-
Notifications
You must be signed in to change notification settings - Fork 8
322 lines (280 loc) · 15.9 KB
/
caname-id-test.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
name: caname-id tests
on:
workflow_call:
inputs:
go-version:
type: string
description: "Version of Go used to build ncm-issuer image"
required: true
image-artifact-name:
type: string
description: "Name of the ncm-issuer image artifact"
required: true
jobs:
ca-id-test:
name: "ca id"
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-go@v5
- run: go version
- name: "install microk8s"
run: |
sudo snap install microk8s --classic --channel=1.29/stable
sudo microk8s status --wait-ready
sudo microk8s enable helm3
sudo microk8s enable dns
echo K8S_VERSION=$(sudo microk8s.kubectl version --short=true|grep -Po 'Server Version: \K.*' -m 1) >> $GITHUB_ENV
- run: echo "k8s ${{ env.K8S_VERSION }}"
- name: Set KUBECONFIG for MicroK8s
run: echo "KUBECONFIG=/var/snap/microk8s/current/credentials/client.config" >> $GITHUB_ENV
- name: "Download ncm-issuer image"
uses: actions/download-artifact@v4
with:
name: ${{ inputs.image-artifact-name }}
path: .
- name: "Load ncm-issuer image"
run: sudo microk8s ctr image import ${{ inputs.image-artifact-name }}.tar
- name: "install cert-manager charts"
run: |
sudo microk8s.kubectl create namespace cert-manager
sudo microk8s.helm3 repo add jetstack https://charts.jetstack.io
sudo microk8s.helm3 repo update
sudo microk8s.helm3 install cert-manager jetstack/cert-manager --namespace cert-manager --set installCRDs=true
echo CERTMGR_VERSION=$(sudo microk8s.helm3 list -n cert-manager -o yaml|grep -Po 'cert-manager-\K.*' -m 1) >> $GITHUB_ENV
- run: echo "cert-manager ${{ env.CERTMGR_VERSION }}"
- name: "sleep for 10s"
run: sleep 10
- name: "cert-manager status"
run: |
sudo microk8s.helm3 list -A
sudo microk8s.kubectl get pods -A
sudo microk8s.kubectl -n cert-manager logs `sudo microk8s.kubectl get pods -n cert-manager -l app=cert-manager -o jsonpath='{.items[0].metadata.name}'`|tail -25
- name: "install yq"
run: sudo snap install yq
- name: "prepare environment / create namespace and secret"
run: |
REG_ADDR=${{ env.REG_ADDR }}
mkdir -p data/logs
echo "$NCM_CA_BUNDLE" > data/ca_bundle.pem
cp .github/*.yml data/
NCM_HOST=$NCM_HOST yq -i '.spec.provisioner.mainAPI = env(NCM_HOST)' data/ncm-issuer.yml
sed -i "s|caName: SubCA|caID: $NCM_CAHREF|g" data/ncm-issuer.yml
yq -i '.image.repository = "ncm-issuer"' helm/values.yaml
yq -i '.image.pullPolicy = "Never"' helm/values.yaml
TAG=$(grep -m1 imageVersion main.go | cut -d '"' -f2) yq -i '.image.tag = env(TAG)' helm/values.yaml
sudo microk8s.kubectl create namespace ncm-issuer
sudo microk8s.kubectl create secret generic ncm-issuer -n ncm-issuer --from-literal=username=$NCM_USER --from-literal=usrPassword=$NCM_PASSWORD
sudo microk8s.kubectl create secret generic ncm-issuer-bundle -n ncm-issuer --from-file=cacert=data/ca_bundle.pem
env:
NCM_HOST: ${{ secrets.NCM_HOST }}
NCM_USER: ${{ secrets.NCM_USER }}
NCM_PASSWORD: ${{ secrets.NCM_PASSWORD }}
NCM_CA_BUNDLE: ${{ secrets.NCM_CA_BUNDLE }}
NCM_CAHREF: ${{ secrets.NCM_CAHREF }}
- name: "install ncm-issuer plugin"
run: |
sudo microk8s.helm3 install -n ncm-issuer ncm-issuer "$(pwd)/helm"
- name: "sleep for 10s"
run: sleep 10
- name: "ncm-issuer plugin status"
run: |
sudo microk8s.helm3 list -A
sudo microk8s.kubectl get pods -A
sudo microk8s.kubectl -n ncm-issuer logs `sudo microk8s.kubectl get pods -A -l app=ncm-issuer -o jsonpath='{.items[0].metadata.name}'`|tail -25
- name: "create issuer"
run: |
sudo microk8s.kubectl apply -f data/ncm-issuer.yml
sudo microk8s.kubectl get issuers.certmanager.ncm.nokia.com -n ncm-issuer
- name: "wait for ncm-issuer readiness"
run: |
while [[ $(sudo microk8s.kubectl get issuers.certmanager.ncm.nokia.com -n ncm-issuer -o jsonpath="{.items[0].status.conditions[?(@.type=='Ready')].status}") != "True" ]]; do
echo "Waiting for ncm-issuer to be ready..."
sleep 1
done
echo "ncm-issuer is ready"
- name: "check issuer status"
run: |
sudo microk8s.kubectl get issuers.certmanager.ncm.nokia.com -n ncm-issuer
sudo microk8s.kubectl -n ncm-issuer describe issuers.certmanager.ncm.nokia.com ncm
sudo microk8s.kubectl -n ncm-issuer logs `sudo microk8s.kubectl get pods -A -l app=ncm-issuer -o jsonpath='{.items[0].metadata.name}'`|tail -25
sudo microk8s.kubectl get issuers.certmanager.ncm.nokia.com -n ncm-issuer | grep -i True
- name: "create certificate resource"
run: |
sudo microk8s.kubectl apply -f data/cert-resource.yml
- name: "wait for certificate readiness"
run: |
while [[ $(sudo microk8s.kubectl get certificate.cert-manager.io/ncm-cert -n ncm-issuer -o jsonpath="{.status.conditions[?(@.type=='Ready')].status}") != "True" ]]; do
echo "Waiting for certificate to be ready..."
sleep 1
done
echo "Certificate is ready"
- name: "check certificate resource"
run: |
sudo microk8s.kubectl describe cert ncm-cert -n ncm-issuer
sudo microk8s.kubectl -n ncm-issuer logs `sudo microk8s.kubectl get pods -A -l app=ncm-issuer -o jsonpath='{.items[0].metadata.name}'`|tail -25
sudo microk8s.kubectl describe cert ncm-cert -n ncm-issuer | grep "The certificate has been successfully issued"
sudo microk8s.kubectl describe certificaterequest ncm-cert -n ncm-issuer
sudo microk8s.kubectl describe certificaterequest ncm-cert -n ncm-issuer | grep "Approved"
sudo microk8s.kubectl describe certificaterequest ncm-cert -n ncm-issuer | grep "Issued"
sudo microk8s.kubectl describe certificaterequest ncm-cert -n ncm-issuer | grep "Certificate:" | awk '{print $2}' | base64 -d > /tmp/cert.der
sudo microk8s.kubectl describe certificaterequest ncm-cert -n ncm-issuer | grep "Ca:" | awk '{print $2}' | base64 -d > /tmp/ca.pem
openssl x509 -in /tmp/cert.der -text -noout
openssl verify -CAfile /tmp/ca.pem --untrusted /tmp/cert.der /tmp/cert.der
- name: "[ * ] collecting test logs"
continue-on-error: true
if: ${{ failure() }}
run: |
sudo microk8s.kubectl get namespaces > data/logs/get_namespaces.log
sudo microk8s.kubectl get po -A > data/logs/get_pods.log
sudo microk8s.kubectl describe pods ncm-issuer -n ncm-issuer > data/logs/describe_ncm-issuer.log
sudo microk8s.kubectl get secrets -n ncm-issuer > data/logs/get_secrets.log
sudo microk8s.kubectl get issuers.certmanager.ncm.nokia.com -n ncm-issuer > data/logs/get_issuers.log
sudo microk8s.kubectl describe issuer.certmanager.ncm.nokia.com -n ncm-issuer > data/logs/describe_issuer.log
sudo microk8s.kubectl -n ncm-issuer logs `sudo microk8s.kubectl get pods -A -l app=ncm-issuer -o jsonpath='{.items[0].metadata.name}'` > data/logs/ncm-issuer.log
sudo microk8s.kubectl -n cert-manager logs `sudo microk8s.kubectl get pods -n cert-manager -l app=cert-manager -o jsonpath='{.items[0].metadata.name}'` > data/logs/cert-manager.log
sudo microk8s.kubectl get certificaterequest -n ncm-issuer > data/logs/get_csr.log
sudo microk8s.kubectl describe certificaterequest ncm-cert -n ncm-issuer > data/logs/describe_csr.log
sudo microk8s.kubectl get certificate -n ncm-issuer > data/logs/get_certificate.log
sudo microk8s.kubectl describe certificate ncm-cert -n ncm-issuer > data/logs/describe_certificate.log
mkdir -p ${{ github.workspace }}/artifact/upload
sudo cp -rp data/ ${{ github.workspace }}/artifact/data/
sudo tar -C ${{ github.workspace }}/artifact/ -cvzf ${{ github.workspace }}/artifact/upload/artifact.tar.gz data
- name: "[ * ] uploading artificates"
uses: actions/upload-artifact@v4
if: ${{ failure() }}
with:
name: logs-cahref.tar.gz
path: ${{ github.workspace }}/artifact/upload/
ca-name-test:
name: "ca name"
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-go@v5
- run: go version
- name: "install microk8s"
run: |
sudo snap install microk8s --classic --channel=1.29/stable
sudo microk8s status --wait-ready
sudo microk8s enable helm3
sudo microk8s enable dns
echo K8S_VERSION=$(sudo microk8s.kubectl version --short=true|grep -Po 'Server Version: \K.*' -m 1) >> $GITHUB_ENV
- run: echo "k8s ${{ env.K8S_VERSION }}"
- name: Set KUBECONFIG for MicroK8s
run: echo "KUBECONFIG=/var/snap/microk8s/current/credentials/client.config" >> $GITHUB_ENV
- name: "Download ncm-issuer image"
uses: actions/download-artifact@v4
with:
name: ${{ inputs.image-artifact-name }}
path: .
- name: "Load ncm-issuer image"
run: sudo microk8s ctr image import ${{ inputs.image-artifact-name }}.tar
- name: "install cert-manager charts"
run: |
sudo microk8s.kubectl create namespace cert-manager
sudo microk8s.helm3 repo add jetstack https://charts.jetstack.io
sudo microk8s.helm3 repo update
sudo microk8s.helm3 install cert-manager jetstack/cert-manager --namespace cert-manager --set installCRDs=true
echo CERTMGR_VERSION=$(sudo microk8s.helm3 list -n cert-manager -o yaml|grep -Po 'cert-manager-\K.*' -m 1) >> $GITHUB_ENV
- run: echo "cert-manager ${{ env.CERTMGR_VERSION }}"
- name: "sleep for 10s"
run: sleep 10
- name: "cert-manager status"
run: |
sudo microk8s.helm3 list -A
sudo microk8s.kubectl get pods -A
sudo microk8s.kubectl -n cert-manager logs `sudo microk8s.kubectl get pods -n cert-manager -l app=cert-manager -o jsonpath='{.items[0].metadata.name}'`|tail -25
- name: "install yq"
run: sudo snap install yq
- name: "prepare environment / create namespace and secret"
run: |
mkdir -p data/logs
echo "$NCM_CA_BUNDLE" > data/ca_bundle.pem
cp .github/*.yml data/
NCM_HOST=$NCM_HOST yq -i '.spec.provisioner.mainAPI = env(NCM_HOST)' data/ncm-issuer.yml
yq -i '.image.repository = "ncm-issuer"' helm/values.yaml
yq -i '.image.pullPolicy = "Never"' helm/values.yaml
TAG=$(grep -m1 imageVersion main.go | cut -d '"' -f2) yq -i '.image.tag = env(TAG)' helm/values.yaml
sudo microk8s.kubectl create namespace ncm-issuer
sudo microk8s.kubectl create secret generic ncm-issuer -n ncm-issuer --from-literal=username=$NCM_USER --from-literal=usrPassword=$NCM_PASSWORD
sudo microk8s.kubectl create secret generic ncm-issuer-bundle -n ncm-issuer --from-file=cacert=data/ca_bundle.pem
env:
NCM_HOST: ${{ secrets.NCM_HOST }}
NCM_USER: ${{ secrets.NCM_USER }}
NCM_PASSWORD: ${{ secrets.NCM_PASSWORD }}
NCM_CA_BUNDLE: ${{ secrets.NCM_CA_BUNDLE }}
- name: "install ncm-issuer plugin"
run: |
sudo microk8s.helm3 install -n ncm-issuer ncm-issuer "$(pwd)/helm"
- name: "sleep for 10s"
run: sleep 10
- name: "ncm-issuer plugin status"
run: |
sudo microk8s.helm3 list -A
sudo microk8s.kubectl get pods -A
sudo microk8s.kubectl -n ncm-issuer logs `sudo microk8s.kubectl get pods -A -l app=ncm-issuer -o jsonpath='{.items[0].metadata.name}'`|tail -25
- name: "create issuer"
run: |
sudo microk8s.kubectl apply -f data/ncm-issuer.yml
sudo microk8s.kubectl get issuers.certmanager.ncm.nokia.com -n ncm-issuer
- name: "wait for ncm-issuer readiness"
run: |
while [[ $(sudo microk8s.kubectl get issuers.certmanager.ncm.nokia.com -n ncm-issuer -o jsonpath="{.items[0].status.conditions[?(@.type=='Ready')].status}") != "True" ]]; do
echo "Waiting for ncm-issuer to be ready..."
sleep 1
done
echo "ncm-issuer is ready"
- name: "check issuer status"
run: |
sudo microk8s.kubectl get issuers.certmanager.ncm.nokia.com -n ncm-issuer
sudo microk8s.kubectl -n ncm-issuer describe issuers.certmanager.ncm.nokia.com ncm
sudo microk8s.kubectl -n ncm-issuer logs `sudo microk8s.kubectl get pods -A -l app=ncm-issuer -o jsonpath='{.items[0].metadata.name}'`|tail -25
sudo microk8s.kubectl get issuers.certmanager.ncm.nokia.com -n ncm-issuer | grep -i True
- name: "create certificate resource"
run: |
sudo microk8s.kubectl apply -f data/cert-resource.yml
- name: "wait for certificate readiness"
run: |
while [[ $(sudo microk8s.kubectl get certificate.cert-manager.io/ncm-cert -n ncm-issuer -o jsonpath="{.status.conditions[?(@.type=='Ready')].status}") != "True" ]]; do
echo "Waiting for certificate to be ready..."
sleep 1
done
echo "Certificate is ready"
- name: "check certificate resource"
run: |
sudo microk8s.kubectl describe cert ncm-cert -n ncm-issuer
sudo microk8s.kubectl -n ncm-issuer logs `sudo microk8s.kubectl get pods -A -l app=ncm-issuer -o jsonpath='{.items[0].metadata.name}'`|tail -25
sudo microk8s.kubectl describe cert ncm-cert -n ncm-issuer | grep "The certificate has been successfully issued"
sudo microk8s.kubectl describe certificaterequest ncm-cert -n ncm-issuer
sudo microk8s.kubectl describe certificaterequest ncm-cert -n ncm-issuer | grep "Approved"
sudo microk8s.kubectl describe certificaterequest ncm-cert -n ncm-issuer | grep "Issued"
sudo microk8s.kubectl describe certificaterequest ncm-cert -n ncm-issuer | grep "Certificate:" | awk '{print $2}' | base64 -d > /tmp/cert.der
sudo microk8s.kubectl describe certificaterequest ncm-cert -n ncm-issuer | grep "Ca:" | awk '{print $2}' | base64 -d > /tmp/ca.pem
openssl x509 -in /tmp/cert.der -text -noout
openssl verify -CAfile /tmp/ca.pem --untrusted /tmp/cert.der /tmp/cert.der
- name: "[ * ] collecting test logs"
continue-on-error: true
if: ${{ failure() }}
run: |
sudo microk8s.kubectl get namespaces > data/logs/get_namespaces.log
sudo microk8s.kubectl get po -A > data/logs/get_pods.log
sudo microk8s.kubectl describe pods ncm-issuer -n ncm-issuer > data/logs/describe_ncm-issuer.log
sudo microk8s.kubectl get secrets -n ncm-issuer > data/logs/get_secrets.log
sudo microk8s.kubectl get issuers.certmanager.ncm.nokia.com -n ncm-issuer > data/logs/get_issuers.log
sudo microk8s.kubectl describe issuer.certmanager.ncm.nokia.com -n ncm-issuer > data/logs/describe_issuer.log
sudo microk8s.kubectl -n ncm-issuer logs `sudo microk8s.kubectl get pods -A -l app=ncm-issuer -o jsonpath='{.items[0].metadata.name}'` > data/logs/ncm-issuer.log
sudo microk8s.kubectl -n cert-manager logs `sudo microk8s.kubectl get pods -n cert-manager -l app=cert-manager -o jsonpath='{.items[0].metadata.name}'` > data/logs/cert-manager.log
sudo microk8s.kubectl get certificaterequest -n ncm-issuer > data/logs/get_csr.log
sudo microk8s.kubectl describe certificaterequest ncm-cert -n ncm-issuer > data/logs/describe_csr.log
sudo microk8s.kubectl get certificate -n ncm-issuer > data/logs/get_certificate.log
sudo microk8s.kubectl describe certificate ncm-cert -n ncm-issuer > data/logs/describe_certificate.log
mkdir -p ${{ github.workspace }}/artifact/upload
sudo cp -rp data/ ${{ github.workspace }}/artifact/data/
sudo tar -C ${{ github.workspace }}/artifact/ -cvzf ${{ github.workspace }}/artifact/upload/artifact.tar.gz data
- name: "[ * ] uploading artificates"
uses: actions/upload-artifact@v4
if: ${{ failure() }}
with:
name: logs-caname.tar.gz
path: ${{ github.workspace }}/artifact/upload/