Fix missing ROLE_ASSUME events #3844

Workflow file for this run

.github/workflows/acme-tests.yml at 022687f

	name: ACME Tests

	on: [push, pull_request]

	jobs:
	init:
	name: Initialization
	uses: ./.github/workflows/init.yml
	secrets: inherit

	build:
	name: Waiting for build
	needs: init
	runs-on: ubuntu-latest
	steps:
	- name: Wait for build
	uses: lewagon/[email protected]
	with:
	ref: ${{ github.ref }}
	check-name: 'Building PKI'
	repo-token: ${{ secrets.GITHUB_TOKEN }}
	wait-interval: 30
	if: github.event_name == 'push'

	- name: Wait for build
	uses: lewagon/[email protected]
	with:
	ref: ${{ github.event.pull_request.head.sha }}
	check-name: 'Building PKI'
	repo-token: ${{ secrets.GITHUB_TOKEN }}
	wait-interval: 30
	if: github.event_name == 'pull_request'

	# docs/installation/acme/Installing_PKI_ACME_Responder.md
	# docs/user/acme/Using_PKI_ACME_Responder_with_Certbot.md
	acme-certbot-test:
	name: Testing ACME with certbot
	needs: [init, build]
	runs-on: ubuntu-latest
	env:
	PKIDIR: /tmp/workdir/pki
	steps:
	- name: Clone repository
	uses: actions/checkout@v3

	- name: Retrieve pki-runner image
	uses: actions/cache@v3
	with:
	key: pki-runner-${{ github.sha }}
	path: pki-runner.tar

	- name: Load runner image
	run: docker load --input pki-runner.tar

	- name: Create network
	run: docker network create example

	- name: Run PKI container
	run: \|
	IMAGE=pki-runner \
	NAME=pki \
	HOSTNAME=pki.example.com \
	tests/bin/runner-init.sh

	- name: Connect PKI container to network
	run: docker network connect example pki --alias pki.example.com

	- name: Install dependencies in PKI container
	run: docker exec pki dnf install -y 389-ds-base

	- name: Install DS in PKI container
	run: docker exec pki ${PKIDIR}/tests/bin/ds-create.sh

	- name: Install CA in PKI container
	run: docker exec pki pkispawn -f /usr/share/pki/server/examples/installation/ca.cfg -s CA -v

	- name: Install ACME in PKI container
	run: \|
	docker exec pki pki-server acme-create
	docker exec pki ldapmodify -h pki.example.com \
	-x \
	-D "cn=Directory Manager" \
	-w Secret.123 \
	-f /usr/share/pki/acme/database/ds/schema.ldif
	docker exec pki ldapadd -h pki.example.com \
	-x \
	-D "cn=Directory Manager" \
	-w Secret.123 \
	-f /usr/share/pki/acme/database/ds/create.ldif
	docker exec pki ldapadd -h pki.example.com \
	-x \
	-D "cn=Directory Manager" \
	-w Secret.123 \
	-f /usr/share/pki/acme/realm/ds/create.ldif
	docker exec pki pki-server acme-database-mod --type ds
	docker exec pki pki-server acme-issuer-mod --type pki
	docker exec pki pki-server acme-realm-mod --type ds
	docker exec pki pki-server acme-deploy --wait

	- name: Run PKI healthcheck in PKI container
	run: docker exec pki pki-healthcheck --failures-only

	- name: Verify admin user in PKI container
	run: \|
	docker exec pki pki-server cert-export ca_signing --cert-file ca_signing.crt
	docker exec pki pki client-cert-import ca_signing --ca-cert ca_signing.crt
	docker exec pki pki client-cert-import \
	--pkcs12 /root/.dogtag/pki-tomcat/ca_admin_cert.p12 \
	--pkcs12-password-file /root/.dogtag/pki-tomcat/ca/pkcs12_password.conf
	docker exec pki pki -n caadmin ca-user-show caadmin

	- name: Verify ACME in PKI container
	run: docker exec pki pki acme-info

	- name: Run client container
	run: \|
	IMAGE=pki-runner \
	NAME=client \
	HOSTNAME=client.example.com \
	tests/bin/runner-init.sh

	- name: Connect client container to network
	run: docker network connect example client --alias client.example.com

	- name: Install dependencies in client container
	run: docker exec client dnf install -y certbot

	- name: Verify certbot in client container
	run: \|
	docker exec client certbot register \
	--server http://pki.example.com:8080/acme/directory \
	--email [email protected] \
	--agree-tos \
	--non-interactive
	docker exec client certbot certonly \
	--server http://pki.example.com:8080/acme/directory \
	-d client.example.com \
	--standalone \
	--non-interactive
	docker exec client certbot renew \
	--server http://pki.example.com:8080/acme/directory \
	--cert-name client.example.com \
	--force-renewal \
	--no-random-sleep-on-renew \
	--non-interactive
	docker exec client certbot revoke \
	--server http://pki.example.com:8080/acme/directory \
	--cert-name client.example.com \
	--non-interactive
	docker exec client certbot update_account \
	--server http://pki.example.com:8080/acme/directory \
	--email [email protected] \
	--non-interactive
	docker exec client certbot unregister \
	--server http://pki.example.com:8080/acme/directory \
	--non-interactive

	- name: Gather artifacts from PKI container
	if: always()
	run: \|
	tests/bin/ds-artifacts-save.sh pki
	tests/bin/pki-artifacts-save.sh pki

	- name: Remove ACME from PKI container
	run: \|
	docker exec pki pki-server acme-undeploy --wait
	docker exec pki pki-server acme-remove

	- name: Remove CA from PKI container
	run: docker exec pki pkidestroy -i pki-tomcat -s CA -v

	- name: Remove DS from PKI container
	run: docker exec pki ${PKIDIR}/tests/bin/ds-remove.sh

	- name: Upload artifacts
	if: always()
	uses: actions/upload-artifact@v3
	with:
	name: acme
	path: \|
	/tmp/artifacts/pki

	# This test verifies that in a cluster the baseURL parameter can be used
	# to replace a server with another server without affecting the client.
	acme-switchover-test:
	name: Testing ACME server switchover
	needs: [init, build]
	runs-on: ubuntu-latest
	env:
	PKIDIR: /tmp/workdir/pki
	steps:
	- name: Clone repository
	uses: actions/checkout@v3

	- name: Retrieve pki-runner image
	uses: actions/cache@v3
	with:
	key: pki-runner-${{ github.sha }}
	path: pki-runner.tar

	- name: Load runner image
	run: docker load --input pki-runner.tar

	- name: Create network
	run: docker network create example

	- name: Run PKI container
	run: \|
	IMAGE=pki-runner \
	NAME=pki \
	HOSTNAME=pki.example.com \
	tests/bin/runner-init.sh

	- name: Connect PKI container to network
	run: docker network connect example pki --alias pki.example.com --alias server1.example.com

	- name: Install dependencies in PKI container
	run: docker exec pki dnf install -y 389-ds-base jq

	- name: Install DS in PKI container
	run: docker exec pki ${PKIDIR}/tests/bin/ds-create.sh

	- name: Install CA in PKI container
	run: docker exec pki pkispawn -f /usr/share/pki/server/examples/installation/ca.cfg -s CA -v

	- name: Install ACME in PKI container
	run: \|
	docker exec pki pki-server acme-create
	docker exec pki ldapmodify -h pki.example.com \
	-x \
	-D "cn=Directory Manager" \
	-w Secret.123 \
	-f /usr/share/pki/acme/database/ds/schema.ldif
	docker exec pki ldapadd -h pki.example.com \
	-x \
	-D "cn=Directory Manager" \
	-w Secret.123 \
	-f /usr/share/pki/acme/database/ds/create.ldif
	docker exec pki ldapadd -h pki.example.com \
	-x \
	-D "cn=Directory Manager" \
	-w Secret.123 \
	-f /usr/share/pki/acme/realm/ds/create.ldif
	docker exec pki pki-server acme-database-mod --type ds
	docker exec pki pki-server acme-issuer-mod --type pki
	docker exec pki pki-server acme-realm-mod --type ds
	docker exec pki bash -c "echo baseURL=http://server1.example.com:8080/acme >> /etc/pki/pki-tomcat/acme/engine.conf"
	docker exec pki pki-server acme-deploy --wait

	- name: Run client container
	run: \|
	IMAGE=pki-runner \
	NAME=client \
	HOSTNAME=client.example.com \
	tests/bin/runner-init.sh

	- name: Connect client container to network
	run: docker network connect example client --alias client1.example.com --alias client2.example.com

	- name: Install dependencies in client container
	run: docker exec client dnf install -y certbot

	- name: Verify ACME directory before switchover
	run: \|
	echo http://server1.example.com:8080/acme/new-nonce > expected
	docker exec pki bash -c "curl -s -k http://pki.example.com:8080/acme/directory \| jq -r '.newNonce' > ${PKIDIR}/actual"
	diff expected actual

	- name: Verify registration and enrollment before switchover
	run: \|
	docker exec client certbot register \
	--server http://pki.example.com:8080/acme/directory \
	--email [email protected] \
	--agree-tos \
	--non-interactive
	docker exec client certbot certonly \
	--server http://pki.example.com:8080/acme/directory \
	-d client1.example.com \
	--standalone \
	--non-interactive
	docker exec client certbot certonly \
	--server http://pki.example.com:8080/acme/directory \
	-d client2.example.com \
	--standalone \
	--non-interactive

	- name: Simulate ACME server switchover by replacing the baseURL parameter
	run: \|
	docker network disconnect example pki
	docker exec pki pki-server acme-undeploy --wait
	docker exec pki sed -i "s/server1.example.com/server2.example.com/g" /etc/pki/pki-tomcat/acme/engine.conf
	docker exec pki pki-server acme-deploy --wait
	docker network connect example pki --alias pki.example.com --alias server2.example.com

	- name: Verify ACME directory after switchover
	run: \|
	echo http://server2.example.com:8080/acme/new-nonce > expected
	docker exec pki bash -c "curl -s -k http://pki.example.com:8080/acme/directory \| jq -r '.newNonce' > ${PKIDIR}/actual"
	diff expected actual

	- name: Verify renewal, revocation, account update and deactivation after switchover
	run: \|
	docker exec client certbot renew \
	--server http://pki.example.com:8080/acme/directory \
	--cert-name client1.example.com \
	--force-renewal \
	--no-random-sleep-on-renew \
	--non-interactive
	docker exec client certbot revoke \
	--server http://pki.example.com:8080/acme/directory \
	--cert-name client2.example.com \
	--non-interactive
	docker exec client certbot update_account \
	--server http://pki.example.com:8080/acme/directory \
	--email [email protected] \
	--non-interactive
	docker exec client certbot unregister \
	--server http://pki.example.com:8080/acme/directory \
	--non-interactive

	- name: Gather artifacts from PKI container
	if: always()
	run: \|
	tests/bin/ds-artifacts-save.sh pki
	tests/bin/pki-artifacts-save.sh pki

	- name: Remove ACME from PKI container
	run: \|
	docker exec pki pki-server acme-undeploy --wait
	docker exec pki pki-server acme-remove

	- name: Remove CA from PKI container
	run: docker exec pki pkidestroy -i pki-tomcat -s CA -v

	- name: Remove DS from PKI container
	run: docker exec pki ${PKIDIR}/tests/bin/ds-remove.sh

	- name: Upload artifacts
	if: always()
	uses: actions/upload-artifact@v3
	with:
	name: acme-switchover
	path: \|
	/tmp/artifacts/pki

	# docs/installation/podman/Deploying_PKI_ACME_Responder_on_Podman.md
	acme-container-test:
	name: Testing ACME container
	needs: [init, build]
	runs-on: ubuntu-latest
	env:
	PKIDIR: /tmp/workdir/pki
	steps:
	- name: Clone repository
	uses: actions/checkout@v3

	- name: Retrieve pki-runner image
	uses: actions/cache@v3
	with:
	key: pki-runner-${{ github.sha }}
	path: pki-runner.tar

	- name: Load runner image
	run: docker load --input pki-runner.tar

	- name: Retrieve pki-acme image
	uses: actions/cache@v3
	with:
	key: pki-acme-${{ github.sha }}
	path: pki-acme.tar

	- name: Load acme image
	run: docker load --input pki-acme.tar

	- name: Create network
	run: docker network create example

	- name: Run ACME container
	run: \|
	docker run \
	--name server \
	--detach \
	pki-acme

	- name: Connect ACME container to network
	run: docker network connect example server --alias pki.example.com

	- name: Run client container
	run: \|
	IMAGE=pki-runner \
	NAME=client \
	HOSTNAME=client.example.com \
	tests/bin/runner-init.sh

	- name: Connect client container to network
	run: docker network connect example client --alias client.example.com

	- name: Install dependencies in client container
	run: docker exec client dnf install -y certbot

	- name: Verify certbot in client container
	run: \|
	tests/acme/bin/acme-wait.sh client http://pki.example.com:8080/acme/directory
	docker exec client certbot register \
	--server http://pki.example.com:8080/acme/directory \
	--email [email protected] \
	--agree-tos \
	--non-interactive
	docker exec client certbot certonly \
	--server http://pki.example.com:8080/acme/directory \
	-d client.example.com \
	--standalone \
	--non-interactive
	docker exec client certbot renew \
	--server http://pki.example.com:8080/acme/directory \
	--cert-name client.example.com \
	--force-renewal \
	--no-random-sleep-on-renew \
	--non-interactive
	#
	# By default the pki-acme container uses NSS issuer (instead of
	# PKI issuer) which does not support cert revocation, so the
	# revocation test is disabled.
	#
	# docker exec client certbot revoke \
	# --server http://pki.example.com:8080/acme/directory \
	# --cert-name client.example.com \
	# --non-interactive
	#
	docker exec client certbot update_account \
	--server http://pki.example.com:8080/acme/directory \
	--email [email protected] \
	--non-interactive
	docker exec client certbot unregister \
	--server http://pki.example.com:8080/acme/directory \
	--non-interactive

	- name: Gather artifacts from server container
	if: always()
	run: \|
	mkdir -p /tmp/artifacts/server/var/lib
	docker cp server:/var/lib/tomcats /tmp/artifacts/server/var/lib
	docker logs server > /tmp/artifacts/server/container.log

	- name: Gather artifacts from client container
	if: always()
	run: \|
	mkdir -p /tmp/artifacts/client/var/log/letsencrypt
	docker cp client:/var/log/letsencrypt/letsencrypt.log /tmp/artifacts/client/var/log/letsencrypt

	- name: Upload artifacts from server container
	if: always()
	uses: actions/upload-artifact@v3
	with:
	name: acme-container-server
	path: /tmp/artifacts/server

	- name: Upload artifacts from client container
	if: always()
	uses: actions/upload-artifact@v3
	with:
	name: acme-container-client
	path: /tmp/artifacts/client

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix missing ROLE_ASSUME events #3844

Workflow file

Fix missing ROLE_ASSUME events #3844

Jobs

Run details

Workflow file for this run