Add KEA DHCP provider feature for foreman-proxy by archanaserver · Pull Request #531 · theforeman/foremanctl

archanaserver · 2026-06-01T09:18:28Z

Why are you introducing these changes? (Problem description, related links)

ISC DHCP reached end-of-life in October 2022 and has been removed from RHEL 10. This adds support for KEA DHCP as the replacement.

What are the changes introduced in this pull request?

Add dhcp-kea-external feature definition to src/features.yaml
Create Smart Proxy configuration template dhcp_kea_api.yml.j2
Add default Ansible variables for KEA server connection (localhost:8000, default subnet)
Add integration tests for DHCP KEA feature validation

How to test this pull request

Steps to reproduce:

Verify feature is available: ./foremanctl features | grep dhcp-kea-external
Deploy with KEA DHCP feature enabled: ./foremanctl deploy --add-feature dhcp-kea-external
Verify feature is enabled: ./foremanctl features --list-enabled | grep dhcp-kea-external
Check configuration file was created: podman exec foreman-proxy ls -la /etc/foreman-proxy/settings.d/dhcp_kea_api.yml
Run tests python -m pytest tests/foreman_proxy_test.py::test_dhcp_kea_feature_present -v

Checklist

Tests added/updated (if applicable)
Documentation updated (if applicable)

evgeni · 2026-06-01T09:30:11Z

  description: Power management for bare metal hosts (IPMI, Redfish)
  foreman_proxy:
    plugin_name: bmc
+dhcp-kea-external:


I think the feature should be "dhcp" and then you add a parameter to select which provider to use, with kea being one of the answers

makes way more sense to have a single dhcp feature with a provider parameter

I played with that thought in #532 for the DNS side of things, would love to hear your opinion on the approach I took

evgeni · 2026-06-01T09:31:41Z

 foreman_proxy_bmc_redfish_verify_ssl: true
+
+# KEA DHCP settings (external unmanaged server)
+foreman_proxy_dhcp_kea_server: localhost


What are the chances that localhost is a place where a Kea will actually run (outside of development setups)?

I think we should leave that undef (like in https://github.com/theforeman/foremanctl/pull/523/changes) and force the user to set a sensible value.

evgeni · 2026-06-01T09:35:52Z

+
+:enabled: {{ feature_enabled }}
+:use_provider: dhcp_kea_api
+:server: {{ foreman_proxy_dhcp_kea_server }}


where does this come from? I don't see such an option in https://gitlab.surrey.ac.uk/sm0049/smart-proxy-dhcp-kea-api/

yeah, i was just playing around with few things, needed to look again, the reason i added that in draft but thanks for reviews, also i tryna fix few things with the updated changes.

evgeni · 2026-06-01T09:36:04Z

+:enabled: {{ feature_enabled }}
+:use_provider: dhcp_kea_api
+:server: {{ foreman_proxy_dhcp_kea_server }}
+:kea_url: {{ foreman_proxy_dhcp_kea_url }}


shouldn't this be kea_api_url?

also, we need kea_api_username and kea_api_password

evgeni · 2026-06-01T09:36:10Z

+:use_provider: dhcp_kea_api
+:server: {{ foreman_proxy_dhcp_kea_server }}
+:kea_url: {{ foreman_proxy_dhcp_kea_url }}
+:kea_subnet: {{ foreman_proxy_dhcp_kea_subnet }}


where does this come from? I don't see such an option in https://gitlab.surrey.ac.uk/sm0049/smart-proxy-dhcp-kea-api/

evgeni · 2026-06-01T09:45:36Z

Shall we package https://gitlab.surrey.ac.uk/sm0049/smart-proxy-dhcp-kea-api until we figure out whether we want to merge it into core or not?

archanaserver · 2026-06-02T08:04:21Z

Shall we package https://gitlab.surrey.ac.uk/sm0049/smart-proxy-dhcp-kea-api until we figure out whether we want to merge it into core or not?

Yeah, I was thinking we can package it for now, that will be independent of our decision about potentially merging it into the core later.

stejskalleos · 2026-06-02T12:47:02Z

 foreman_proxy_bmc_redfish_verify_ssl: true
+
+# DHCP settings
+foreman_proxy_dhcp_provider: dhcp_kea_api


Why not just:

Suggested change

foreman_proxy_dhcp_provider: dhcp_kea_api

foreman_proxy_dhcp_provider: dhcp_kea

stejskalleos · 2026-06-02T12:53:45Z

+:kea_api_password: {{ foreman_proxy_dhcp_kea_api_password }}
+{% endif %}
+{% if foreman_proxy_dhcp_kea_managed_subnets is defined and foreman_proxy_dhcp_kea_managed_subnets %}
+:managed_subnets:


There is a definition of subnets in DHCP as well: https://github.com/theforeman/smart-proxy/blob/develop/config/settings.d/dhcp.yml.example

stejskalleos · 2026-06-02T12:55:10Z

+foreman_proxy_dhcp_kea_api_url: "{{ undef(hint='You must specify the KEA API URL') }}"
+foreman_proxy_dhcp_kea_api_username: ""
+foreman_proxy_dhcp_kea_api_password: ""
+foreman_proxy_dhcp_kea_managed_subnets: []


I think this should be:

Suggested change

foreman_proxy_dhcp_kea_managed_subnets: []

foreman_proxy_dhcp_subnets: []

as in https://github.com/theforeman/smart-proxy/blob/develop/config/settings.d/dhcp.yml.example

evgeni · 2026-06-02T12:58:34Z

Shall we package https://gitlab.surrey.ac.uk/sm0049/smart-proxy-dhcp-kea-api until we figure out whether we want to merge it into core or not?

Yeah, I was thinking we can package it for now, that will be independent of our decision about potentially merging it into the core later.

Do you want to do it, or shall I?

archanaserver · 2026-06-04T05:56:42Z

Shall we package https://gitlab.surrey.ac.uk/sm0049/smart-proxy-dhcp-kea-api until we figure out whether we want to merge it into core or not?

Yeah, I was thinking we can package it for now, that will be independent of our decision about potentially merging it into the core later.

Do you want to do it, or shall I?

I'll do it

archanaserver · 2026-06-11T09:40:08Z

Update: Following the refinement session, we decided to integrate the KEA DHCP provider directly into smart-proxy core rather than packaging it as an external gem. I'm on it. So keeping this into draft till then.

Also looking at the current CI test failures, I believe they are coming from IOP tests failures and are unrelated to the DHCP feature changes in this PR.

stejskalleos · 2026-06-15T12:32:25Z

    type: Boolean
+  foreman_proxy_dhcp_kea_api_url:
+    parameter: --foreman-proxy-dhcp-kea-api-url
+    help: KEA Control Agent API URL (e.g., http://kea-server:8000/)


Nit: https example

Suggested change

help: KEA Control Agent API URL (e.g., http://kea-server:8000/)

help: KEA Control Agent API URL (e.g., https://kea-server)

(foreman_proxy_dhcp_kea_verify_ssl) is true by default, so this should be https

stejskalleos · 2026-06-15T12:33:37Z

+    help: KEA Control Agent API URL (e.g., http://kea-server:8000/)
+  foreman_proxy_dhcp_kea_api_username:
+    parameter: --foreman-proxy-dhcp-kea-api-username
+    help: Optional HTTP Basic Auth username for KEA API


Do we want to make it optional? It's not really secure IMO

I have updated it but auth is genuinely optional for kea control agent (many deployments run without auth on internal networks), but i agree we should encourage it for security. so fixed it

stejskalleos · 2026-06-15T12:34:36Z

+
+# KEA DHCP provider settings (when foreman_proxy_dhcp_provider is dhcp_kea)
+foreman_proxy_dhcp_kea_api_url: "{{ undef(hint='You must specify the KEA API URL') }}"
+foreman_proxy_dhcp_kea_api_username: "{{ undef(hint='Optional HTTP Basic Auth username for KEA API') }}"


If the parameter is optional, why raise an error when no value is provided?

So I removed optional from the hint text to reduce any confusion but the undef() is never actually raised because the template checks if you see

{% if foreman_proxy_dhcp_kea_api_username is defined and foreman_proxy_dhcp_kea_api_username %} :dhcp_kea_api_username: {{ foreman_proxy_dhcp_kea_api_username }} {% else %} :dhcp_kea_api_username: ~ {% endif %}

is defined before using it. I added just to satisfy the linter earlier. do you have any other suggestons?

stejskalleos · 2026-06-15T12:34:58Z

+    help: Optional HTTP Basic Auth password for KEA API
+  foreman_proxy_dhcp_kea_verify_ssl:
+    parameter: --foreman-proxy-dhcp-kea-verify-ssl
+    help: Verify SSL certificates when connecting to KEA API


Mention the default value (true)

stejskalleos · 2026-06-15T12:35:34Z

+# KEA DHCP provider settings (when foreman_proxy_dhcp_provider is dhcp_kea)
+foreman_proxy_dhcp_kea_api_url: "{{ undef(hint='You must specify the KEA API URL') }}"
+foreman_proxy_dhcp_kea_api_username: "{{ undef(hint='Optional HTTP Basic Auth username for KEA API') }}"
+foreman_proxy_dhcp_kea_api_password: "{{ undef(hint='Optional HTTP Basic Auth password for KEA API') }}"


same as above

stejskalleos · 2026-06-15T12:37:10Z

    parameter: --bmc-redfish-verify-ssl
    help: Verify SSL certificates for Redfish BMC connections.
    type: Boolean
+  foreman_proxy_dhcp_kea_api_url:


I don't see a parameter for DHCP subnets.

yes, now we can specify this

Ref: theforeman/foremanctl#531 (comment) ISC DHCP reached end-of-life in October 2022 and is no longer maintained. ISC officially recommends migrating to KEA DHCP as the replacement. This commit adds Smart Proxy DHCP provider for ISC KEA DHCP server using the KEA Control Agent API, providing a migration path for users currently using the deprecated dhcp_isc provider. Based on the `smart_proxy_dhcp_kea_api` gem by Sam McCarthy with author's permission to integrate into Smart Proxy core. https://gitlab.surrey.ac.uk/sm0049/smart-proxy-dhcp-kea-api/-/issues/3 Fixes: https://redhat.atlassian.net/browse/SAT-27739

stejskalleos · 2026-06-17T12:20:19Z

+:dhcp_kea_password: ~
+{% endif %}
+:dhcp_kea_verify_ssl: {{ foreman_proxy_dhcp_kea_verify_ssl | default(true) | lower }}
+:dhcp_kea_lease_timeout: {{ foreman_proxy_dhcp_kea_lease_timeout | default(60) }}


The default value should be set in the src/roles/foreman_proxy/defaults/main.yaml

stejskalleos · 2026-06-17T12:20:53Z

+:dhcp_kea_password: ~
+{% endif %}
+:dhcp_kea_verify_ssl: {{ foreman_proxy_dhcp_kea_verify_ssl | default(true) | lower }}
+:dhcp_kea_lease_timeout: {{ foreman_proxy_dhcp_kea_lease_timeout | default(60) }}


Question: Do we want to give users a chance to edit this value via foremanctl? If yes, then we need another parameter for it.

Yes, both values are exposed as CLI parameters

stejskalleos · 2026-06-17T12:21:42Z

+{% else %}
+:dhcp_kea_password: ~
+{% endif %}
+:dhcp_kea_verify_ssl: {{ foreman_proxy_dhcp_kea_verify_ssl | default(true) | lower }}


Is this needed when the default value is already set in src/roles/foreman_proxy/defaults/main.yaml?

Suggested change

:dhcp_kea_verify_ssl: {{ foreman_proxy_dhcp_kea_verify_ssl | default(true) | lower }}

:dhcp_kea_verify_ssl: {{ foreman_proxy_dhcp_kea_verify_ssl }}

Ref: theforeman/foremanctl#531 (comment) ISC DHCP reached end-of-life in October 2022 and is no longer maintained. ISC officially recommends migrating to KEA DHCP as the replacement. This commit adds Smart Proxy DHCP provider for ISC KEA DHCP server using the KEA Control Agent API, providing a migration path for users currently using the deprecated dhcp_isc provider. Based on the `smart_proxy_dhcp_kea_api` gem by Sam McCarthy with author's permission to integrate into Smart Proxy core. https://gitlab.surrey.ac.uk/sm0049/smart-proxy-dhcp-kea-api/-/issues/3 Fixes: https://redhat.atlassian.net/browse/SAT-27739 Fix Rubocop failures Simplify KEA plugin config loading

stejskalleos · 2026-06-23T11:46:18Z

+    - name: Configure Kea DHCP4 server
+      ansible.builtin.copy:
+        dest: /etc/kea/kea-dhcp4.conf
+        content: |


Can we make it a file/template?

stejskalleos · 2026-06-23T13:13:58Z

+        name: kea-ctrl-agent
+        state: started
+
+    - name: Wait for Kea Control Agent to be ready


This is failing for me, repeatedly.

TASK [Wait for Kea Control Agent to be ready] **************************************************************************************************** [ERROR]: Task failed: Module failed: Timeout when waiting for 127.0.0.1:8000 Origin: /home/lstejska/projects/foremanctl/development/playbooks/kea/kea.yaml:115:7 113 state: started 114 115 - name: Wait for Kea Control Agent to be ready ^ column 7 fatal: [quadlet]: FAILED! => { "changed": false, "elapsed": 30 } MSG: Timeout when waiting for 127.0.0.1:8000 PLAY RECAP *************************************************************************************************************************************** quadlet : ok=12 changed=9 unreachable=0 failed=1 skipped=0 rescued=0 ignored=0

before I ran:

./foremanctl deploy --initial-admin-password=changeme --tuning development --add-feature foreman-proxy --add-feature dhcp --foreman-proxy-dhcp-kea-url http://127.0.0.1:8000

I see it for me as well, taking a look on it

Also you don't need to include --add-feature foreman-proxy, I have added it as a dependency in the dhcp with expand_features that automatically includes all dependencies.

stejskalleos · 2026-06-23T13:15:14Z

+      - name: Create installer certificates
+        if: contains(matrix.certificate_source, 'installer')
+        run: |
+          ./forge installer-certs


Why is this needed?

For me it's failing with:

forge: error: argument action: invalid choice: 'installer-certs' (choose from 'custom-certs', 'deploy-dev', 'kea', 'lock', 'mock-installer', 'remote-database', 'security', 'setup-repositories', 'smoker', 'sos', 'test', 'vms'

I see that's a leftover dead code. I should have dropped earlier. Let's see now

Adds the dhcp-kea-external feature to enable Smart Proxy integration with external KEA DHCP servers.

Since it defaults to dhcp_kea, we don't need to pass it at all

pr-processor Bot added the Not yet reviewed label Jun 1, 2026

evgeni reviewed Jun 1, 2026

View reviewed changes

pr-processor Bot removed the Not yet reviewed label Jun 1, 2026

evgeni reviewed Jun 1, 2026

View reviewed changes

stejskalleos reviewed Jun 2, 2026

View reviewed changes

amolpati30 reviewed Jun 3, 2026

View reviewed changes

Comment thread src/features.yaml

archanaserver force-pushed the dhcp-kea-external branch from 053aa03 to 715b2e0 Compare June 4, 2026 09:50

archanaserver marked this pull request as ready for review June 4, 2026 09:51

archanaserver marked this pull request as draft June 11, 2026 09:40

archanaserver mentioned this pull request Jun 15, 2026

Fixes #39429 - Add KEA DHCP provider theforeman/smart-proxy#949

Open

archanaserver force-pushed the dhcp-kea-external branch 2 times, most recently from 16f5653 to a4dd887 Compare June 15, 2026 10:47

stejskalleos requested changes Jun 15, 2026

View reviewed changes

pr-processor Bot added the Waiting on contributor label Jun 15, 2026

archanaserver force-pushed the dhcp-kea-external branch from a4dd887 to 1db2d43 Compare June 16, 2026 20:44

pr-processor Bot added Needs re-review and removed Waiting on contributor Needs re-review labels Jun 16, 2026

stejskalleos requested changes Jun 17, 2026

View reviewed changes

pr-processor Bot added the Waiting on contributor label Jun 17, 2026

archanaserver force-pushed the dhcp-kea-external branch from 1db2d43 to 883858e Compare June 19, 2026 10:37

pr-processor Bot added Needs re-review and removed Waiting on contributor Needs re-review labels Jun 19, 2026

archanaserver force-pushed the dhcp-kea-external branch from ea7ba9f to 7ea157e Compare June 23, 2026 06:16

archanaserver marked this pull request as ready for review June 23, 2026 06:27

archanaserver self-assigned this Jun 23, 2026

archanaserver force-pushed the dhcp-kea-external branch from ad89208 to 00439b3 Compare June 23, 2026 07:42

stejskalleos requested changes Jun 23, 2026

View reviewed changes

pr-processor Bot added Waiting on contributor Needs re-review and removed Waiting on contributor labels Jun 23, 2026

archanaserver force-pushed the dhcp-kea-external branch 3 times, most recently from ed48493 to ac5d9bb Compare June 24, 2026 14:32

pr-processor Bot removed the Needs re-review label Jun 24, 2026

archanaserver added 6 commits June 25, 2026 14:15

Add KEA DHCP provider feature for foreman-proxy

0779a77

Adds the dhcp-kea-external feature to enable Smart Proxy integration with external KEA DHCP servers.

Add feature test

4175f99

Fix DHCP KEA settings

b9364f8

add forge kea

2f85745

drop --foreman-proxy-dhcp-provider dhcp_kea

967d6f4

Since it defaults to dhcp_kea, we don't need to pass it at all

refactor to use template file

8a1408e

archanaserver force-pushed the dhcp-kea-external branch from ac5d9bb to 8a1408e Compare June 25, 2026 08:58

	foreman_proxy_dhcp_provider: dhcp_kea_api
	foreman_proxy_dhcp_provider: dhcp_kea

	foreman_proxy_dhcp_kea_managed_subnets: []
	foreman_proxy_dhcp_subnets: []

	help: KEA Control Agent API URL (e.g., http://kea-server:8000/)
	help: KEA Control Agent API URL (e.g., https://kea-server)

	:dhcp_kea_verify_ssl: {{ foreman_proxy_dhcp_kea_verify_ssl \| default(true) \| lower }}
	:dhcp_kea_verify_ssl: {{ foreman_proxy_dhcp_kea_verify_ssl }}

Uh oh!

Conversation

archanaserver commented Jun 1, 2026 • edited by amolpati30 Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why are you introducing these changes? (Problem description, related links)

What are the changes introduced in this pull request?

How to test this pull request

Checklist

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

evgeni commented Jun 1, 2026

Uh oh!

archanaserver commented Jun 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

evgeni commented Jun 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

archanaserver commented Jun 4, 2026

Uh oh!

archanaserver commented Jun 11, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

archanaserver commented Jun 1, 2026 •

edited by amolpati30

Loading

archanaserver commented Jun 2, 2026 •

edited

Loading

evgeni commented Jun 2, 2026 •

edited

Loading