ipa-tests.yml

name: IPA Tests

on: [push, pull_request]

jobs:
  init:
    name: Initializing Workflow
    runs-on: ubuntu-latest
    container: fedora:latest
    outputs:
      matrix: ${{ steps.set-matrix.outputs.matrix }}
    steps:
      - name: Set up test matrix
        id: set-matrix
        run: |
          export latest=$(cat /etc/fedora-release | awk '{ print $3 }')
          export previous=$(cat /etc/fedora-release | awk '{ print $3 - 1}')
          echo "Running CI against Fedora $previous and $latest"
          if [ "${{ secrets.MATRIX }}" == "" ]
          then
              echo "::set-output name=matrix::{\"os\":[\"$previous\", \"$latest\"]}"
          else
              echo "::set-output name=matrix::${{ secrets.MATRIX }}"
          fi

  # docs/development/Building_PKI.md
  build:
    name: Building PKI
    needs: init
    runs-on: ubuntu-latest
    env:
      COPR_REPO: "@pki/master"
    strategy:
      matrix: ${{ fromJSON(needs.init.outputs.matrix) }}
    steps:
      - name: Clone the repository
        uses: actions/checkout@v2

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v1

      - name: Build runner image
        uses: docker/build-push-action@v2
        with:
          context: .
          build-args: |
            OS_VERSION=${{ matrix.os }}
            COPR_REPO=${{ env.COPR_REPO }}
            BUILD_OPTS=--with-pkgs=base,server,acme,ca,kra --with-timestamp --with-commit-id
          tags: pki-runner
          target: pki-runner
          outputs: type=docker,dest=/tmp/pki-runner.tar

      - name: Upload runner image
        uses: actions/upload-artifact@v2
        with:
          name: pki-runner-${{ matrix.os }}
          path: /tmp/pki-runner.tar

  ipa-test:
    name: Testing IPA
    needs: [init, build]
    runs-on: ubuntu-latest
    env:
      BUILDDIR: /tmp/workdir
      PKIDIR: /tmp/workdir/pki
      COPR_REPO: "@pki/master"
    strategy:
      matrix: ${{ fromJSON(needs.init.outputs.matrix) }}
    steps:
      - name: Clone repository
        uses: actions/checkout@v2

      - name: Download runner image
        uses: actions/download-artifact@v2
        with:
          name: pki-runner-${{ matrix.os }}
          path: /tmp

      - name: Load runner image
        run: docker load --input /tmp/pki-runner.tar

      - name: Create network
        run: docker network create example

      - name: Run IPA container
        run: |
          IMAGE=pki-runner \
          NAME=ipa \
          HOSTNAME=ipa.example.com \
          tests/bin/runner-init.sh

      - name: Connect IPA container to network
        run: docker network connect example ipa --alias ipa.example.com --alias ipa-ca.example.com

      - name: Install IPA packages in IPA container
        run: |
          docker exec ipa dnf copr enable -y @freeipa/freeipa-master-nightly
          docker exec ipa dnf install -y freeipa-server freeipa-server-dns \
              python3-ipatests freeipa-healthcheck

      - name: Install IPA server in IPA container
        run: |
          docker exec ipa sysctl net.ipv6.conf.lo.disable_ipv6=0
          docker exec ipa ipa-server-install \
              -U \
              --domain example.com \
              -r EXAMPLE.COM \
              -p Secret.123 \
              -a Secret.123 \
              --setup-kra \
              --no-host-dns \
              --no-ntp
          docker exec ipa bash -c "echo Secret.123 | kinit admin"
          docker exec ipa ipa ping

      - name: Verify CA admin in IPA container
        run: |
          docker exec ipa pki-server cert-export ca_signing --cert-file ca_signing.crt
          docker exec ipa pki client-cert-import ca_signing --ca-cert ca_signing.crt
          docker exec ipa pki client-cert-import \
              --pkcs12 /root/ca-agent.p12 \
              --pkcs12-password Secret.123
          docker exec ipa pki -n ipa-ca-agent ca-user-show admin

      - name: Enable ACME in IPA container
        run: |
          docker exec ipa ipa-acme-manage enable
          docker exec ipa ipa-acme-manage status
          echo "Available" > expected
          docker exec ipa bash -c "pki acme-info | sed -n 's/\s*Status:\s\+\(\S\+\).*/\1/p' > ${PKIDIR}/actual"
          diff expected actual

      - name: Run client container
        run: |
          docker run \
              --detach \
              --name=client \
              --hostname=client.example.com \
              --privileged \
              --tmpfs /tmp \
              --tmpfs /run \
              pki-runner \
              /usr/sbin/init

      - name: Connect client container to network
        run: docker network connect example client --alias client.example.com

      - name: Install dependencies in client container
        run: |
          docker exec client dnf copr enable -y @freeipa/freeipa-master-nightly
          docker exec client dnf install -y freeipa-client certbot

      - name: Install IPA client in client container
        run: |
          docker exec client sysctl net.ipv6.conf.lo.disable_ipv6=0
          docker exec client ipa-client-install \
              -U \
              --server=ipa.example.com \
              --domain=example.com \
              --realm=EXAMPLE.COM \
              -p admin \
              -w Secret.123 \
              --no-ntp
          docker exec client bash -c "echo Secret.123 | kinit admin"
          docker exec client klist

      - name: Verify certbot in client container
        run: |
          docker exec client certbot register \
              --server https://ipa-ca.example.com/acme/directory \
              --email user1@example.com \
              --agree-tos \
              --non-interactive
          docker exec client certbot certonly \
              --server https://ipa-ca.example.com/acme/directory \
              -d client.example.com \
               --standalone \
              --non-interactive
          docker exec client certbot renew \
              --server https://ipa-ca.example.com/acme/directory \
              --cert-name client.example.com \
              --force-renewal \
              --non-interactive
          docker exec client certbot revoke \
              --server https://ipa-ca.example.com/acme/directory \
              --cert-name client.example.com \
              --non-interactive
          docker exec client certbot update_account \
              --server https://ipa-ca.example.com/acme/directory \
              --email user2@example.com \
              --non-interactive
          docker exec client certbot unregister \
              --server https://ipa-ca.example.com/acme/directory \
              --non-interactive

      - name: Disable ACME in IPA container
        run: |
          docker exec ipa ipa-acme-manage disable
          docker exec ipa ipa-acme-manage status
          echo "Unavailable" > expected
          docker exec ipa bash -c "pki acme-info | sed -n 's/\s*Status:\s\+\(\S\+\).*/\1/p' > ${PKIDIR}/actual"
          diff expected actual

      - name: Run IPA tests in IPA container
        run: docker exec ipa ${PKIDIR}/tests/bin/ipa-test.sh

      - name: Gather artifacts from IPA container
        if: always()
        run: |
          tests/bin/ds-artifacts-save.sh ipa EXAMPLE-COM
          tests/bin/pki-artifacts-save.sh ipa
          tests/bin/ipa-artifacts-save.sh ipa

      - name: Remove IPA server from IPA container
        run: docker exec ipa ipa-server-install --uninstall -U

      - name: Upload artifacts from IPA container
        if: always()
        uses: actions/upload-artifact@v2
        with:
          name: ipa-${{ matrix.os }}
          path: |
            /tmp/artifacts/ipa

  ipa-clone-test:
    name: Installing IPA Clone
    needs: [init, build]
    runs-on: ubuntu-latest
    env:
      BUILDDIR: /tmp/workdir
      PKIDIR: /tmp/workdir/pki
      COPR_REPO: "@pki/master"
    strategy:
      matrix: ${{ fromJSON(needs.init.outputs.matrix) }}
    steps:
      - name: Clone repository
        uses: actions/checkout@v2

      - name: Download runner image
        uses: actions/download-artifact@v2
        with:
          name: pki-runner-${{ matrix.os }}
          path: /tmp

      - name: Load runner image
        run: docker load --input /tmp/pki-runner.tar

      - name: Create network
        run: docker network create example

      - name: Run primary container
        run: |
          IMAGE=pki-runner \
          NAME=primary \
          HOSTNAME=primary.example.com \
          tests/bin/runner-init.sh

      - name: Connect primary container to network
        run: docker network connect example primary --alias primary.example.com

      - name: Install IPA packages in primary container
        run: |
          docker exec primary dnf copr enable -y @freeipa/freeipa-master-nightly
          docker exec primary dnf install -y freeipa-server freeipa-server-dns

      - name: Install IPA server in primary container
        run: |
          docker exec primary sysctl net.ipv6.conf.lo.disable_ipv6=0
          docker exec primary ipa-server-install \
              -U \
              --domain example.com \
              -r EXAMPLE.COM \
              -p Secret.123 \
              -a Secret.123 \
              --setup-kra \
              --no-host-dns \
              --no-ntp
          docker exec primary bash -c "echo Secret.123 | kinit admin"
          docker exec primary klist

      - name: Run secondary container
        run: |
          IMAGE=pki-runner \
          NAME=secondary \
          HOSTNAME=secondary.example.com \
          tests/bin/runner-init.sh

      - name: Connect secondary container to network
        run: docker network connect example secondary --alias secondary.example.com

      - name: Install IPA packages in secondary container
        run: |
          docker exec secondary dnf copr enable -y @freeipa/freeipa-master-nightly
          docker exec secondary dnf install -y freeipa-server freeipa-server-dns

      - name: Install IPA client in secondary container
        run: |
          docker exec secondary sysctl net.ipv6.conf.lo.disable_ipv6=0
          docker exec secondary ipa-client-install \
              -U \
              --server=primary.example.com \
              --domain=example.com \
              --realm=EXAMPLE.COM \
              -p admin \
              -w Secret.123 \
              --no-ntp
          docker exec secondary bash -c "echo Secret.123 | kinit admin"
          docker exec secondary klist

      - name: Promote IPA client into IPA replica in secondary container
        run: |
          docker exec secondary ipa-replica-install \
              --no-host-dns \
              --setup-ca \
              --setup-kra

      - name: Verify CA admin
        run: |
          docker exec primary cp /root/ca-agent.p12 ${PKIDIR}/ca-agent.p12
          docker exec secondary pki-server cert-export ca_signing --cert-file ca_signing.crt
          docker exec secondary pki client-cert-import ca_signing --ca-cert ca_signing.crt
          docker exec secondary pki client-cert-import --pkcs12 ${PKIDIR}/ca-agent.p12 --pkcs12-password Secret.123
          docker exec secondary pki -n ipa-ca-agent ca-user-show admin

      - name: Gather artifacts from primary container
        if: always()
        run: |
          tests/bin/ds-artifacts-save.sh primary EXAMPLE-COM
          tests/bin/pki-artifacts-save.sh primary
          tests/bin/ipa-artifacts-save.sh primary

      - name: Gather artifacts from secondary container
        if: always()
        run: |
          tests/bin/ds-artifacts-save.sh secondary EXAMPLE-COM
          tests/bin/pki-artifacts-save.sh secondary
          tests/bin/ipa-artifacts-save.sh secondary

      - name: Disconnect secondary container from network
        run: docker network disconnect example secondary

      - name: Disconnect primary container from network
        run: docker network disconnect example primary

      - name: Remove network
        run: docker network rm example

      - name: Upload artifacts from primary container
        if: always()
        uses: actions/upload-artifact@v2
        with:
          name: ipa-clone-primary-${{ matrix.os }}
          path: |
            /tmp/artifacts/primary

      - name: Upload artifacts from secondary container
        if: always()
        uses: actions/upload-artifact@v2
        with:
          name: ipa-clone-secondary-${{ matrix.os }}
          path: |
            /tmp/artifacts/secondary