tks-tests.yml

name: TKS Tests

on: [push, pull_request]

jobs:
  init:
    name: Initialization
    uses: ./.github/workflows/init.yml
    secrets: inherit

  build:
    name: Waiting for build
    needs: init
    runs-on: ubuntu-latest
    steps:
      - name: Wait for build
        uses: lewagon/wait-on-check-action@v1.2.0
        with:
          ref: ${{ github.ref }}
          check-name: 'Building PKI'
          repo-token: ${{ secrets.GITHUB_TOKEN }}
          wait-interval: 30
        if: github.event_name == 'push'

      - name: Wait for build
        uses: lewagon/wait-on-check-action@v1.2.0
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          check-name: 'Building PKI'
          repo-token: ${{ secrets.GITHUB_TOKEN }}
          wait-interval: 30
        if: github.event_name == 'pull_request'

  # docs/installation/tks/Installing_TKS.md
  tks-test:
    name: Testing TKS
    needs: [init, build]
    runs-on: ubuntu-latest
    env:
      PKIDIR: /tmp/workdir/pki
    steps:
      - name: Clone repository
        uses: actions/checkout@v3

      - name: Retrieve pki-runner image
        uses: actions/cache@v3
        with:
          key: pki-runner-${{ github.sha }}
          path: pki-runner.tar

      - name: Load runner image
        run: docker load --input pki-runner.tar

      - name: Run container
        run: |
          IMAGE=pki-runner \
          NAME=pki \
          HOSTNAME=pki.example.com \
          tests/bin/runner-init.sh

      - name: Install dependencies
        run: docker exec pki dnf install -y 389-ds-base

      - name: Install DS
        run: docker exec pki ${PKIDIR}/tests/bin/ds-create.sh

      - name: Install CA
        run: docker exec pki pkispawn -f /usr/share/pki/server/examples/installation/ca.cfg -s CA -v

      - name: Install TKS
        run: docker exec pki pkispawn -f /usr/share/pki/server/examples/installation/tks.cfg -s TKS -v

      - name: Run PKI healthcheck
        run: docker exec pki pki-healthcheck --failures-only

      - name: Verify TKS admin
        run: |
          docker exec pki pki-server cert-export ca_signing --cert-file ca_signing.crt
          docker exec pki pki client-cert-import ca_signing --ca-cert ca_signing.crt
          docker exec pki pki client-cert-import \
              --pkcs12 /root/.dogtag/pki-tomcat/ca_admin_cert.p12 \
              --pkcs12-password-file /root/.dogtag/pki-tomcat/ca/pkcs12_password.conf
          docker exec pki pki -n caadmin tks-user-show tksadmin

      - name: Gather artifacts
        if: always()
        run: |
          tests/bin/ds-artifacts-save.sh pki
          tests/bin/pki-artifacts-save.sh pki

      - name: Remove TKS
        run: docker exec pki pkidestroy -i pki-tomcat -s TKS -v

      - name: Remove CA
        run: docker exec pki pkidestroy -i pki-tomcat -s CA -v

      - name: Remove DS
        run: docker exec pki ${PKIDIR}/tests/bin/ds-remove.sh

      - name: Upload artifacts
        if: always()
        uses: actions/upload-artifact@v3
        with:
          name: tks
          path: |
            /tmp/artifacts/pki

  tks-separate-test:
    name: Testing TKS on separate instance
    needs: [init, build]
    runs-on: ubuntu-latest
    env:
      PKIDIR: /tmp/workdir/pki
    steps:
      - name: Clone repository
        uses: actions/checkout@v3

      - name: Retrieve pki-runner image
        uses: actions/cache@v3
        with:
          key: pki-runner-${{ github.sha }}
          path: pki-runner.tar

      - name: Load runner image
        run: docker load --input pki-runner.tar

      - name: Create network
        run: docker network create example

      - name: Setup CA container
        run: |
          IMAGE=pki-runner \
          NAME=ca \
          HOSTNAME=ca.example.com \
          tests/bin/runner-init.sh

      - name: Connect CA container to network
        run: docker network connect example ca --alias ca.example.com

      - name: Install dependencies in CA container
        run: docker exec ca dnf install -y 389-ds-base

      - name: Install DS in CA container
        run: docker exec ca ${PKIDIR}/tests/bin/ds-create.sh

      - name: Install CA in CA container
        run: docker exec ca pkispawn -f /usr/share/pki/server/examples/installation/ca.cfg -s CA -v

      - name: Install banner in CA container
        run: docker exec ca cp /usr/share/pki/server/examples/banner/banner.txt /etc/pki/pki-tomcat

      - name: Setup TKS container
        run: |
          IMAGE=pki-runner \
          NAME=tks \
          HOSTNAME=tks.example.com \
          tests/bin/runner-init.sh

      - name: Connect TKS container to network
        run: docker network connect example tks --alias tks.example.com

      - name: Install dependencies in TKS container
        run: docker exec tks dnf install -y 389-ds-base

      - name: Install DS in TKS container
        run: docker exec tks ${PKIDIR}/tests/bin/ds-create.sh

      - name: Install TKS in TKS container
        run: |
          docker exec ca pki-server cert-export ca_signing --cert-file ${PKIDIR}/ca_signing.crt
          docker exec ca cp /root/.dogtag/pki-tomcat/ca_admin.cert ${PKIDIR}/ca_admin.cert
          docker exec tks cp ${PKIDIR}/ca_signing.crt .
          docker exec tks cp ${PKIDIR}/ca_admin.cert .
          docker exec tks pkispawn -f /usr/share/pki/server/examples/installation/tks-separate.cfg -s TKS -v

      - name: Install banner in TKS container
        run: docker exec tks cp /usr/share/pki/server/examples/banner/banner.txt /etc/pki/pki-tomcat

      - name: Run PKI healthcheck
        run: docker exec tks pki-healthcheck --debug

      - name: Verify TKS admin
        run: |
          docker exec ca cp /root/.dogtag/pki-tomcat/ca_admin_cert.p12 ${PKIDIR}/ca_admin_cert.p12
          docker exec ca cp /root/.dogtag/pki-tomcat/ca/pkcs12_password.conf ${PKIDIR}/pkcs12_password.conf
          docker exec tks pki client-cert-import ca_signing --ca-cert ca_signing.crt
          docker exec tks pki client-cert-import \
              --pkcs12 ${PKIDIR}/ca_admin_cert.p12 \
              --pkcs12-password-file ${PKIDIR}/pkcs12_password.conf
          docker exec tks pki -n caadmin --ignore-banner tks-user-show tksadmin

      - name: Gather artifacts from CA container
        if: always()
        run: |
          tests/bin/ds-artifacts-save.sh ca
          tests/bin/pki-artifacts-save.sh ca

      - name: Gather artifacts from TKS container
        if: always()
        run: |
          tests/bin/ds-artifacts-save.sh tks
          tests/bin/pki-artifacts-save.sh tks

      - name: Remove TKS from TKS container
        run: docker exec tks pkidestroy -i pki-tomcat -s TKS -v

      - name: Remove DS from TKS container
        run: docker exec tks ${PKIDIR}/tests/bin/ds-remove.sh

      - name: Disconnect TKS container from network
        run: docker network disconnect example tks

      - name: Remove CA from CA container
        run: docker exec ca pkidestroy -i pki-tomcat -s CA -v

      - name: Remove DS from CA container
        run: docker exec ca ${PKIDIR}/tests/bin/ds-remove.sh

      - name: Disconnect CA container from network
        run: docker network disconnect example ca

      - name: Remove network
        run: docker network rm example

      - name: Upload artifacts from CA container
        if: always()
        uses: actions/upload-artifact@v3
        with:
          name: tks-separate-ca
          path: |
            /tmp/artifacts/ca

      - name: Upload artifacts from TKS container
        if: always()
        uses: actions/upload-artifact@v3
        with:
          name: tks-separate-tks
          path: |
            /tmp/artifacts/tks

  # docs/installation/tks/Installing_TKS_Clone.md
  # This test installs DS, CA, and TKS in the primary container,
  # then installs DS clone, CA clone, and TKS clone in the secondary container.
  tks-clone-test:
    name: Testing TKS clone
    needs: [init, build]
    runs-on: ubuntu-latest
    env:
      PKIDIR: /tmp/workdir/pki
    steps:
      - name: Clone repository
        uses: actions/checkout@v3

      - name: Retrieve pki-runner image
        uses: actions/cache@v3
        with:
          key: pki-runner-${{ github.sha }}
          path: pki-runner.tar

      - name: Load runner image
        run: docker load --input pki-runner.tar

      - name: Create network
        run: docker network create example

      - name: Run primary container
        run: |
          IMAGE=pki-runner \
          NAME=primary \
          HOSTNAME=primary.example.com \
          tests/bin/runner-init.sh

      - name: Connect primary container to network
        run: docker network connect example primary --alias primary.example.com

      - name: Install dependencies in primary container
        run: docker exec primary dnf install -y 389-ds-base

      - name: Install DS in primary container
        run: docker exec primary ${PKIDIR}/tests/bin/ds-create.sh

      - name: Install CA in primary container
        run: docker exec primary pkispawn -f /usr/share/pki/server/examples/installation/ca.cfg -s CA -v

      - name: Install TKS in primary container
        run: docker exec primary pkispawn -f /usr/share/pki/server/examples/installation/tks.cfg -s TKS -v

      - name: Setup secondary container
        run: |
          IMAGE=pki-runner \
          NAME=secondary \
          HOSTNAME=secondary.example.com \
          tests/bin/runner-init.sh

      - name: Connect secondary container to network
        run: docker network connect example secondary --alias secondary.example.com

      - name: Install dependencies in secondary container
        run: docker exec secondary dnf install -y 389-ds-base

      - name: Install DS in secondary container
        run: docker exec secondary ${PKIDIR}/tests/bin/ds-create.sh

      - name: Install CA in secondary container
        run: |
          docker exec primary pki-server cert-export ca_signing --cert-file ${PKIDIR}/ca_signing.crt
          docker exec primary pki-server ca-clone-prepare --pkcs12-file ${PKIDIR}/ca-certs.p12 --pkcs12-password Secret.123
          docker exec secondary cp ${PKIDIR}/ca_signing.crt .
          docker exec secondary cp ${PKIDIR}/ca-certs.p12 .
          docker exec secondary pkispawn -f /usr/share/pki/server/examples/installation/ca-clone.cfg -s CA -v

      - name: Install TKS in secondary container
        run: |
          docker exec primary pki-server tks-clone-prepare --pkcs12-file ${PKIDIR}/tks-certs.p12 --pkcs12-password Secret.123
          docker exec secondary cp ${PKIDIR}/tks-certs.p12 .
          docker exec secondary pkispawn -f /usr/share/pki/server/examples/installation/tks-clone.cfg -s TKS -v

      - name: Verify TKS admin in secondary container
        run: |
          docker exec primary cp /root/.dogtag/pki-tomcat/ca_admin_cert.p12 ${PKIDIR}/ca_admin_cert.p12
          docker exec primary cp /root/.dogtag/pki-tomcat/ca/pkcs12_password.conf ${PKIDIR}/pkcs12_password.conf
          docker exec secondary pki client-cert-import ca_signing --ca-cert ca_signing.crt
          docker exec secondary pki client-cert-import \
              --pkcs12 ${PKIDIR}/ca_admin_cert.p12 \
              --pkcs12-password-file ${PKIDIR}/pkcs12_password.conf
          docker exec secondary pki -n caadmin --ignore-banner tks-user-show tksadmin

      - name: Setup tertiary container
        run: |
          IMAGE=pki-runner \
          NAME=tertiary \
          HOSTNAME=tertiary.example.com \
          tests/bin/runner-init.sh

      - name: Connect tertiary container to network
        run: docker network connect example tertiary --alias tertiary.example.com

      - name: Install dependencies in tertiary container
        run: docker exec tertiary dnf install -y 389-ds-base

      - name: Install DS in tertiary container
        run: docker exec tertiary ${PKIDIR}/tests/bin/ds-create.sh

      - name: Install CA in tertiary container
        run: |
          docker exec secondary pki-server cert-export ca_signing --cert-file ${PKIDIR}/ca_signing.crt
          docker exec secondary pki-server ca-clone-prepare --pkcs12-file ${PKIDIR}/ca-certs.p12 --pkcs12-password Secret.123
          docker exec tertiary cp ${PKIDIR}/ca_signing.crt .
          docker exec tertiary cp ${PKIDIR}/ca-certs.p12 .
          docker exec tertiary pkispawn -f /usr/share/pki/server/examples/installation/ca-clone-of-clone.cfg -s CA -v

      - name: Install TKS in tertiary container
        run: |
          docker exec secondary pki-server tks-clone-prepare --pkcs12-file ${PKIDIR}/tks-certs.p12 --pkcs12-password Secret.123
          docker exec tertiary cp ${PKIDIR}/tks-certs.p12 .
          docker exec tertiary pkispawn -f /usr/share/pki/server/examples/installation/tks-clone-of-clone.cfg -s TKS -v

      - name: Verify TKS admin in tertiary container
        run: |
          docker exec tertiary pki client-cert-import ca_signing --ca-cert ca_signing.crt
          docker exec tertiary pki client-cert-import \
              --pkcs12 ${PKIDIR}/ca_admin_cert.p12 \
              --pkcs12-password-file ${PKIDIR}/pkcs12_password.conf
          docker exec tertiary pki -n caadmin tks-user-show tksadmin

      - name: Gather config files from primary container
        run: |
          tests/bin/ds-artifacts-save.sh primary
          tests/bin/pki-artifacts-save.sh primary

      - name: Gather config files from secondary container
        if: always()
        run: |
          tests/bin/ds-artifacts-save.sh secondary
          tests/bin/pki-artifacts-save.sh secondary

      - name: Gather config files from tertiary container
        if: always()
        run: |
          tests/bin/ds-artifacts-save.sh tertiary
          tests/bin/pki-artifacts-save.sh tertiary

      - name: Remove TKS from tertiary container
        run: docker exec tertiary pkidestroy -i pki-tomcat -s TKS -v

      - name: Remove CA from tertiary container
        run: docker exec tertiary pkidestroy -i pki-tomcat -s CA -v

      - name: Remove DS from tertiary container
        run: docker exec tertiary ${PKIDIR}/tests/bin/ds-remove.sh

      - name: Disconnect tertiary container from network
        run: docker network disconnect example tertiary

      - name: Remove TKS from secondary container
        run: docker exec secondary pkidestroy -i pki-tomcat -s TKS -v

      - name: Remove CA from secondary container
        run: docker exec secondary pkidestroy -i pki-tomcat -s CA -v

      - name: Remove DS from secondary container
        run: docker exec secondary ${PKIDIR}/tests/bin/ds-remove.sh

      - name: Disconnect secondary container from network
        run: docker network disconnect example secondary

      - name: Remove TKS from primary container
        run: docker exec primary pkidestroy -i pki-tomcat -s TKS -v

      - name: Remove CA from primary container
        run: docker exec primary pkidestroy -i pki-tomcat -s CA -v

      - name: Remove DS from primary container
        run: docker exec primary ${PKIDIR}/tests/bin/ds-remove.sh

      - name: Disconnect primary container from network
        run: docker network disconnect example primary

      - name: Remove network
        run: docker network rm example

      - name: Upload artifacts from primary container
        if: always()
        uses: actions/upload-artifact@v3
        with:
          name: tks-clone-primary
          path: |
            /tmp/artifacts/primary

      - name: Upload artifacts from secondary container
        if: always()
        uses: actions/upload-artifact@v3
        with:
          name: tks-clone-secondary
          path: |
            /tmp/artifacts/secondary

      - name: Upload artifacts from tertiary container
        if: always()
        uses: actions/upload-artifact@v3
        with:
          name: tks-clone-tertiary
          path: |
            /tmp/artifacts/tertiary