/foreman_proxy.pp
+++ b/manifests/foreman_proxy.pp
@@ -32,6 +32,7 @@
   String $owner = 'root',
   Stdlib::Filemode $private_key_mode = '0440',
   Stdlib::Filemode $public_key_mode = '0444',
+  Enum['present', 'absent'] $client_bundle_ensure = 'present',
 ) inherits certs {
   $proxy_cert_name = "${hostname}-foreman-proxy"
   $foreman_proxy_client_cert_name = "${hostname}-foreman-proxy-client"
@@ -152,7 +153,7 @@
     }
 
     cert_key_bundle { $foreman_proxy_ssl_client_bundle:
-      ensure       => present,
+      ensure       => $client_bundle_ensure,
       certificate  => "${certs::ssl_build_dir}/${hostname}/${foreman_proxy_client_cert_name}.crt",
       private_key  => "${certs::ssl_build_dir}/${hostname}/${foreman_proxy_client_cert_name}.key",
       force_pkcs_1 => true,
diff --git a/spec/acceptance/foreman_proxy_spec.rb b/spec/acceptance/foreman_proxy_spec.rb
index 17d670e1..8b750dd3 100644
--- a/spec/acceptance/foreman_proxy_spec.rb
+++ b/spec/acceptance/foreman_proxy_spec.rb
@@ -272,4 +272,57 @@ class { 'certs::foreman_proxy':
       it { should_not exist }
     end
   end
+
+  context 'with include_client_bundle absent' do
+    before(:context) do
+      on default, 'rm -rf /root/ssl-build /etc/foreman-proxy /etc/pki/katello'
+    end
+
+    it_behaves_like 'an idempotent resource' do
+      let(:manifest) do
+        <<-PUPPET
+          file { '/etc/foreman-proxy':
+            ensure => directory,
+          }
+
+          group { 'foreman-proxy':
+            ensure => present,
+            system => true,
+          }
+
+          class { 'certs::foreman_proxy':
+            client_bundle_ensure => 'absent',
+          }
+        PUPPET
+      end
+    end
+
+    describe file('/etc/foreman-proxy/ssl_cert.pem') do
+      it { should exist }
+    end
+
+    describe file('/etc/foreman-proxy/ssl_key.pem') do
+      it { should exist }
+    end
+
+    describe file('/etc/foreman-proxy/ssl_ca.pem') do
+      it { should exist }
+    end
+
+    describe file('/etc/foreman-proxy/foreman_ssl_cert.pem') do
+      it { should exist }
+    end
+
+    describe file('/etc/foreman-proxy/foreman_ssl_key.pem') do
+      it { should exist }
+    end
+
+    describe file('/etc/foreman-proxy/foreman_ssl_ca.pem') do
+      it { should exist }
+    end
+
+    describe file("/etc/pki/katello/private/#{fqdn}/#{fqdn}-foreman-proxy-client-bundle.pem") do
+      it { should_not exist }
+    end
+  end
 end