Skip to content

Commit f7518c8

Browse files
MrMarbleMrMarble
authored
Merge pull request #1 from RedHatProductSecurity/OSIDB-3712
OSIDB-3712: Create container image
2 parents 77f3d1e + 4c28b98 commit f7518c8

File tree

14 files changed

+191
-26
lines changed

14 files changed

+191
-26
lines changed

‎.github/workflows/lint.yml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,9 @@ on:
44
push:
55
branches:
66
- main
7+
pull_request:
8+
branches:
9+
- main
710

811
jobs:
912
type-check:

‎.gitignore

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,3 +6,4 @@ node_modules/
66
/playwright/.auth/
77
.vscode
88
.env
9+
*.keytab

‎docker/.dockerignore

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
.gitignore
2+
*.md
3+
.git
4+
.vscode
5+
.github
6+
.husky
7+
test-results
8+
playwright-report
9+
user.json
10+
Dockerfile
11+
node_modules
12+
.env

‎docker/Dockerfile

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
FROM registry.redhat.io/ubi9/ubi:9.5 as base
2+
3+
ENV LANG=C.UTF-8
4+
ENV LC_ALL=C.UTF-8
5+
ENV KRB5CCNAME=/tmp/cache
6+
7+
COPY docker/krb5.conf /etc/krb5.conf
8+
COPY docker/install-certs.sh /install-certs.sh
9+
COPY docker/auth.sh /auth.sh
10+
11+
RUN ./install-certs.sh $RH_CERT_URL \
12+
&& yum update -y \
13+
&& yum install -y wget git krb5-workstation \
14+
# Playwright dependencies
15+
libxcb libXdamage libXcursor libXext libXcomposite libXrandr \
16+
libXi pango cairo cairo-gobject libXrender gtk3 atk gdk-pixbuf2 \
17+
# NodeJS
18+
&& yum module install -y nodejs:20/common \
19+
&& yum clean all \
20+
&& npm install -g yarn \
21+
&& mkdir -p /krb5 \
22+
&& chmod 755 /krb5 \
23+
&& mkdir -p /var/lib/sss/pubconf/krb5.include.d \
24+
&& chmod 755 /etc/krb5.conf.d \
25+
&& chown -R 1001:0 /etc/krb5.conf.d \
26+
&& chown 1001:0 /etc/krb5.conf \
27+
&& chown -R 1001:0 /krb5
28+
29+
FROM base as build
30+
31+
WORKDIR /app
32+
ENV PLAYWRIGHT_BROWSERS_PATH=0
33+
34+
COPY --chown=1001 package.json /app/package.json
35+
COPY --chown=1001 yarn.lock /app/yarn.lock
36+
COPY --chown=1001 playwright.config.ts /app/playwright.config.ts
37+
COPY --chown=1001 tsconfig.json /app/tsconfig.json
38+
COPY --chown=1001 docker/krb5.conf.d /etc/krb5.conf.d
39+
COPY --chown=1001 docker/krb5.keytab /krb5/krb5.keytab
40+
41+
RUN yarn install --frozen-lockfile \
42+
&& yarn playwright install chromium firefox
43+
44+
COPY --chown=1001 . /app
45+
46+
USER 1001
47+
48+
CMD ["/bin/sh"]

‎docker/README.md

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
# OSIM UI + Kerberos Tests Container
2+
3+
This is the container that is used to run the tests on the CI/CD pipeline. It is based on redhat's ubi9 image and has the necessary dependencies to run the tests.
4+
5+
## Building the container
6+
Before building the container, you need to prepare some files.
7+
8+
1. Create a `krb5.keytab` file in the `docker` directory. This file is used to authenticate with kerberos.
9+
```bash
10+
$ ktutil
11+
ktutil: addent -password -p <principal> -k 1 -e aes256-cts-hmac-sha1-96 -f
12+
ktutil: wkt krb5.keytab
13+
ktutil: quit
14+
```
15+
2. Create a `crypto-policies` file in the `krb5.conf.d` directory. You should have this file in `/etc/krb5.conf.d/` or `/usr/bin/krb5-conf/` on your machine.
16+
17+
18+
3. Provide the correct realm configuration in a file inside the `krb5.conf.d` directory. You should have this file in `/etc/krb5.conf` on your machine.
19+
20+
21+
That should look like this:
22+
```bash
23+
|-- docker
24+
| |-- krb5.conf.d
25+
| | |-- crypto-policies
26+
| | |-- realm # name of the file is not important
27+
| |-- krb5.keytab
28+
| |-- krb5.conf
29+
| |-- Dockerfile
30+
```
31+
32+
After preparing the files, you can build the container using the following command:
33+
34+
> [!IMPORTANT]
35+
> Make sure to run the command from the root of the project.
36+
> (outside of the docker folder)
37+
38+
```bash
39+
podman build -t osim-ui-tests -f docker/Dockerfile --ignorefile docker/.dockerignore .
40+
# to install RH certificates add --env RH_CERT_URL=<url> to the command
41+
```
42+
43+
## Running the container
44+
Make sure to provide the required [environment variables](/README.md#required-environment-variables) when running the container:
45+
46+
```bash
47+
podman run --rm -it --env-file .env osim-ui-tests
48+
```
49+
50+
## Running the tests
51+
52+
You need to authenticate with kerberos before running the tests. You can do this by running the script **inside the container**:
53+
54+
```bash
55+
sh /auth.sh
56+
```
57+
58+
After authenticating, you can run the tests using the following command:
59+
60+
```bash
61+
yarn test
62+
```

‎docker/auth.sh

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
#!/bin/sh
2+
3+
principal="$( klist -kt /krb5/krb5.keytab | grep -Eo -m1 '\w+@[A-Z.]+' )"
4+
5+
kinit -k -t /krb5/krb5.keytab $principal
6+
klist -c /tmp/cache

‎docker/install-certs.sh

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
#!/bin/sh
2+
3+
if [[ -z "${1}" ]]; then
4+
echo -e "\e[1;33mWARNING: RH_CERT_URL environment variable not set, internal RH resources won't be accessible\e[0m"
5+
else
6+
curl "${1}/certs/Current-IT-Root-CAs.pem" -o /etc/pki/ca-trust/source/anchors/Current-IT-Root-CAs.pem
7+
mkdir -p /etc/ipa
8+
curl "${1}/chains/ipa-ca-chain-2015.crt" -o /etc/ipa/ipa.crt
9+
update-ca-trust
10+
fi

‎docker/krb5.conf

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
# To opt out of the system crypto-policies configuration of krb5, remove the
2+
# symlink at /etc/krb5.conf.d/crypto-policies which will not be recreated.
3+
includedir /etc/krb5.conf.d/
4+
5+
[logging]
6+
default = FILE:/var/log/krb5libs.log
7+
kdc = FILE:/var/log/krb5kdc.log
8+
admin_server = FILE:/var/log/kadmind.log
9+
10+
[libdefaults]
11+
dns_lookup_realm = false
12+
ticket_lifetime = 24h
13+
renew_lifetime = 7d
14+
forwardable = true
15+
rdns = false
16+
pkinit_anchors = FILE:/etc/pki/tls/certs/ca-bundle.crt
17+
spake_preauth_groups = edwards25519
18+
dns_canonicalize_hostname = fallback
19+
qualify_shortname = ""
20+
# default_realm = EXAMPLE.COM
21+
default_ccache_name = KEYRING:persistent:%{uid}
22+
23+
[realms]
24+
# EXAMPLE.COM = {
25+
# kdc = kerberos.example.com
26+
# admin_server = kerberos.example.com
27+
# }
28+
29+
[domain_realm]
30+
# .example.com = EXAMPLE.COM
31+
# example.com = EXAMPLE.COM

‎docker/krb5.conf.d/.gitignore

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
*
2+
!.gitignore

‎package.json

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,6 @@
66
"private": true,
77
"devDependencies": {
88
"@faker-js/faker": "^9.2.0",
9-
"@playwright/browser-chromium": "^1.48.2",
10-
"@playwright/browser-firefox": "^1.48.2",
119
"@playwright/test": "^1.48.2",
1210
"@stylistic/eslint-plugin": "^2.10.1",
1311
"@types/eslint__js": "^8.42.3",
@@ -26,9 +24,9 @@
2624
"undici": "^6.21.0"
2725
},
2826
"scripts": {
29-
"test": "playwright test --reporter=list",
30-
"test:chrome": "playwright test --reporter=list --project=chrome",
31-
"test:firefox": "playwright test --reporter=list --project=firefox",
27+
"test": "playwright test",
28+
"test:chromium": "playwright test --project=chromium",
29+
"test:firefox": "playwright test --project=firefox",
3230
"dev": "playwright test --ui",
3331
"lint": "eslint . ",
3432
"lint:fix": "eslint . --fix",

0 commit comments

Comments
 (0)