Bug2246422-(refinement of)ServerSideKeygen static SKID #4598

Workflow file for this run

.github/workflows/tks-tests.yml at 1512d3f

	name: TKS Tests

	on: [push, pull_request]

	jobs:
	init:
	name: Initialization
	uses: ./.github/workflows/init.yml
	secrets: inherit

	build:
	name: Waiting for build
	needs: init
	runs-on: ubuntu-latest
	steps:
	- name: Wait for build
	uses: lewagon/[email protected]
	with:
	ref: ${{ github.ref }}
	check-name: 'Building PKI'
	repo-token: ${{ secrets.GITHUB_TOKEN }}
	wait-interval: 30
	if: github.event_name == 'push'

	- name: Wait for build
	uses: lewagon/[email protected]
	with:
	ref: ${{ github.event.pull_request.head.sha }}
	check-name: 'Building PKI'
	repo-token: ${{ secrets.GITHUB_TOKEN }}
	wait-interval: 30
	if: github.event_name == 'pull_request'

	# docs/installation/tks/Installing_TKS.md
	tks-test:
	name: Testing TKS
	needs: [init, build]
	runs-on: ubuntu-latest
	env:
	PKIDIR: /tmp/workdir/pki
	steps:
	- name: Clone repository
	uses: actions/checkout@v3

	- name: Retrieve pki-runner image
	uses: actions/cache@v3
	with:
	key: pki-runner-${{ github.sha }}
	path: pki-runner.tar

	- name: Load runner image
	run: docker load --input pki-runner.tar

	- name: Run container
	run: \|
	IMAGE=pki-runner \
	NAME=pki \
	HOSTNAME=pki.example.com \
	tests/bin/runner-init.sh

	- name: Install dependencies
	run: docker exec pki dnf install -y 389-ds-base

	- name: Install DS
	run: docker exec pki ${PKIDIR}/tests/bin/ds-create.sh

	- name: Install CA
	run: docker exec pki pkispawn -f /usr/share/pki/server/examples/installation/ca.cfg -s CA -v

	- name: Install TKS
	run: docker exec pki pkispawn -f /usr/share/pki/server/examples/installation/tks.cfg -s TKS -v

	- name: Run PKI healthcheck
	run: docker exec pki pki-healthcheck --failures-only

	- name: Verify TKS admin
	run: \|
	docker exec pki pki-server cert-export ca_signing --cert-file ca_signing.crt
	docker exec pki pki client-cert-import ca_signing --ca-cert ca_signing.crt
	docker exec pki pki client-cert-import \
	--pkcs12 /root/.dogtag/pki-tomcat/ca_admin_cert.p12 \
	--pkcs12-password-file /root/.dogtag/pki-tomcat/ca/pkcs12_password.conf
	docker exec pki pki -n caadmin tks-user-show tksadmin

	- name: Gather artifacts
	if: always()
	run: \|
	tests/bin/ds-artifacts-save.sh pki
	tests/bin/pki-artifacts-save.sh pki

	- name: Remove TKS
	run: docker exec pki pkidestroy -i pki-tomcat -s TKS -v

	- name: Remove CA
	run: docker exec pki pkidestroy -i pki-tomcat -s CA -v

	- name: Remove DS
	run: docker exec pki ${PKIDIR}/tests/bin/ds-remove.sh

	- name: Upload artifacts
	if: always()
	uses: actions/upload-artifact@v3
	with:
	name: tks
	path: \|
	/tmp/artifacts/pki

	tks-separate-test:
	name: Testing TKS on separate instance
	needs: [init, build]
	runs-on: ubuntu-latest
	env:
	PKIDIR: /tmp/workdir/pki
	steps:
	- name: Clone repository
	uses: actions/checkout@v3

	- name: Retrieve pki-runner image
	uses: actions/cache@v3
	with:
	key: pki-runner-${{ github.sha }}
	path: pki-runner.tar

	- name: Load runner image
	run: docker load --input pki-runner.tar

	- name: Create network
	run: docker network create example

	- name: Setup CA container
	run: \|
	IMAGE=pki-runner \
	NAME=ca \
	HOSTNAME=ca.example.com \
	tests/bin/runner-init.sh

	- name: Connect CA container to network
	run: docker network connect example ca --alias ca.example.com

	- name: Install dependencies in CA container
	run: docker exec ca dnf install -y 389-ds-base

	- name: Install DS in CA container
	run: docker exec ca ${PKIDIR}/tests/bin/ds-create.sh

	- name: Install CA in CA container
	run: docker exec ca pkispawn -f /usr/share/pki/server/examples/installation/ca.cfg -s CA -v

	- name: Install banner in CA container
	run: docker exec ca cp /usr/share/pki/server/examples/banner/banner.txt /etc/pki/pki-tomcat

	- name: Setup TKS container
	run: \|
	IMAGE=pki-runner \
	NAME=tks \
	HOSTNAME=tks.example.com \
	tests/bin/runner-init.sh

	- name: Connect TKS container to network
	run: docker network connect example tks --alias tks.example.com

	- name: Install dependencies in TKS container
	run: docker exec tks dnf install -y 389-ds-base

	- name: Install DS in TKS container
	run: docker exec tks ${PKIDIR}/tests/bin/ds-create.sh

	- name: Install TKS in TKS container
	run: \|
	docker exec ca pki-server cert-export ca_signing --cert-file ${PKIDIR}/ca_signing.crt
	docker exec ca cp /root/.dogtag/pki-tomcat/ca_admin.cert ${PKIDIR}/ca_admin.cert
	docker exec tks cp ${PKIDIR}/ca_signing.crt .
	docker exec tks cp ${PKIDIR}/ca_admin.cert .
	docker exec tks pkispawn -f /usr/share/pki/server/examples/installation/tks-separate.cfg -s TKS -v

	- name: Install banner in TKS container
	run: docker exec tks cp /usr/share/pki/server/examples/banner/banner.txt /etc/pki/pki-tomcat

	- name: Run PKI healthcheck
	run: docker exec tks pki-healthcheck --debug

	- name: Verify TKS admin
	run: \|
	docker exec ca cp /root/.dogtag/pki-tomcat/ca_admin_cert.p12 ${PKIDIR}/ca_admin_cert.p12
	docker exec ca cp /root/.dogtag/pki-tomcat/ca/pkcs12_password.conf ${PKIDIR}/pkcs12_password.conf
	docker exec tks pki client-cert-import ca_signing --ca-cert ca_signing.crt
	docker exec tks pki client-cert-import \
	--pkcs12 ${PKIDIR}/ca_admin_cert.p12 \
	--pkcs12-password-file ${PKIDIR}/pkcs12_password.conf
	docker exec tks pki -n caadmin --ignore-banner tks-user-show tksadmin

	- name: Gather artifacts from CA container
	if: always()
	run: \|
	tests/bin/ds-artifacts-save.sh ca
	tests/bin/pki-artifacts-save.sh ca

	- name: Gather artifacts from TKS container
	if: always()
	run: \|
	tests/bin/ds-artifacts-save.sh tks
	tests/bin/pki-artifacts-save.sh tks

	- name: Remove TKS from TKS container
	run: docker exec tks pkidestroy -i pki-tomcat -s TKS -v

	- name: Remove DS from TKS container
	run: docker exec tks ${PKIDIR}/tests/bin/ds-remove.sh

	- name: Disconnect TKS container from network
	run: docker network disconnect example tks

	- name: Remove CA from CA container
	run: docker exec ca pkidestroy -i pki-tomcat -s CA -v

	- name: Remove DS from CA container
	run: docker exec ca ${PKIDIR}/tests/bin/ds-remove.sh

	- name: Disconnect CA container from network
	run: docker network disconnect example ca

	- name: Remove network
	run: docker network rm example

	- name: Upload artifacts from CA container
	if: always()
	uses: actions/upload-artifact@v3
	with:
	name: tks-separate-ca
	path: \|
	/tmp/artifacts/ca

	- name: Upload artifacts from TKS container
	if: always()
	uses: actions/upload-artifact@v3
	with:
	name: tks-separate-tks
	path: \|
	/tmp/artifacts/tks

	# docs/installation/tks/Installing_TKS_Clone.md
	# This test installs DS, CA, and TKS in the primary container,
	# then installs DS clone, CA clone, and TKS clone in the secondary container.
	tks-clone-test:
	name: Testing TKS clone
	needs: [init, build]
	runs-on: ubuntu-latest
	env:
	PKIDIR: /tmp/workdir/pki
	steps:
	- name: Clone repository
	uses: actions/checkout@v3

	- name: Retrieve pki-runner image
	uses: actions/cache@v3
	with:
	key: pki-runner-${{ github.sha }}
	path: pki-runner.tar

	- name: Load runner image
	run: docker load --input pki-runner.tar

	- name: Create network
	run: docker network create example

	- name: Run primary container
	run: \|
	IMAGE=pki-runner \
	NAME=primary \
	HOSTNAME=primary.example.com \
	tests/bin/runner-init.sh

	- name: Connect primary container to network
	run: docker network connect example primary --alias primary.example.com

	- name: Install dependencies in primary container
	run: docker exec primary dnf install -y 389-ds-base

	- name: Install DS in primary container
	run: docker exec primary ${PKIDIR}/tests/bin/ds-create.sh

	- name: Install CA in primary container
	run: docker exec primary pkispawn -f /usr/share/pki/server/examples/installation/ca.cfg -s CA -v

	- name: Install TKS in primary container
	run: docker exec primary pkispawn -f /usr/share/pki/server/examples/installation/tks.cfg -s TKS -v

	- name: Setup secondary container
	run: \|
	IMAGE=pki-runner \
	NAME=secondary \
	HOSTNAME=secondary.example.com \
	tests/bin/runner-init.sh

	- name: Connect secondary container to network
	run: docker network connect example secondary --alias secondary.example.com

	- name: Install dependencies in secondary container
	run: docker exec secondary dnf install -y 389-ds-base

	- name: Install DS in secondary container
	run: docker exec secondary ${PKIDIR}/tests/bin/ds-create.sh

	- name: Install CA in secondary container
	run: \|
	docker exec primary pki-server cert-export ca_signing --cert-file ${PKIDIR}/ca_signing.crt
	docker exec primary pki-server ca-clone-prepare --pkcs12-file ${PKIDIR}/ca-certs.p12 --pkcs12-password Secret.123
	docker exec secondary cp ${PKIDIR}/ca_signing.crt .
	docker exec secondary cp ${PKIDIR}/ca-certs.p12 .
	docker exec secondary pkispawn -f /usr/share/pki/server/examples/installation/ca-clone.cfg -s CA -v

	- name: Install TKS in secondary container
	run: \|
	docker exec primary pki-server tks-clone-prepare --pkcs12-file ${PKIDIR}/tks-certs.p12 --pkcs12-password Secret.123
	docker exec secondary cp ${PKIDIR}/tks-certs.p12 .
	docker exec secondary pkispawn -f /usr/share/pki/server/examples/installation/tks-clone.cfg -s TKS -v

	- name: Verify TKS admin in secondary container
	run: \|
	docker exec primary cp /root/.dogtag/pki-tomcat/ca_admin_cert.p12 ${PKIDIR}/ca_admin_cert.p12
	docker exec primary cp /root/.dogtag/pki-tomcat/ca/pkcs12_password.conf ${PKIDIR}/pkcs12_password.conf
	docker exec secondary pki client-cert-import ca_signing --ca-cert ca_signing.crt
	docker exec secondary pki client-cert-import \
	--pkcs12 ${PKIDIR}/ca_admin_cert.p12 \
	--pkcs12-password-file ${PKIDIR}/pkcs12_password.conf
	docker exec secondary pki -n caadmin --ignore-banner tks-user-show tksadmin

	- name: Setup tertiary container
	run: \|
	IMAGE=pki-runner \
	NAME=tertiary \
	HOSTNAME=tertiary.example.com \
	tests/bin/runner-init.sh

	- name: Connect tertiary container to network
	run: docker network connect example tertiary --alias tertiary.example.com

	- name: Install dependencies in tertiary container
	run: docker exec tertiary dnf install -y 389-ds-base

	- name: Install DS in tertiary container
	run: docker exec tertiary ${PKIDIR}/tests/bin/ds-create.sh

	- name: Install CA in tertiary container
	run: \|
	docker exec secondary pki-server cert-export ca_signing --cert-file ${PKIDIR}/ca_signing.crt
	docker exec secondary pki-server ca-clone-prepare --pkcs12-file ${PKIDIR}/ca-certs.p12 --pkcs12-password Secret.123
	docker exec tertiary cp ${PKIDIR}/ca_signing.crt .
	docker exec tertiary cp ${PKIDIR}/ca-certs.p12 .
	docker exec tertiary pkispawn -f /usr/share/pki/server/examples/installation/ca-clone-of-clone.cfg -s CA -v

	- name: Install TKS in tertiary container
	run: \|
	docker exec secondary pki-server tks-clone-prepare --pkcs12-file ${PKIDIR}/tks-certs.p12 --pkcs12-password Secret.123
	docker exec tertiary cp ${PKIDIR}/tks-certs.p12 .
	docker exec tertiary pkispawn -f /usr/share/pki/server/examples/installation/tks-clone-of-clone.cfg -s TKS -v

	- name: Verify TKS admin in tertiary container
	run: \|
	docker exec tertiary pki client-cert-import ca_signing --ca-cert ca_signing.crt
	docker exec tertiary pki client-cert-import \
	--pkcs12 ${PKIDIR}/ca_admin_cert.p12 \
	--pkcs12-password-file ${PKIDIR}/pkcs12_password.conf
	docker exec tertiary pki -n caadmin tks-user-show tksadmin

	- name: Gather config files from primary container
	run: \|
	tests/bin/ds-artifacts-save.sh primary
	tests/bin/pki-artifacts-save.sh primary

	- name: Gather config files from secondary container
	if: always()
	run: \|
	tests/bin/ds-artifacts-save.sh secondary
	tests/bin/pki-artifacts-save.sh secondary

	- name: Gather config files from tertiary container
	if: always()
	run: \|
	tests/bin/ds-artifacts-save.sh tertiary
	tests/bin/pki-artifacts-save.sh tertiary

	- name: Remove TKS from tertiary container
	run: docker exec tertiary pkidestroy -i pki-tomcat -s TKS -v

	- name: Remove CA from tertiary container
	run: docker exec tertiary pkidestroy -i pki-tomcat -s CA -v

	- name: Remove DS from tertiary container
	run: docker exec tertiary ${PKIDIR}/tests/bin/ds-remove.sh

	- name: Disconnect tertiary container from network
	run: docker network disconnect example tertiary

	- name: Remove TKS from secondary container
	run: docker exec secondary pkidestroy -i pki-tomcat -s TKS -v

	- name: Remove CA from secondary container
	run: docker exec secondary pkidestroy -i pki-tomcat -s CA -v

	- name: Remove DS from secondary container
	run: docker exec secondary ${PKIDIR}/tests/bin/ds-remove.sh

	- name: Disconnect secondary container from network
	run: docker network disconnect example secondary

	- name: Remove TKS from primary container
	run: docker exec primary pkidestroy -i pki-tomcat -s TKS -v

	- name: Remove CA from primary container
	run: docker exec primary pkidestroy -i pki-tomcat -s CA -v

	- name: Remove DS from primary container
	run: docker exec primary ${PKIDIR}/tests/bin/ds-remove.sh

	- name: Disconnect primary container from network
	run: docker network disconnect example primary

	- name: Remove network
	run: docker network rm example

	- name: Upload artifacts from primary container
	if: always()
	uses: actions/upload-artifact@v3
	with:
	name: tks-clone-primary
	path: \|
	/tmp/artifacts/primary

	- name: Upload artifacts from secondary container
	if: always()
	uses: actions/upload-artifact@v3
	with:
	name: tks-clone-secondary
	path: \|
	/tmp/artifacts/secondary

	- name: Upload artifacts from tertiary container
	if: always()
	uses: actions/upload-artifact@v3
	with:
	name: tks-clone-tertiary
	path: \|
	/tmp/artifacts/tertiary

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bug2246422-(refinement of)ServerSideKeygen static SKID #4598

Workflow file

Bug2246422-(refinement of)ServerSideKeygen static SKID #4598

Jobs

Run details

Workflow file for this run