Daniel adds:

• `foreman-rake security:generate_encryption_key` doesn't run by
  default because of the permissions set by the installer. `Permission
  denied - /usr/share/foreman/config/initializers/encryption_key.rb`

This works correctly during package installation, it's just a post-install issue that prevents you re-running it. I'll file this separately as it's a low priority and impact bug.

Before 1.8, I think we should address this. I've naively renamed the
initializer to 0_encrypted_key.rb and it fixes the issue. Before 1.8:

• We should document Compute Resource encryption through
  EncryptionKey in the manual.

• There should be tests for the tasks that deal with this.

• Tests for should ensure the initializer runs before the concern is
  loaded.

Renaming the initialiser certainly works, though as it's a locally created file then we'll need to handle this in packaging somehow - a bit messy. Renaming the apipie initialiser might be easier!

#9771 is caused by the same issue I believe. The Encryptable concern isn't being loaded due to the initialiser reordering, so the encrypt rake task is failing as the concern methods aren't present.

Can confirm #9771 is completely related, as when I make the initializer load earlier it does work.