Allow proxy registration via agent role

[ra2xfael]

To register agents proxy-registration can be used on a separate machine, which is already fully provisioned (tls registered). This allows the role user to keep the firewall between ansible target and CheckMK server closed. The proxy-registration port only needs to be open between delegation target and server.

Pull request type

• Feature

What is the current behavior?

Proxy registration is not possible using the agent ansible role. Regular registration needs to be used or proxy registration executed manually.

What is the new behavior?

• cmk-agent-ctl proxy-registration is executed automatically on a delegate target and the encryption key is directly imported on the ansible target.
• The new variable checkmk_agent_delegate_registration is introduced by default. To set it checkmk_agent_proxy_registration can be used.

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[robin-checkmk]

@ra2xfael Please follow the instructions from the CLA bot, for us to be able to merge this PR (pending review).

[robin-checkmk]

Thanks for your contribution! We are pressed for time right now, but rest assured, this will be reviewed, as soon as we find the time. ✌️

[robin-checkmk]

@ra2xfael in the meantime, you can look into the test failures and try to fix them. That will speed up the review process.

[robin-checkmk]

You pushed changes, while I was reviewing, so I hope my review is not outdated. :)

Overall I really appreciate the quality of the pull request. There are just some minor changes necessary I think.

Also, it would be nice to keep an eye on idempotency, but it is not a hard requirement. I just know we have users, who have a keen eye on this. ;)

[robin-checkmk]

This needs clarification. See my comment in the defaults file as well. I think I understand, what you are trying to do, but I struggle to use it without much thinking, which is not a good sign for usability. We probably need to discuss which default value makes sense and how to make it as accessible as possible.

Also, we should mention, that the system, we delegate the task to, requires the Checkmk agent installed.

[ra2xfael]

You pushed changes, while I was reviewing, so I hope my review is not outdated. :)

Overall I really appreciate the quality of the pull request. There are just some minor changes necessary I think.

Also, it would be nice to keep an eye on idempotency, but it is not a hard requirement. I just know we have users, who have a keen eye on this. ;)

Thanks for the pull review @robin-checkmk !
I see the problems and would be keen to enhance my addition. There are just two points I need some clarification on.

1. Idempotency: The four tasks I added only run when checkmk_agent_registration_server + '/' + checkmk_agent_registration_site in __checkmk_agent_registered_connections.stdout is false. As I understand this, it is the case if the agent is not already connected with tls, so registration is still necessary. If tls registration is already done, then the tasks won't be executed. Idempotency should be guaranteed?
2. Do all variables have to have a default? Can we just set a variable if delegation to do proxy-registration is necessary, otherwise if not set we assume it does not need to be done?

[robin-checkmk]

@ra2xfael I wanted to rebase your changes on devel and add some final touches to wording, but apparently GitHub did not like that too much. So now a lot of changes pop up, that should already be in devel. Maybe you can double-check the files you modified in the first place and if everything looks fine, I would go ahead and merge this.

[ra2xfael]

Hi @robin-checkmk, everything looks fine. The changes I made have been retained, there should be no problem with merging