Skip to content

Commit 89531ad

Browse files
edewataedewata
committed
Add option to remove config folder
The pkidestroy and pki-server remove commands have been modified to keep the config folder by default but provide an option to remove the folder. The security_databases.py has also been modified to no longer remove the client NSS database. This will allow the subsystem to be reinstalled with the same config files (including the certs). The basic installation tests have been modified to verify that the config folder still exists after server removal. New tests have been added to install PKI subsystems with existing config files from previous installation.
1 parent 352ca19 commit 89531ad

25 files changed

+1003
-63
lines changed

‎.github/workflows/ca-basic-test.yml

+20-3
Original file line numberDiff line numberDiff line change
@@ -360,6 +360,7 @@ jobs:
360360
361361
# TODO: review permissions
362362
cat > expected << EOF
363+
lrwxrwxrwx pkiuser pkiuser conf -> /etc/pki/pki-tomcat
363364
lrwxrwxrwx pkiuser pkiuser logs -> /var/log/pki/pki-tomcat
364365
EOF
365366
@@ -369,13 +370,29 @@ jobs:
369370
run: |
370371
# check file types, owners, and permissions
371372
docker exec pki ls -l /etc/pki/pki-tomcat \
372-
> >(tee stdout) 2> >(tee stderr >&2) || true
373+
| sed \
374+
-e '/^total/d' \
375+
-e 's/^\(\S*\) *\S* *\(\S*\) *\(\S*\) *\S* *\S* *\S* *\S* *\(.*\)$/\1 \2 \3 \4/' \
376+
| tee output
373377
378+
# TODO: review permissions
374379
cat > expected << EOF
375-
ls: cannot access '/etc/pki/pki-tomcat': No such file or directory
380+
drwxrwx--- pkiuser pkiuser Catalina
381+
drwxrwx--- pkiuser pkiuser alias
382+
drwxrwx--- pkiuser pkiuser ca
383+
-rw-r--r-- pkiuser pkiuser catalina.policy
384+
lrwxrwxrwx pkiuser pkiuser catalina.properties -> /usr/share/pki/server/conf/catalina.properties
385+
drwxrwx--- pkiuser pkiuser certs
386+
lrwxrwxrwx pkiuser pkiuser context.xml -> /etc/tomcat/context.xml
387+
lrwxrwxrwx pkiuser pkiuser logging.properties -> /usr/share/pki/server/conf/logging.properties
388+
-rw-rw---- pkiuser pkiuser password.conf
389+
-rw-rw---- pkiuser pkiuser server.xml
390+
-rw-rw---- pkiuser pkiuser serverCertNick.conf
391+
-rw-rw---- pkiuser pkiuser tomcat.conf
392+
lrwxrwxrwx pkiuser pkiuser web.xml -> /etc/tomcat/web.xml
376393
EOF
377394
378-
diff expected stderr
395+
diff expected output
379396
380397
- name: Check PKI server logs dir after removal
381398
run: |

‎.github/workflows/ca-existing-config-test.yml

+141
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,141 @@
1+
name: CA with existing config
2+
3+
on: workflow_call
4+
5+
env:
6+
DB_IMAGE: ${{ vars.DB_IMAGE || 'quay.io/389ds/dirsrv' }}
7+
8+
jobs:
9+
test:
10+
name: Test
11+
runs-on: ubuntu-latest
12+
env:
13+
SHARED: /tmp/workdir/pki
14+
steps:
15+
- name: Clone repository
16+
uses: actions/checkout@v4
17+
18+
- name: Retrieve PKI images
19+
uses: actions/cache@v4
20+
with:
21+
key: pki-images-${{ github.sha }}
22+
path: pki-images.tar
23+
24+
- name: Load PKI images
25+
run: docker load --input pki-images.tar
26+
27+
- name: Create network
28+
run: docker network create example
29+
30+
- name: Set up DS container
31+
run: |
32+
tests/bin/ds-container-create.sh ds
33+
env:
34+
IMAGE: ${{ env.DB_IMAGE }}
35+
HOSTNAME: ds.example.com
36+
PASSWORD: Secret.123
37+
38+
- name: Connect DS container to network
39+
run: docker network connect example ds --alias ds.example.com
40+
41+
- name: Set up PKI container
42+
run: |
43+
tests/bin/runner-init.sh pki
44+
env:
45+
HOSTNAME: pki.example.com
46+
47+
- name: Connect PKI container to network
48+
run: docker network connect example pki --alias pki.example.com
49+
50+
- name: Install CA
51+
run: |
52+
docker exec pki pkispawn \
53+
-f /usr/share/pki/server/examples/installation/ca.cfg \
54+
-s CA \
55+
-D pki_ds_url=ldap://ds.example.com:3389 \
56+
-v
57+
58+
- name: Check system certs
59+
run: |
60+
docker exec pki pki \
61+
-d /var/lib/pki/pki-tomcat/conf/alias \
62+
nss-cert-find | tee system-certs.orig
63+
64+
- name: Check CA admin
65+
run: |
66+
docker exec pki pki-server cert-export ca_signing --cert-file ca_signing.crt
67+
docker exec pki pki client-cert-import ca_signing --ca-cert ca_signing.crt
68+
docker exec pki pki pkcs12-import \
69+
--pkcs12 /root/.dogtag/pki-tomcat/ca_admin_cert.p12 \
70+
--pkcs12-password Secret.123
71+
72+
docker exec pki pki nss-cert-find | tee admin-cert.orig
73+
74+
docker exec pki pki -n caadmin ca-user-show caadmin
75+
76+
- name: Remove CA
77+
run: |
78+
docker exec pki pkidestroy -i pki-tomcat -s CA -v
79+
80+
- name: Install CA again
81+
run: |
82+
docker exec pki pkispawn \
83+
-f /usr/share/pki/server/examples/installation/ca.cfg \
84+
-s CA \
85+
-D pki_ds_url=ldap://ds.example.com:3389 \
86+
-v
87+
88+
- name: Check system certs again
89+
run: |
90+
docker exec pki pki \
91+
-d /var/lib/pki/pki-tomcat/conf/alias \
92+
nss-cert-find | tee system-certs.new
93+
94+
# system certs should not change
95+
diff system-certs.orig system-certs.new
96+
97+
- name: Check CA admin again
98+
run: |
99+
docker exec pki pki nss-cert-find | tee admin-cert.new
100+
101+
# admin cert should not change
102+
diff admin-cert.orig admin-cert.new
103+
104+
docker exec pki pki -n caadmin ca-user-show caadmin
105+
106+
- name: Remove CA again
107+
run: docker exec pki pkidestroy -i pki-tomcat -s CA -v
108+
109+
- name: Check DS server systemd journal
110+
if: always()
111+
run: |
112+
docker exec ds journalctl -x --no-pager -u [email protected]
113+
114+
- name: Check DS container logs
115+
if: always()
116+
run: |
117+
docker logs ds
118+
119+
- name: Check PKI server systemd journal
120+
if: always()
121+
run: |
122+
docker exec pki journalctl -x --no-pager -u [email protected]
123+
124+
- name: Check CA debug log
125+
if: always()
126+
run: |
127+
docker exec pki find /var/log/pki/pki-tomcat/ca -name "debug.*" -exec cat {} \;
128+
129+
- name: Gather artifacts
130+
if: always()
131+
run: |
132+
tests/bin/ds-artifacts-save.sh ds
133+
tests/bin/pki-artifacts-save.sh pki
134+
continue-on-error: true
135+
136+
- name: Upload artifacts
137+
if: always()
138+
uses: actions/upload-artifact@v4
139+
with:
140+
name: ca-existing-config
141+
path: /tmp/artifacts

‎.github/workflows/ca-tests.yml

+5
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,11 @@ jobs:
4848
needs: build
4949
uses: ./.github/workflows/ca-existing-ds-test.yml
5050

51+
ca-existing-config-test:
52+
name: CA with existing config
53+
needs: build
54+
uses: ./.github/workflows/ca-existing-config-test.yml
55+
5156
ca-cmc-shared-token-test:
5257
name: CA with CMC shared token
5358
needs: build

‎.github/workflows/kra-basic-test.yml

+21-3
Original file line numberDiff line numberDiff line change
@@ -471,6 +471,7 @@ jobs:
471471
472472
# TODO: review permissions
473473
cat > expected << EOF
474+
lrwxrwxrwx pkiuser pkiuser conf -> /etc/pki/pki-tomcat
474475
lrwxrwxrwx pkiuser pkiuser logs -> /var/log/pki/pki-tomcat
475476
EOF
476477
@@ -480,13 +481,30 @@ jobs:
480481
run: |
481482
# check file types, owners, and permissions
482483
docker exec pki ls -l /etc/pki/pki-tomcat \
483-
> >(tee stdout) 2> >(tee stderr >&2) || true
484+
| sed \
485+
-e '/^total/d' \
486+
-e 's/^\(\S*\) *\S* *\(\S*\) *\(\S*\) *\S* *\S* *\S* *\S* *\(.*\)$/\1 \2 \3 \4/' \
487+
| tee output
484488
489+
# TODO: review permissions
485490
cat > expected << EOF
486-
ls: cannot access '/etc/pki/pki-tomcat': No such file or directory
491+
drwxrwx--- pkiuser pkiuser Catalina
492+
drwxrwx--- pkiuser pkiuser alias
493+
drwxrwx--- pkiuser pkiuser ca
494+
-rw-r--r-- pkiuser pkiuser catalina.policy
495+
lrwxrwxrwx pkiuser pkiuser catalina.properties -> /usr/share/pki/server/conf/catalina.properties
496+
drwxrwx--- pkiuser pkiuser certs
497+
lrwxrwxrwx pkiuser pkiuser context.xml -> /etc/tomcat/context.xml
498+
drwxrwx--- pkiuser pkiuser kra
499+
lrwxrwxrwx pkiuser pkiuser logging.properties -> /usr/share/pki/server/conf/logging.properties
500+
-rw-rw---- pkiuser pkiuser password.conf
501+
-rw-rw---- pkiuser pkiuser server.xml
502+
-rw-rw---- pkiuser pkiuser serverCertNick.conf
503+
-rw-rw---- pkiuser pkiuser tomcat.conf
504+
lrwxrwxrwx pkiuser pkiuser web.xml -> /etc/tomcat/web.xml
487505
EOF
488506
489-
diff expected stderr
507+
diff expected output
490508
491509
- name: Check PKI server logs dir after removal
492510
run: |

‎.github/workflows/kra-existing-config-test.yml

+146
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,146 @@
1+
name: KRA with existing config
2+
3+
on: workflow_call
4+
5+
env:
6+
DB_IMAGE: ${{ vars.DB_IMAGE || 'quay.io/389ds/dirsrv' }}
7+
8+
jobs:
9+
test:
10+
name: Test
11+
runs-on: ubuntu-latest
12+
env:
13+
SHARED: /tmp/workdir/pki
14+
steps:
15+
- name: Clone repository
16+
uses: actions/checkout@v4
17+
18+
- name: Retrieve PKI images
19+
uses: actions/cache@v4
20+
with:
21+
key: pki-images-${{ github.sha }}
22+
path: pki-images.tar
23+
24+
- name: Load PKI images
25+
run: docker load --input pki-images.tar
26+
27+
- name: Create network
28+
run: docker network create example
29+
30+
- name: Set up DS container
31+
run: |
32+
tests/bin/ds-container-create.sh ds
33+
env:
34+
IMAGE: ${{ env.DB_IMAGE }}
35+
HOSTNAME: ds.example.com
36+
PASSWORD: Secret.123
37+
38+
- name: Connect DS container to network
39+
run: docker network connect example ds --alias ds.example.com
40+
41+
- name: Set up PKI container
42+
run: |
43+
tests/bin/runner-init.sh pki
44+
env:
45+
HOSTNAME: pki.example.com
46+
47+
- name: Connect PKI container to network
48+
run: docker network connect example pki --alias pki.example.com
49+
50+
- name: Install CA
51+
run: |
52+
docker exec pki pkispawn \
53+
-f /usr/share/pki/server/examples/installation/ca.cfg \
54+
-s CA \
55+
-D pki_ds_url=ldap://ds.example.com:3389 \
56+
-v
57+
58+
- name: Install KRA
59+
run: |
60+
docker exec pki pkispawn \
61+
-f /usr/share/pki/server/examples/installation/kra.cfg \
62+
-s KRA \
63+
-D pki_ds_url=ldap://ds.example.com:3389 \
64+
-v
65+
66+
- name: Check system certs
67+
run: |
68+
docker exec pki pki \
69+
-d /var/lib/pki/pki-tomcat/conf/alias \
70+
nss-cert-find | tee system-certs.orig
71+
72+
- name: Check KRA admin
73+
run: |
74+
docker exec pki pki-server cert-export ca_signing --cert-file ca_signing.crt
75+
docker exec pki pki client-cert-import ca_signing --ca-cert ca_signing.crt
76+
docker exec pki pki pkcs12-import \
77+
--pkcs12 /root/.dogtag/pki-tomcat/ca_admin_cert.p12 \
78+
--pkcs12-password Secret.123
79+
80+
docker exec pki pki nss-cert-find | tee admin-cert.orig
81+
82+
docker exec pki pki -n caadmin kra-user-show kraadmin
83+
84+
- name: Remove KRA
85+
run: docker exec pki pkidestroy -i pki-tomcat -s KRA -v
86+
87+
- name: Install KRA again
88+
run: |
89+
docker exec pki pkispawn \
90+
-f /usr/share/pki/server/examples/installation/kra.cfg \
91+
-s KRA \
92+
-D pki_ds_url=ldap://ds.example.com:3389 \
93+
-v
94+
95+
- name: Check system certs again
96+
run: |
97+
docker exec pki pki \
98+
-d /var/lib/pki/pki-tomcat/conf/alias \
99+
nss-cert-find | tee system-certs.new
100+
101+
# system certs should not change
102+
diff system-certs.orig system-certs.new
103+
104+
- name: Check KRA admin again
105+
run: |
106+
docker exec pki pki nss-cert-find | tee admin-cert.new
107+
108+
# admin cert should not change
109+
diff admin-cert.orig admin-cert.new
110+
111+
docker exec pki pki -n caadmin kra-user-show kraadmin
112+
113+
- name: Remove KRA again
114+
run: docker exec pki pkidestroy -i pki-tomcat -s KRA -v
115+
116+
- name: Remove CA
117+
run: docker exec pki pkidestroy -i pki-tomcat -s CA -v
118+
119+
- name: Check PKI server systemd journal
120+
if: always()
121+
run: |
122+
docker exec pki journalctl -x --no-pager -u [email protected]
123+
124+
- name: Check CA debug log
125+
if: always()
126+
run: |
127+
docker exec pki find /var/lib/pki/pki-tomcat/logs/ca -name "debug.*" -exec cat {} \;
128+
129+
- name: Check KRA debug log
130+
if: always()
131+
run: |
132+
docker exec pki find /var/lib/pki/pki-tomcat/logs/kra -name "debug.*" -exec cat {} \;
133+
134+
- name: Gather artifacts
135+
if: always()
136+
run: |
137+
tests/bin/ds-artifacts-save.sh ds
138+
tests/bin/pki-artifacts-save.sh pki
139+
continue-on-error: true
140+
141+
- name: Upload artifacts
142+
if: always()
143+
uses: actions/upload-artifact@v4
144+
with:
145+
name: kra-existing-config
146+
path: /tmp/artifacts

‎.github/workflows/kra-tests.yml

+5
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,11 @@ jobs:
5353
needs: build
5454
uses: ./.github/workflows/kra-existing-ds-test.yml
5555

56+
kra-existing-config-test:
57+
name: KRA with existing config
58+
needs: build
59+
uses: ./.github/workflows/kra-existing-config-test.yml
60+
5661
kra-cmc-test:
5762
name: KRA with CMC
5863
needs: build

0 commit comments

Comments
 (0)