ipa-clone-test.yml

name: IPA clone

on: workflow_call

env:
  DS_IMAGE: ${{ vars.DS_IMAGE || 'quay.io/389ds/dirsrv' }}

jobs:
  test:
    name: Test
    runs-on: ubuntu-latest
    env:
      SHARED: /tmp/workdir/pki
    steps:
      - name: Clone repository
        uses: actions/checkout@v4

      - name: Retrieve IPA images
        uses: actions/cache@v4
        with:
          key: ipa-images-${{ github.sha }}
          path: ipa-images.tar

      - name: Load IPA images
        run: docker load --input ipa-images.tar

      - name: Create network
        run: docker network create example

      - name: Run primary container
        run: |
          tests/bin/runner-init.sh primary
        env:
          IMAGE: ipa-runner
          HOSTNAME: primary.example.com

      - name: Connect primary container to network
        run: docker network connect example primary --alias primary.example.com

      - name: Install IPA server in primary container
        run: |
          docker exec primary sysctl net.ipv6.conf.lo.disable_ipv6=0
          docker exec primary ipa-server-install \
              -U \
              --domain example.com \
              -r EXAMPLE.COM \
              -p Secret.123 \
              -a Secret.123 \
              --no-host-dns \
              --no-ntp

      - name: Check CA database config in primary IPA
        run: |
          docker exec primary pki-server ca-config-find | grep "^internaldb\." | tee output

          cat > expected << EOF
          internaldb._000=##
          internaldb._001=## Internal Database
          internaldb._002=##
          internaldb.basedn=o=ipaca
          internaldb.database=ipaca
          internaldb.ldapauth.authtype=SslClientAuth
          internaldb.ldapauth.bindDN=cn=Directory Manager
          internaldb.ldapauth.bindPWPrompt=internaldb
          internaldb.ldapauth.clientCertNickname=subsystemCert cert-pki-ca
          internaldb.ldapconn.host=primary.example.com
          internaldb.ldapconn.port=636
          internaldb.ldapconn.secureConn=true
          internaldb.maxConns=15
          internaldb.minConns=3
          internaldb.multipleSuffix.enable=false
          EOF

          diff expected output

      - name: Check CA CRL config in primary IPA
        run: |
          docker exec primary pki-server ca-config-find | grep ca.crl.MasterCRL

          # CRL cache should be enabled
          echo "true" > expected
          docker exec primary pki-server ca-config-show ca.crl.MasterCRL.enableCRLCache | tee actual
          diff expected actual

          # CRL updates should be enabled
          echo "true" > expected
          docker exec primary pki-server ca-config-show ca.crl.MasterCRL.enableCRLUpdates | tee actual
          diff expected actual

          # CA should listen to clone modifications
          echo "true" > expected
          docker exec primary pki-server ca-config-show ca.listenToCloneModifications | tee actual
          diff expected actual

      - name: Check primary IPA server config
        run: |
          docker exec primary bash -c "echo Secret.123 | kinit admin"
          docker exec primary klist

          docker exec primary ipa config-show | tee output

          # primary server should be IPA master
          echo "primary.example.com" > expected
          sed -n -e 's/^ *IPA masters: *\(.*\)$/\1/p' output | tee actual
          diff expected actual

          # primary server should have CA
          echo "primary.example.com" > expected
          sed -n -e 's/^ *IPA CA servers: *\(.*\)$/\1/p' output | tee actual
          diff expected actual

          # primary server should be the renewal master
          echo "primary.example.com" > expected
          sed -n -e 's/^ *IPA CA renewal master: *\(.*\)$/\1/p' output | tee actual
          diff expected actual

      - name: Install KRA in primary container
        run: |
          docker exec primary ipa-kra-install -p Secret.123

      - name: Check KRA connector config
        run: |
          # KRA connector should be enabled
          echo "true" > expected
          docker exec primary pki-server ca-config-show ca.connector.KRA.enable | tee actual
          diff expected actual

          # KRA connector points to primary KRA
          echo "primary.example.com" > expected
          docker exec primary pki-server ca-config-show ca.connector.KRA.host | tee actual
          diff expected actual

      - name: Check primary IPA server config after KRA installation
        run: |
          docker exec primary ipa config-show | tee output

          # primary servers should have KRA
          echo "primary.example.com" > expected
          sed -n -e 's/^ *IPA KRA servers: *\(.*\)$/\1/p' output | tee actual
          diff expected actual

      - name: Run secondary container
        run: |
          tests/bin/runner-init.sh secondary
        env:
          IMAGE: ipa-runner
          HOSTNAME: secondary.example.com

      - name: Connect secondary container to network
        run: docker network connect example secondary --alias secondary.example.com

      - name: Install IPA client in secondary container
        run: |
          docker exec secondary sysctl net.ipv6.conf.lo.disable_ipv6=0
          docker exec secondary ipa-client-install \
              -U \
              --server=primary.example.com \
              --domain=example.com \
              --realm=EXAMPLE.COM \
              -p admin \
              -w Secret.123 \
              --no-ntp

          docker exec secondary bash -c "echo Secret.123 | kinit admin"
          docker exec secondary klist

          docker exec secondary ipa config-show

      - name: Promote IPA client into IPA replica in secondary container
        run: |
          # install basic IPA replica (without CA and KRA)
          docker exec secondary ipa-replica-install --no-host-dns

          docker exec secondary ipa config-show

      - name: Install CA in secondary container
        run: |
          docker exec secondary ipa-ca-install -p Secret.123

          docker exec secondary ipa config-show

      - name: Check CA database config in secondary IPA
        run: |
          docker exec secondary pki-server ca-config-find | grep "^internaldb\." | tee output

          cat > expected << EOF
          internaldb._000=##
          internaldb._001=## Internal Database
          internaldb._002=##
          internaldb.basedn=o=ipaca
          internaldb.database=ipaca
          internaldb.ldapauth.authtype=SslClientAuth
          internaldb.ldapauth.bindDN=cn=Directory Manager
          internaldb.ldapauth.bindPWPrompt=internaldb
          internaldb.ldapauth.clientCertNickname=subsystemCert cert-pki-ca
          internaldb.ldapconn.host=secondary.example.com
          internaldb.ldapconn.port=636
          internaldb.ldapconn.secureConn=true
          internaldb.maxConns=15
          internaldb.minConns=3
          internaldb.multipleSuffix.enable=false
          EOF

          diff expected output

      - name: Check CA CRL config in primary IPA
        run: |
          docker exec primary pki-server ca-config-find | grep ca.crl.MasterCRL

          # CRL cache should be enabled
          echo "true" > expected
          docker exec primary pki-server ca-config-show ca.crl.MasterCRL.enableCRLCache | tee actual
          diff expected actual

          # CRL updates should be enabled
          echo "true" > expected
          docker exec primary pki-server ca-config-show ca.crl.MasterCRL.enableCRLUpdates | tee actual
          diff expected actual

          # CA should listen to clone modifications
          echo "true" > expected
          docker exec primary pki-server ca-config-show ca.listenToCloneModifications | tee actual
          diff expected actual

      - name: Check CA CRL config in secondary IPA
        run: |
          docker exec secondary pki-server ca-config-find | grep ca.crl.MasterCRL

          # CRL cache should be disabled
          echo "false" > expected
          docker exec secondary pki-server ca-config-show ca.crl.MasterCRL.enableCRLCache | tee actual
          diff expected actual

          # CRL updates should be disabled
          echo "false" > expected
          docker exec secondary pki-server ca-config-show ca.crl.MasterCRL.enableCRLUpdates | tee actual
          diff expected actual

          # CA should not listen to clone modifications
          echo "false" > expected
          docker exec secondary pki-server ca-config-show ca.listenToCloneModifications | tee actual
          diff expected actual

      - name: Install KRA in secondary container
        run: |
          docker exec secondary ipa-kra-install -p Secret.123

      - name: Check schema in primary DS and secondary DS
        if: always()
        run: |
          docker exec primary ldapsearch \
              -H ldap://primary.example.com:389 \
              -D "cn=Directory Manager" \
              -w Secret.123 \
              -x \
              -b cn=schema \
              -o ldif_wrap=no \
              -LLL \
              objectClasses attributeTypes \
              | grep "\-oid" | sort | tee primary.schema

          docker exec secondary ldapsearch \
              -H ldap://secondary.example.com:389 \
              -D "cn=Directory Manager" \
              -w Secret.123 \
              -x \
              -b cn=schema \
              -o ldif_wrap=no \
              -LLL \
              objectClasses attributeTypes \
              | grep "\-oid" | sort | tee secondary.schema

          diff primary.schema secondary.schema

      - name: Check replication managers on primary DS
        if: always()
        run: |
          docker exec primary ldapsearch \
              -H ldap://primary.example.com:389 \
              -D "cn=Directory Manager" \
              -w Secret.123 \
              -x \
              -b "cn=config" \
              -o ldif_wrap=no \
              -LLL \
              "(cn=replication manager)"

          docker exec primary ldapsearch \
              -H ldap://primary.example.com:389 \
              -D "cn=Directory Manager" \
              -w Secret.123 \
              -x \
              -b "cn=replication managers,cn=sysaccounts,cn=etc,dc=example,dc=com" \
              -o ldif_wrap=no \
              -LLL

      - name: Check replication managers on secondary DS
        if: always()
        run: |
          docker exec secondary ldapsearch \
              -H ldap://secondary.example.com:389 \
              -D "cn=Directory Manager" \
              -w Secret.123 \
              -x \
              -b "cn=config" \
              -o ldif_wrap=no \
              -LLL \
              "(cn=replication manager)"

          docker exec secondary ldapsearch \
              -H ldap://secondary.example.com:389 \
              -D "cn=Directory Manager" \
              -w Secret.123 \
              -x \
              -b "cn=replication managers,cn=sysaccounts,cn=etc,dc=example,dc=com" \
              -o ldif_wrap=no \
              -LLL

      - name: Check replica objects on primary DS
        if: always()
        run: |
          docker exec primary ldapsearch \
              -H ldap://primary.example.com:389 \
              -D "cn=Directory Manager" \
              -w Secret.123 \
              -x \
              -b "cn=replica,cn=dc\3Dexample\2Cdc\3Dcom,cn=mapping tree,cn=config" \
              -s base \
              -o ldif_wrap=no \
              -LLL

          docker exec primary ldapsearch \
              -H ldap://primary.example.com:389 \
              -D "cn=Directory Manager" \
              -w Secret.123 \
              -x \
              -b "cn=replica,cn=o\3Dipaca,cn=mapping tree,cn=config" \
              -s base \
              -o ldif_wrap=no \
              -LLL

      - name: Check replica objects on secondary DS
        if: always()
        run: |
          docker exec secondary ldapsearch \
              -H ldap://secondary.example.com:389 \
              -D "cn=Directory Manager" \
              -w Secret.123 \
              -x \
              -b "cn=replica,cn=dc\3Dexample\2Cdc\3Dcom,cn=mapping tree,cn=config" \
              -s base \
              -o ldif_wrap=no \
              -LLL

          docker exec secondary ldapsearch \
              -H ldap://secondary.example.com:389 \
              -D "cn=Directory Manager" \
              -w Secret.123 \
              -x \
              -b "cn=replica,cn=o\3Dipaca,cn=mapping tree,cn=config" \
              -s base \
              -o ldif_wrap=no \
              -LLL

      - name: Check replication agreements on primary DS
        run: |
          docker exec primary ldapsearch \
              -H ldap://primary.example.com:389 \
              -D "cn=Directory Manager" \
              -w Secret.123 \
              -x \
              -b "cn=meTosecondary.example.com,cn=replica,cn=dc\3Dexample\2Cdc\3Dcom,cn=mapping tree,cn=config" \
              -s base \
              -o ldif_wrap=no \
              -LLL

          docker exec primary ldapsearch \
              -H ldap://primary.example.com:389 \
              -D "cn=Directory Manager" \
              -w Secret.123 \
              -x \
              -b "cn=caTosecondary.example.com,cn=replica,cn=o\3Dipaca,cn=mapping tree,cn=config" \
              -s base \
              -o ldif_wrap=no \
              -LLL

      - name: Check replication agreements on secondary DS
        run: |
          docker exec secondary ldapsearch \
              -H ldap://secondary.example.com:389 \
              -D "cn=Directory Manager" \
              -w Secret.123 \
              -x \
              -b "cn=meToprimary.example.com,cn=replica,cn=dc\3Dexample\2Cdc\3Dcom,cn=mapping tree,cn=config" \
              -s base \
              -o ldif_wrap=no \
              -LLL

          docker exec secondary ldapsearch \
              -H ldap://secondary.example.com:389 \
              -D "cn=Directory Manager" \
              -w Secret.123 \
              -x \
              -b "cn=caToprimary.example.com,cn=replica,cn=o\3Dipaca,cn=mapping tree,cn=config" \
              -s base \
              -o ldif_wrap=no \
              -LLL

      - name: Check KRA connector config
        run: |
          # KRA connector should be enabled in primary CA
          echo "true" > expected
          docker exec primary pki-server ca-config-show ca.connector.KRA.enable | tee actual
          diff expected actual

           # KRA connector should be enabled in secondary CA
          echo "true" > expected
          docker exec secondary pki-server ca-config-show ca.connector.KRA.enable | tee actual
          diff expected actual

          # KRA connector points to primary KRA in primary CA
          echo "primary.example.com" > expected
          docker exec primary pki-server ca-config-show ca.connector.KRA.host | tee actual
          diff expected actual

          # KRA connector points to both KRAs in secondary CA
          echo "primary.example.com:8443 secondary.example.com:8443" > expected
          docker exec secondary pki-server ca-config-show ca.connector.KRA.host | tee actual
          diff expected actual

          # KRA connectors should be consistent
          # https://pagure.io/freeipa/issue/9432

      - name: Check IPA server config
        run: |
          docker exec primary ipa config-show | tee output

          # both servers should be IPA masters
          echo "primary.example.com, secondary.example.com" > expected
          sed -n -e 's/^ *IPA masters: *\(.*\)$/\1/p' output | tee actual
          diff expected actual

          # both servers should have CA
          echo "primary.example.com, secondary.example.com" > expected
          sed -n -e 's/^ *IPA CA servers: *\(.*\)$/\1/p' output | tee actual
          diff expected actual

          # both servers should have KRA
          echo "primary.example.com, secondary.example.com" > expected
          sed -n -e 's/^ *IPA KRA servers: *\(.*\)$/\1/p' output | tee actual
          diff expected actual

          # primary server should be the renewal master
          echo "primary.example.com" > expected
          sed -n -e 's/^ *IPA CA renewal master: *\(.*\)$/\1/p' output | tee actual
          diff expected actual

      - name: Change renewal master
        run: |
          # get CS.cfg before renewal update
          docker cp primary:/var/lib/pki/pki-tomcat/conf/ca/CS.cfg CS.cfg.primary.orig
          docker cp secondary:/var/lib/pki/pki-tomcat/conf/ca/CS.cfg CS.cfg.secondary.orig

          # move renewal master to secondary server
          docker exec primary ipa config-mod \
              --ca-renewal-master-server secondary.example.com

          docker exec primary ipa config-show | tee output

          # secondary server should be the renewal master
          echo "secondary.example.com" > expected
          sed -n -e 's/^ *IPA CA renewal master: *\(.*\)$/\1/p' output | tee actual
          diff expected actual

      - name: Check primary CA config
        run: |
          docker cp primary:/var/lib/pki/pki-tomcat/conf/ca/CS.cfg CS.cfg.primary.after-renewal-update

          # renewal config is maintained by IPA, so there should be no change in PKI
          diff CS.cfg.primary.orig CS.cfg.primary.after-renewal-update

      - name: Check secondary CA config
        run: |
          docker cp secondary:/var/lib/pki/pki-tomcat/conf/ca/CS.cfg CS.cfg.secondary.after-renewal-update

          # renewal config is maintained by IPA, so there should be no change in PKI
          diff CS.cfg.secondary.orig CS.cfg.secondary.after-renewal-update

      - name: Check CA CSR copied correctly 
        run: |
          docker cp primary:/var/lib/pki/pki-tomcat/conf/certs primary-certs
          docker cp secondary:/var/lib/pki/pki-tomcat/conf/certs secondary-certs

          diff primary-certs/ca_audit_signing.csr secondary-certs/ca_audit_signing.csr
          diff primary-certs/ca_ocsp_signing.csr secondary-certs/ca_ocsp_signing.csr
          diff primary-certs/ca_signing.csr secondary-certs/ca_signing.csr

      - name: Check CRL generation config
        run: |
          docker exec primary ipa-crlgen-manage status | tee output

          # CRL generation should be enabled in primary CA
          echo "enabled" > expected
          sed -n -e 's/^ *CRL generation: *\(.*\)$/\1/p' output | tee actual
          diff expected actual

          docker exec secondary ipa-crlgen-manage status | tee output

          # CRL generation should be disabled in secondary CA
          echo "disabled" > expected
          sed -n -e 's/^ *CRL generation: *\(.*\)$/\1/p' output | tee actual
          diff expected actual

      - name: Change CRL master
        run: |
          # move CRL generation to secondary server
          docker exec primary ipa-crlgen-manage disable
          docker exec secondary ipa-crlgen-manage enable

          docker exec primary ipa-crlgen-manage status | tee output

          # CRL generation should be disabled on the primary server
          echo "disabled" > expected
          sed -n -e 's/^ *CRL generation: *\(.*\)$/\1/p' output | tee actual
          diff expected actual

          docker exec secondary ipa-crlgen-manage status | tee output

          # CRL generation should be enabled on the secondary server
          echo "enabled" > expected
          sed -n -e 's/^ *CRL generation: *\(.*\)$/\1/p' output | tee actual
          diff expected actual

      - name: Check CRL generation config in primary CA
        run: |
          # get CS.cfg from primary CA after CRL generation update
          docker cp primary:/var/lib/pki/pki-tomcat/conf/ca/CS.cfg CS.cfg.primary.after-crl-update

          docker exec primary pki-server ca-config-find | grep ca.crl.MasterCRL

          # normalize expected result:
          # - CRL, cache, and updates should be disabled in primary CA
          sed -e 's/^\(ca.crl.MasterCRL.enable\)=.*$/\1=false/' \
              -e 's/^\(ca.crl.MasterCRL.enableCRLCache\)=.*$/\1=false/' \
              -e 's/^\(ca.crl.MasterCRL.enableCRLUpdates\)=.*$/\1=false/' \
              -e 's/^\(ca.listenToCloneModifications\)=.*$/\1=false/' \
              -e '$ a ca.certStatusUpdateInterval=0' \
              CS.cfg.primary.after-renewal-update \
              | sort > expected

          # normalize actual result
          # - temporarily change ca.crl.MasterCRL.enable to false
          #   TODO: remove this change once the following PR is merged:
          #   https://github.com/freeipa/freeipa/pull/6971
          sed -e 's/^\(ca.crl.MasterCRL.enable\)=.*$/\1=false/' \
              CS.cfg.primary.after-crl-update \
              | sort > actual

          diff expected actual

      - name: Check CRL generation config in secondary CA
        run: |
          # get CS.cfg from secondary CA after CRL generation update
          docker cp secondary:/var/lib/pki/pki-tomcat/conf/ca/CS.cfg CS.cfg.secondary.after-crl-update

          docker exec secondary pki-server ca-config-find | grep ca.crl.MasterCRL

          # normalize expected result:
          # - CRL, cache, and updates should be enabled in secondary CA
          sed -e 's/^\(ca.crl.MasterCRL.enable\)=.*$/\1=true/' \
              -e 's/^\(ca.crl.MasterCRL.enableCRLCache\)=.*$/\1=true/' \
              -e 's/^\(ca.crl.MasterCRL.enableCRLUpdates\)=.*$/\1=true/' \
              -e 's/^\(ca.listenToCloneModifications\)=.*$/\1=true/' \
              CS.cfg.secondary.after-renewal-update \
              | sort > expected

          # normalize actual result
          sed -e '$ a ca.certStatusUpdateInterval=0' \
              CS.cfg.secondary.after-crl-update | sort > actual

          diff expected actual

      - name: Run PKI healthcheck in primary container
        run: docker exec primary pki-healthcheck --failures-only

      - name: Run PKI healthcheck in secondary container
        run: docker exec secondary pki-healthcheck --failures-only

      - name: Verify CA admin
        run: |
          docker exec primary cp /root/ca-agent.p12 ${SHARED}/ca-agent.p12
          docker exec secondary pki-server cert-export ca_signing --cert-file ca_signing.crt

          docker exec secondary pki nss-cert-import \
              --cert ca_signing.crt \
              --trust CT,C,C \
              ca_signing

          docker exec secondary pki pkcs12-import \
              --pkcs12 ${SHARED}/ca-agent.p12 \
              --pkcs12-password Secret.123
          docker exec secondary pki -n ipa-ca-agent ca-user-show admin

      - name: Check subca replication from primary
        run: |
          docker exec primary ipa ca-add subca --subject cn=subca,O=EXAMPLE.COM
          docker exec primary ipa ca-find | tee output-primary
          docker exec secondary ipa ca-find | tee output-secondary
          diff output-primary output-secondary
          echo "Number of entries returned 2" > expected
          grep "Number of entries returned" output-secondary > actual
          diff expected actual

      - name: Remove subca from clone
        run: |
          docker exec secondary ipa ca-disable subca
          docker exec secondary ipa ca-del subca
          docker exec secondary ipa ca-find | tee output-secondary
          docker exec primary ipa ca-find | tee output-primary
          diff output-primary output-secondary
          echo "Number of entries returned 1" > expected
          grep "Number of entries returned" output-primary > actual
          diff expected actual

      - name: Check HTTPD access logs in primary container
        if: always()
        run: |
          docker exec primary cat /var/log/httpd/access_log

      - name: Check HTTPD error logs in primary container
        if: always()
        run: |
          docker exec primary cat /var/log/httpd/error_log

      - name: Check DS server systemd journal in primary container
        if: always()
        run: |
          docker exec primary journalctl -x --no-pager -u dirsrv@EXAMPLE-COM.service

      - name: Check DS access logs in primary container
        if: always()
        run: |
          docker exec primary cat /var/log/dirsrv/slapd-EXAMPLE-COM/access

      - name: Check DS error logs in primary container
        if: always()
        run: |
          docker exec primary cat /var/log/dirsrv/slapd-EXAMPLE-COM/errors

      - name: Check DS security logs in primary container
        if: always()
        run: |
          docker exec primary cat /var/log/dirsrv/slapd-EXAMPLE-COM/security

      - name: Check PKI server systemd journal in primary container
        if: always()
        run: |
          docker exec primary journalctl -x --no-pager -u pki-tomcatd@pki-tomcat.service

      - name: Check PKI server access log in primary container
        if: always()
        run: |
          docker exec primary find /var/log/pki/pki-tomcat -name "localhost_access_log.*" -exec cat {} \;

      - name: Check CA debug log in primary container
        if: always()
        run: |
          docker exec primary find /var/lib/pki/pki-tomcat/logs/ca -name "debug.*" -exec cat {} \;

      - name: Gather artifacts from primary container
        if: always()
        run: |
          tests/bin/ds-artifacts-save.sh primary --instance EXAMPLE-COM
          tests/bin/pki-artifacts-save.sh primary
          tests/bin/ipa-artifacts-save.sh primary
        continue-on-error: true

      - name: Remove IPA server from primary container
        run: |
          docker exec secondary ipa server-del primary.example.com
          docker exec primary ipa-server-install --uninstall -U

      - name: Check IPA config after removing primary server
        run: |
          docker exec secondary ipa config-show | tee output

          # secondary server should be IPA master
          echo "secondary.example.com" > expected
          sed -n -e 's/^ *IPA masters: *\(.*\)$/\1/p' output | tee actual
          diff expected actual

          # CA should only be available on secondary server
          echo "secondary.example.com" > expected
          sed -n -e 's/^ *IPA CA servers: *\(.*\)$/\1/p' output | tee actual
          diff expected actual

          # KRA should only be available on secondary server
          echo "secondary.example.com" > expected
          sed -n -e 's/^ *IPA KRA servers: *\(.*\)$/\1/p' output | tee actual
          diff expected actual

          # secondary server should be the renewal master
          echo "secondary.example.com" > expected
          sed -n -e 's/^ *IPA CA renewal master: *\(.*\)$/\1/p' output | tee actual
          diff expected actual

      - name: Check CRL generator after removing primary server
        run: |
          docker exec secondary ipa-crlgen-manage status | tee output

          # CRL generation should be enabled on the secondary server
          echo "enabled" > expected
          sed -n -e 's/^ *CRL generation: *\(.*\)$/\1/p' output | tee actual
          diff expected actual

      - name: Check KRA connector after removing primary server
        run: |
          # KRA connector should only point to secondary KRA,
          # but currently primary KRA is still listed
          # https://pagure.io/freeipa/issue/9432
          echo "secondary.example.com" > expected
          docker exec secondary pki-server ca-config-show ca.connector.KRA.host | tee actual
          diff expected actual || true

      - name: Check HTTPD access logs in secondary container
        if: always()
        run: |
          docker exec secondary cat /var/log/httpd/access_log

      - name: Check HTTPD error logs in secondary container
        if: always()
        run: |
          docker exec secondary cat /var/log/httpd/error_log

      - name: Check DS server systemd journal in secondary container
        if: always()
        run: |
          docker exec secondary journalctl -x --no-pager -u dirsrv@EXAMPLE-COM.service

      - name: Check DS access logs in secondary container
        if: always()
        run: |
          docker exec secondary cat /var/log/dirsrv/slapd-EXAMPLE-COM/access

      - name: Check DS error logs in secondary container
        if: always()
        run: |
          docker exec secondary cat /var/log/dirsrv/slapd-EXAMPLE-COM/errors

      - name: Check DS security logs in secondary container
        if: always()
        run: |
          docker exec secondary cat /var/log/dirsrv/slapd-EXAMPLE-COM/security

      - name: Check PKI server systemd journal in secondary container
        if: always()
        run: |
          docker exec secondary journalctl -x --no-pager -u pki-tomcatd@pki-tomcat.service

      - name: Check PKI server access log in secondary container
        if: always()
        run: |
          docker exec secondary find /var/log/pki/pki-tomcat -name "localhost_access_log.*" -exec cat {} \;

      - name: Check CA debug log in secondary container
        if: always()
        run: |
          docker exec secondary find /var/lib/pki/pki-tomcat/logs/ca -name "debug.*" -exec cat {} \;

      - name: Gather artifacts from secondary container
        if: always()
        run: |
          tests/bin/ds-artifacts-save.sh secondary --instance EXAMPLE-COM
          tests/bin/pki-artifacts-save.sh secondary
          tests/bin/ipa-artifacts-save.sh secondary
        continue-on-error: true

      - name: Remove IPA server from secondary container
        run: docker exec secondary ipa-server-install --uninstall -U --ignore-last-of-role

      - name: Upload artifacts
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: ipa-clone-test
          path: /tmp/artifacts