Test refresh of internal CA doesn't break the bundle #3144
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | ||
| name: Test | ||
| on: | ||
| push: | ||
| branches: | ||
| - master | ||
| - '*-stable' | ||
| pull_request: | ||
| concurrency: | ||
| group: ${{ github.ref_name }}-${{ github.workflow }} | ||
| cancel-in-progress: true | ||
| jobs: | ||
| ansible-lint: | ||
| name: Ansible Lint | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v7 | ||
| - name: Set up Python | ||
| uses: actions/setup-python@v6 | ||
| with: | ||
| python-version: '3.12' | ||
| - name: Run ansible-lint on src | ||
| uses: ansible/ansible-lint@main | ||
| with: | ||
| requirements_file: requirements.yml | ||
| working_directory: src | ||
| setup_python: false | ||
| - name: Run ansible-lint on development | ||
| uses: ansible/ansible-lint@main | ||
| with: | ||
| requirements_file: requirements.yml | ||
| working_directory: development | ||
| setup_python: false | ||
| python-lint: | ||
| name: Python Lint | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v7 | ||
| - name: Set up Python | ||
| uses: actions/setup-python@v6 | ||
| with: | ||
| python-version: '3.12' | ||
| - name: Install dependencies | ||
| run: | | ||
| pip install --upgrade pip | ||
| pip install ruff | ||
| - name: Run ruff | ||
| run: ruff check --output-format=github tests/ src/ development/scripts/ inventories/ | ||
| tests: | ||
| strategy: | ||
| fail-fast: false | ||
| matrix: | ||
| certificate_source: | ||
| - default | ||
| security: | ||
| - none | ||
| database: | ||
| - internal | ||
| box: | ||
| - centos/stream9 | ||
| - centos/stream10 | ||
| iop: | ||
| - enabled | ||
| include: | ||
| - certificate_source: default | ||
| security: fapolicyd | ||
| database: internal | ||
| box: centos/stream9 | ||
| iop: disabled | ||
| - certificate_source: default | ||
| security: none | ||
| database: external | ||
| box: centos/stream9 | ||
| iop: disabled | ||
| - certificate_source: custom_server | ||
| security: none | ||
| database: internal | ||
| box: centos/stream9 | ||
| runs-on: ubuntu-24.04 | ||
| env: | ||
| FOREMANCTL_BASE_BOX: ${{ matrix.box }} | ||
| name: "Tests (certificates: ${{ matrix.certificate_source }}, database: ${{ matrix.database }}, security: ${{ matrix.security }}, box: ${{ matrix.box }}, iop: ${{ matrix.iop }})" | ||
| steps: | ||
| - name: generate artifact suffix | ||
| run: echo "ARTIFACT_SUFFIX=$(echo '${{ matrix.certificate_source }}-${{ matrix.security }}-${{ matrix.database }}-${{ matrix.box }}-iop${{ matrix.iop }}' | tr -cd '[:alnum:]-')" >> "${GITHUB_ENV}" | ||
| - uses: actions/checkout@v7 | ||
| - name: Set up Python | ||
| uses: actions/setup-python@v6 | ||
| with: | ||
| python-version: '3.12' | ||
| - name: Setup libvirt for Vagrant | ||
| uses: voxpupuli/setup-vagrant@v0 | ||
| with: | ||
| configure_dns: true | ||
| - name: Install Ansible | ||
| run: pip install --upgrade ansible-core | ||
| - name: Setup environment | ||
| run: ./setup-environment | ||
| - name: Start VMs | ||
| run: | | ||
| ./forge vms start --vms "quadlet client ${{ matrix.database == 'external' && 'database' || '' }}" | ||
| - name: Configure remote-database | ||
| if: matrix.database == 'external' | ||
| run: | | ||
| ./forge remote-database | ||
| - name: Configure repositories | ||
| run: | | ||
| ./forge setup-repositories | ||
| - name: Create custom certificates | ||
| if: matrix.certificate_source == 'custom_server' | ||
| run: | | ||
| ./forge custom-certs | ||
| - name: Setup security mode ${{ matrix.security }} | ||
| if: matrix.security != 'none' | ||
| run: | | ||
| ./forge security --mode ${{ matrix.security }} | ||
| - name: Apply fapolicyd workarounds | ||
| # https://access.redhat.com/solutions/7072618 / https://issues.redhat.com/browse/RHEL-37912 | ||
| # https://github.com/theforeman/foreman-fapolicyd/blob/develop/15-foreman-container.rules | ||
| if: matrix.security == 'fapolicyd' | ||
| run: | | ||
| vagrant ssh --command "echo 'allow perm=any pattern=ld_so exe=/usr/bin/crun : path=/usr/lib64/libsystemd.so.0' | sudo tee -a /etc/fapolicyd/rules.d/15-foremanctl.rules" quadlet | ||
| vagrant ssh --command "echo 'allow perm=any all : dir=/home/vagrant/.ansible/tmp/' | sudo tee -a /etc/fapolicyd/rules.d/15-foremanctl.rules" quadlet | ||
| vagrant ssh quadlet -- sudo systemctl restart fapolicyd | ||
| - name: Run image pull | ||
| run: | | ||
| ./foremanctl pull-images ${{ matrix.database == 'external' && '--database-mode=external' || '' }} | ||
| - name: Run deployment | ||
| run: | | ||
| ./foremanctl deploy \ | ||
| --certificate-source=${{ matrix.certificate_source }} \ | ||
| ${{ matrix.database == 'external' && '--database-mode=external --database-host=database.example.com --database-ssl-ca $(pwd)/.var/lib/foremanctl/db-ca.crt --database-ssl-mode verify-full' || '' }} \ | ||
| ${{ matrix.certificate_source == 'custom_server' && '--certificate-server-certificate /root/custom-certificates/certs/quadlet.example.com.crt --certificate-server-key /root/custom-certificates/private/quadlet.example.com.key --certificate-server-ca-certificate /root/custom-certificates/certs/ca.crt' || '' }} \ | ||
| --initial-admin-password=changeme \ | ||
| --initial-organization "Foreman CI" \ | ||
| --initial-location "Internet" \ | ||
| --tuning development \ | ||
| --content-import-path /custom/import \ | ||
| --content-export-path /custom/export | ||
| - name: Deploy features | ||
| run: | | ||
| ./foremanctl deploy \ | ||
| --add-feature hammer \ | ||
| --add-feature foreman-proxy \ | ||
| --add-feature azure-rm \ | ||
| --add-feature google \ | ||
| --add-feature remote-execution \ | ||
| --add-feature bmc \ | ||
| ${{ matrix.iop == 'enabled' && '--add-feature iop' || '' }} | ||
| - name: Run tests | ||
| run: | | ||
| ./forge test | ||
| - name: Run smoker | ||
| run: | | ||
| ./forge smoker | ||
| - name: Archive smoker report | ||
| if: ${{ always() }} | ||
| uses: actions/upload-artifact@v7 | ||
| with: | ||
| name: smoker-${{ env.ARTIFACT_SUFFIX }} | ||
| path: "/home/runner/smoker/report/" | ||
| - name: Generate sos reports | ||
| if: ${{ always() }} | ||
| run: ./forge sos | ||
| - name: Archive sos reports | ||
| if: ${{ always() }} | ||
| uses: actions/upload-artifact@v7 | ||
| with: | ||
| name: sosreport-${{ env.ARTIFACT_SUFFIX }} | ||
| path: sos/ | ||
| - name: Setup upterm session | ||
| if: ${{ failure() }} | ||
| uses: owenthereal/action-upterm@v1 | ||
| with: | ||
| ## limits ssh access and adds the ssh public key for the user which triggered the workflow | ||
| limit-access-to-actor: true | ||
| ## If no one connects after 5 minutes, shut down server. | ||
| wait-timeout-minutes: 5 | ||
| devel-tests: | ||
| strategy: | ||
| fail-fast: false | ||
| runs-on: ubuntu-24.04 | ||
| steps: | ||
| - uses: actions/checkout@v7 | ||
| - name: Set up Python | ||
| uses: actions/setup-python@v6 | ||
| with: | ||
| python-version: '3.12' | ||
| - name: Setup libvirt for Vagrant | ||
| uses: voxpupuli/setup-vagrant@v0 | ||
| with: | ||
| configure_dns: true | ||
| - name: Install Ansible | ||
| run: pip install --upgrade ansible-core | ||
| - name: Setup environment | ||
| run: ./setup-environment | ||
| - name: Start VMs | ||
| run: | | ||
| ./forge vms start | ||
| - name: Configure repositories | ||
| run: | | ||
| ./forge setup-repositories | ||
| - name: Run deployment | ||
| run: | | ||
| ./forge deploy-dev --foreman-development-enabled-plugin foreman_ansible --add-feature foreman-proxy --add-feature hammer | ||
| - name: Setup upterm session | ||
| if: ${{ failure() }} | ||
| uses: owenthereal/action-upterm@v1 | ||
| with: | ||
| ## limits ssh access and adds the ssh public key for the user which triggered the workflow | ||
| limit-access-to-actor: true | ||
| ## If no one connects after 5 minutes, shut down server. | ||
| wait-timeout-minutes: 5 | ||
| upgrade: | ||
| strategy: | ||
| fail-fast: false | ||
| matrix: | ||
| upgrade_from: | ||
| - '2.y-stable' | ||
| runs-on: ubuntu-24.04 | ||
| steps: | ||
| - uses: actions/checkout@v7 | ||
| with: | ||
| ref: ${{ matrix.upgrade_from }} | ||
| fetch-depth: 0 | ||
| - name: Set up Python | ||
| uses: actions/setup-python@v6 | ||
| with: | ||
| python-version: '3.12' | ||
| - name: Setup libvirt for Vagrant | ||
| uses: voxpupuli/setup-vagrant@v0 | ||
| with: | ||
| configure_dns: true | ||
| - name: Install Ansible | ||
| run: pip install --upgrade ansible-core | ||
| - name: Setup environment | ||
| run: ./setup-environment | ||
| - name: Start VMs | ||
| run: | | ||
| ./forge vms start | ||
| - name: Configure repositories | ||
| run: | | ||
| ./forge setup-repositories | ||
| - name: Run image pull | ||
| run: | | ||
| ./foremanctl pull-images | ||
| - name: Run deployment | ||
| run: | | ||
| ./foremanctl deploy \ | ||
| --initial-admin-password=changeme \ | ||
| --initial-organization "Foreman CI" \ | ||
| --initial-location "Internet" \ | ||
| --tuning development | ||
| - name: Deploy features | ||
| run: | | ||
| ./foremanctl deploy \ | ||
| --add-feature hammer \ | ||
| --add-feature foreman-proxy \ | ||
| --add-feature azure-rm \ | ||
| --add-feature google \ | ||
| --add-feature remote-execution | ||
| - name: Stop services | ||
| run: | ||
| vagrant ssh quadlet -- sudo systemctl stop foreman.target | ||
| - name: Switch foremanctl version | ||
| run: | | ||
| git fetch origin ${{ github.ref }} | ||
| git checkout FETCH_HEAD | ||
| - name: Run image pull | ||
| run: | | ||
| ./foremanctl pull-images | ||
| - name: Run deployment | ||
| run: | | ||
| ./foremanctl deploy | ||
| - name: Run health check | ||
| run: | | ||
| ./foremanctl health | ||
| - name: Run tests | ||
| run: | | ||
| ./forge test | ||
| - name: Generate sos reports | ||
| if: ${{ always() }} | ||
| run: ./forge sos | ||
| - name: Archive sos reports | ||
| if: ${{ always() }} | ||
| uses: actions/upload-artifact@v7 | ||
| with: | ||
| name: sosreport-upgrade | ||
| path: sos/ | ||
| - name: Setup upterm session | ||
| if: ${{ failure() }} | ||
| uses: owenthereal/action-upterm@v1 | ||
| with: | ||
| ## limits ssh access and adds the ssh public key for the user which triggered the workflow | ||
| limit-access-to-actor: true | ||
| ## If no one connects after 5 minutes, shut down server. | ||
| wait-timeout-minutes: 5 | ||
| migration: | ||
| strategy: | ||
| fail-fast: false | ||
| runs-on: ubuntu-24.04 | ||
| steps: | ||
| - uses: actions/checkout@v7 | ||
| - name: Set up Python | ||
| uses: actions/setup-python@v6 | ||
| with: | ||
| python-version: '3.12' | ||
| - name: Setup libvirt for Vagrant | ||
| uses: voxpupuli/setup-vagrant@v0 | ||
| with: | ||
| configure_dns: true | ||
| - name: Install Ansible | ||
| run: pip install --upgrade ansible-core | ||
| - name: Setup environment | ||
| run: ./setup-environment | ||
| - name: Start VMs | ||
| run: | | ||
| ./forge vms start --vms "quadlet client" | ||
| - name: Configure repositories | ||
| run: | | ||
| ./forge setup-repositories | ||
| - name: Mock foreman-installer environment | ||
| run: | | ||
| ./forge mock-installer | ||
| - name: Run image pull | ||
| run: | | ||
| ./foremanctl pull-images | ||
| - name: Run migration preview | ||
| run: | | ||
| mkdir -p .var/lib/foremanctl | ||
| ./foremanctl migrate | ||
| - name: Run migration | ||
| run: | | ||
| ./foremanctl migrate --apply | ||
| - name: Run deployment | ||
| run: | | ||
| ./foremanctl deploy \ | ||
| --tuning development \ | ||
| --add-feature hammer \ | ||
| --add-feature foreman-proxy \ | ||
| --add-feature azure-rm \ | ||
| --add-feature google \ | ||
| --add-feature remote-execution | ||
| - name: Run tests | ||
| run: | | ||
| ./forge test | ||
| - name: Run smoker | ||
| run: | | ||
| ./forge smoker | ||
| - name: Archive smoker report | ||
| if: ${{ always() }} | ||
| uses: actions/upload-artifact@v7 | ||
| with: | ||
| name: smoker-migration | ||
| path: "/home/runner/smoker/report/" | ||
| - name: Generate sos reports | ||
| if: ${{ always() }} | ||
| run: ./forge sos | ||
| - name: Archive sos reports | ||
| if: ${{ always() }} | ||
| uses: actions/upload-artifact@v7 | ||
| with: | ||
| name: sosreport-migration | ||
| path: sos/ | ||
| - name: Setup upterm session | ||
| if: ${{ failure() }} | ||
| uses: owenthereal/action-upterm@v1 | ||
| with: | ||
| limit-access-to-actor: true | ||
| wait-timeout-minutes: 5 | ||
| foreman-proxy-content-tests: | ||
| strategy: | ||
| fail-fast: false | ||
| matrix: | ||
| certificate_source: | ||
| - default | ||
| - custom_server | ||
| runs-on: ubuntu-24.04 | ||
| name: "Tests Proxy Deployment" | ||
| steps: | ||
| - uses: actions/checkout@v7 | ||
| - name: Set up Python | ||
| uses: actions/setup-python@v6 | ||
| with: | ||
| python-version: '3.12' | ||
| - name: Setup libvirt for Vagrant | ||
| uses: voxpupuli/setup-vagrant@v0 | ||
| with: | ||
| configure_dns: true | ||
| - name: Install Ansible | ||
| run: pip install --upgrade ansible-core | ||
| - name: Setup environment | ||
| run: ./setup-environment | ||
| - name: Start VMs | ||
| run: | | ||
| ./forge vms start --vms "quadlet proxy" | ||
| - name: Run image pull | ||
| run: | | ||
| ./foremanctl pull-images | ||
| - name: Create custom certificates | ||
| if: matrix.certificate_source == 'custom_server' | ||
| run: | | ||
| ./forge custom-certs | ||
| ./forge custom-certs --hostname proxy.example.com | ||
| - name: Deploy Katello on quadlet | ||
| run: | | ||
| ./foremanctl deploy \ | ||
| --certificate-source=${{ matrix.certificate_source }} \ | ||
| ${{ matrix.certificate_source == 'custom_server' && '--certificate-server-certificate /root/custom-certificates/certs/quadlet.example.com.crt --certificate-server-key /root/custom-certificates/private/quadlet.example.com.key --certificate-server-ca-certificate /root/custom-certificates/certs/ca.crt' || '' }} \ | ||
| --initial-admin-password=changeme \ | ||
| --tuning development \ | ||
| --add-feature foreman-proxy | ||
| - name: Generate certificates bundle on quadlet | ||
| run: | | ||
| ./foremanctl certificate-bundle proxy.example.com \ | ||
| ${{ matrix.certificate_source == 'custom_server' && '--certificate-server-certificate /root/custom-certificates/certs/proxy.example.com.crt --certificate-server-key /root/custom-certificates/private/proxy.example.com.key' || '' }} | ||
| - name: Refresh internal CA to ensure it doesn't break the bundle | ||
| if: matrix.certificate_source != 'custom_server' | ||
| run: | | ||
| ./foremanctl deploy --certificate-renew-ca | ||
| - name: Fetch certificates bundle from quadlet | ||
| run: | | ||
| ./forge fetch-bundle proxy.example.com | ||
| - name: Remove old parameters, but keep certificates_source for tests | ||
| run: echo 'certificates_source: ${{ matrix.certificate_source }}' > .var/lib/foremanctl/parameters.yaml | ||
| - name: Deploy content proxy | ||
| run: | | ||
| ./foremanctl deploy-proxy \ | ||
| --flavor foreman-proxy-content \ | ||
| --certificate-bundle $(pwd)/.var/lib/foremanctl/proxy.example.com.tar.gz \ | ||
| --foreman-fqdn quadlet.example.com | ||
| - name: Run tests | ||
| run: | | ||
| ./forge test --pytest-args="--server-hostname=proxy" | ||
| - name: Generate sos reports | ||
| if: ${{ always() }} | ||
| run: ./forge sos | ||
| - name: Archive sos reports | ||
| if: ${{ always() }} | ||
| uses: actions/upload-artifact@v7 | ||
| with: | ||
| name: sosreport-proxy-content-${{ matrix.certificate_source }} | ||
| path: sos/ | ||
| - name: Setup upterm session | ||
| if: ${{ failure() }} | ||
| uses: owenthereal/action-upterm@v1 | ||
| with: | ||
| limit-access-to-actor: true | ||
| wait-timeout-minutes: 5 | ||
| # A dummy job that you can mark as a required check instead of each individual test | ||
| test-suite: | ||
| if: always() | ||
| needs: | ||
| - tests | ||
| - devel-tests | ||
| - upgrade | ||
| - migration | ||
| - foreman-proxy-content-tests | ||
| - ansible-lint | ||
| - python-lint | ||
| runs-on: ubuntu-latest | ||
| name: Test suite | ||
| steps: | ||
| - name: Decide whether the needed jobs succeeded or failed | ||
| uses: re-actors/alls-green@release/v1 | ||
| with: | ||
| jobs: ${{ toJSON(needs) }} | ||
