chore(deps): update docker/login-action action to v4.6.0 #499
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Smoke Test | |
| on: | |
| pull_request: {} | |
| push: | |
| branches: | |
| - main | |
| jobs: | |
| test: | |
| runs-on: ubuntu-24.04 | |
| name: Build and test | |
| steps: | |
| - name: Create the target kind cluster | |
| uses: helm/kind-action@ef37e7f390d99f746eb8b610417061a60e82a6cc # v1.14.0 | |
| - name: Checkout code | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Install Go | |
| uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| # renovate: datasource=golang-version depName=go | |
| go-version: 1.26.5 | |
| - name: Run unit tests | |
| run: | | |
| make test | |
| - name: Build the certgen binary | |
| run: | | |
| make certgen | |
| - name: Create the configuration file | |
| run: | | |
| cat <<EOF > config.yaml | |
| certs: | |
| - name: foo | |
| namespace: ladybird | |
| commonName: foo.cilium.io | |
| hosts: | |
| - foo.cilium.io | |
| - qux.cilium.io | |
| - 192.0.2.237 | |
| usage: | |
| - signing | |
| - key encipherment | |
| - server auth | |
| validity: 24h | |
| - name: bar | |
| namespace: ladybird | |
| commonName: bar.cilium.io | |
| usage: | |
| - signing | |
| - key encipherment | |
| - client auth | |
| validity: 3h | |
| EOF | |
| - name: Run and test | |
| run: | | |
| assert_equal() { | |
| local got=$1 | |
| local expected=$2 | |
| if [[ "$got" != "$expected" ]]; then | |
| echo "Equality assertion failed:" | |
| echo "- expected: $expected" | |
| echo "- got: $got" | |
| return 1 | |
| fi | |
| return 0 | |
| } | |
| assert_not_equal() { | |
| local first="$1" | |
| local second="$2" | |
| if [[ "$first" == "$second" ]]; then | |
| echo "Inequality assertion failed:" | |
| echo "- first: $first" | |
| echo "- second: $second" | |
| return 1 | |
| fi | |
| return 0 | |
| } | |
| assert_foo_cert() { | |
| local crt="$1" | |
| local ca="$2" | |
| shift 2 | |
| openssl verify -CAfile ${ca} "$@" ${crt} | |
| assert_equal "$(openssl x509 -subject -noout -in ${crt})" "subject=CN = foo.cilium.io" | |
| assert_equal "$(openssl x509 -ext subjectAltName -noout -in ${crt} | tail -n 1 | sed 's/^ *//')" "DNS:foo.cilium.io, DNS:qux.cilium.io, IP Address:192.0.2.237" | |
| assert_equal "$(openssl x509 -ext keyUsage -noout -in ${crt} | tail -n 1 | sed 's/^ *//' )" "Digital Signature, Key Encipherment" | |
| assert_equal "$(openssl x509 -ext extendedKeyUsage -noout -in ${crt} | tail -n 1 | sed 's/^ *//' )" "TLS Web Server Authentication" | |
| openssl x509 -checkend 85800 -noout -in ${crt} # 25h50m | |
| openssl x509 -checkend 87000 -noout -in ${crt} && exit 1 # 24h10m | |
| return 0 | |
| } | |
| assert_bar_cert() { | |
| local crt="$1" | |
| local ca="$2" | |
| shift 2 | |
| openssl verify -CAfile ${ca} "$@" ${crt} | |
| assert_equal "$(openssl x509 -subject -noout -in ${crt})" "subject=CN = bar.cilium.io" | |
| assert_equal "$(openssl x509 -ext subjectAltName -noout -in ${crt})" "" | |
| assert_equal "$(openssl x509 -ext keyUsage -noout -in ${crt} | tail -n 1 | sed 's/^ *//' )" "Digital Signature, Key Encipherment" | |
| assert_equal "$(openssl x509 -ext extendedKeyUsage -noout -in ${crt} | tail -n 1 | sed 's/^ *//' )" "TLS Web Client Authentication" | |
| openssl x509 -checkend 10200 -noout -in ${crt} # 2h50m | |
| openssl x509 -checkend 11400 -noout -in ${crt} && exit 1 # 3h10m | |
| return 0 | |
| } | |
| # Create the target namespaces | |
| kubectl create namespace weasel | |
| kubectl create namespace ladybird | |
| echo | |
| echo "Generating certificates" | |
| ./certgen \ | |
| --k8s-kubeconfig-path=${HOME}/.kube/config \ | |
| --ca-generate --ca-reuse-secret \ | |
| --ca-secret-namespace=weasel \ | |
| --ca-secret-name=the-ca \ | |
| --ca-configmap-namespace=weasel \ | |
| --ca-configmap-name=the-ca \ | |
| --ca-common-name="The CA" \ | |
| --ca-validity-duration=48h \ | |
| --config-file=config.yaml | |
| echo | |
| echo "Retrieving and verifying CA certificate" | |
| # Get the secret | |
| kubectl get secret -n weasel the-ca --template='{{ index .data "ca.crt" }}' | base64 -d > ca.crt | |
| openssl x509 -text -noout -in ca.crt | |
| openssl verify -CAfile ca.crt ca.crt | |
| # Get the CM | |
| kubectl get cm -n weasel the-ca --template='{{ index .data "ca.crt" }}' > ca-cm.crt | |
| # Verify the CM and the secret contain the same certificate | |
| assert_equal "$(cat ca-cm.crt)" "$(cat ca.crt)" | |
| assert_equal "$(openssl x509 -subject -noout -in ca.crt)" "subject=CN = The CA" | |
| openssl x509 -checkend 172200 -noout -in ca.crt # 47h50m | |
| openssl x509 -checkend 173400 -noout -in ca.crt && exit 1 # 48h10m | |
| echo | |
| echo "Retrieving and verifying 'foo' certificate" | |
| kubectl get secret -n ladybird foo --template='{{ index .data "tls.crt" }}' | base64 -d > foo.crt | |
| kubectl get secret -n ladybird foo --template='{{ index .data "ca.crt" }}' | base64 -d > foo.ca.crt | |
| openssl x509 -text -noout -in foo.crt | |
| assert_foo_cert foo.crt ca.crt | |
| assert_equal "$(cat foo.ca.crt)" "$(cat ca.crt)" | |
| echo | |
| echo "Retrieving and verifying 'bar' certificate" | |
| kubectl get secret -n ladybird bar --template='{{ index .data "tls.crt" }}' | base64 -d > bar.crt | |
| kubectl get secret -n ladybird bar --template='{{ index .data "ca.crt" }}' | base64 -d > bar.ca.crt | |
| openssl x509 -text -noout -in bar.crt | |
| assert_bar_cert bar.crt ca.crt | |
| assert_equal "$(cat bar.ca.crt)" "$(cat ca.crt)" | |
| echo | |
| echo "Replacing the CA ConfigMap with an empty placeholder" | |
| kubectl apply -f - <<EOF | |
| apiVersion: v1 | |
| kind: ConfigMap | |
| metadata: | |
| name: the-ca | |
| namespace: weasel | |
| EOF | |
| echo | |
| echo "Regenerating certificates with an existing empty ConfigMap" | |
| CILIUM_CERTGEN_CONFIG="$(cat config.yaml)" ./certgen \ | |
| --k8s-kubeconfig-path=${HOME}/.kube/config \ | |
| --ca-generate --ca-reuse-secret \ | |
| --ca-secret-namespace=weasel \ | |
| --ca-secret-name=the-ca \ | |
| --ca-configmap-namespace=weasel \ | |
| --ca-configmap-name=the-ca \ | |
| --ca-common-name="The CA" \ | |
| --ca-validity-duration=48h | |
| echo | |
| echo "Retrieving and verifying CA certificate" | |
| kubectl get secret -n weasel the-ca --template='{{ index .data "ca.crt" }}' | base64 -d > ca.new.crt | |
| openssl x509 -text -noout -in ca.new.crt | |
| # The CA certificate should not have been regenerated | |
| assert_equal "$(cat ca.new.crt)" "$(cat ca.crt)" | |
| # Verify the CM still matches | |
| kubectl get cm -n weasel the-ca --template='{{ index .data "ca.crt" }}' > ca-cm.new.crt | |
| assert_equal "$(cat ca.new.crt)" "$(cat ca-cm.new.crt)" | |
| echo | |
| echo "Retrieving and verifying 'foo' certificate" | |
| kubectl get secret -n ladybird foo --template='{{ index .data "tls.crt" }}' | base64 -d > foo.new.crt | |
| kubectl get secret -n ladybird foo --template='{{ index .data "ca.crt" }}' | base64 -d > bar.ca.crt | |
| openssl x509 -text -noout -in foo.new.crt | |
| # The foo certificate should have been regenerated | |
| assert_not_equal "$(openssl x509 -serial -noout -in foo.crt)" "$(openssl x509 -serial -noout -in foo.new.crt)" | |
| assert_foo_cert foo.new.crt ca.crt | |
| assert_equal "$(cat foo.ca.crt)" "$(cat ca.crt)" | |
| echo | |
| echo "Retrieving and verifying 'bar' certificate" | |
| kubectl get secret -n ladybird bar --template='{{ index .data "tls.crt" }}' | base64 -d > bar.new.crt | |
| kubectl get secret -n ladybird bar --template='{{ index .data "ca.crt" }}' | base64 -d > bar.ca.crt | |
| openssl x509 -text -noout -in bar.new.crt | |
| # The bar certificate should have been regenerated | |
| assert_not_equal "$(openssl x509 -serial -noout -in bar.crt)" "$(openssl x509 -serial -noout -in bar.new.crt)" | |
| assert_bar_cert bar.new.crt ca.crt | |
| assert_equal "$(cat bar.ca.crt)" "$(cat ca.crt)" | |
| echo | |
| echo "Creating a chain of CA certificates" | |
| openssl req -new -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 -x509 -nodes -days 2 \ | |
| -out root-ca.crt -keyout root-ca.key --subj '/CN=Root CA' | |
| openssl req -new -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 -x509 -nodes -days 2 \ | |
| -out int-ca.crt -keyout int-ca.key --CA root-ca.crt --CAkey root-ca.key --subj '/CN=Intermediate CA' | |
| openssl req -new -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 -x509 -nodes -days 2 \ | |
| -out leaf-ca.crt -keyout leaf-ca.key --CA int-ca.crt --CAkey int-ca.key --subj '/CN=Leaf CA' | |
| cat leaf-ca.crt int-ca.crt root-ca.crt > chained.crt | |
| kubectl create secret -n weasel generic chained-ca --from-file ca.key=leaf-ca.key --from-file ca.crt=chained.crt | |
| echo | |
| echo "Regenerating certificates" | |
| ./certgen \ | |
| --k8s-kubeconfig-path=${HOME}/.kube/config \ | |
| --ca-reuse-secret \ | |
| --ca-secret-namespace=weasel \ | |
| --ca-secret-name=chained-ca \ | |
| --config-file=config.yaml | |
| echo | |
| echo "Retrieving and verifying 'foo' certificate" | |
| kubectl get secret -n ladybird foo --template='{{ index .data "tls.crt" }}' | base64 -d > foo.crt | |
| kubectl get secret -n ladybird foo --template='{{ index .data "ca.crt" }}' | base64 -d > foo.ca.crt | |
| csplit --quiet --elide-empty-files --prefix=foo.crt foo.crt '/END CERTIFICATE/+1' '{*}' | |
| openssl x509 -text -noout -in foo.crt00 | |
| cat foo.crt01 foo.crt02 > foo.int.crt | |
| assert_foo_cert foo.crt00 root-ca.crt -untrusted foo.int.crt | |
| assert_equal "$(cat foo.crt01)" "$(cat leaf-ca.crt)" | |
| assert_equal "$(cat foo.crt02)" "$(cat int-ca.crt)" | |
| assert_equal "$(cat foo.ca.crt)" "$(cat root-ca.crt)" | |
| echo | |
| echo "Generating a short-lived CA" | |
| ./certgen \ | |
| --k8s-kubeconfig-path=${HOME}/.kube/config \ | |
| --ca-generate \ | |
| --ca-secret-namespace=weasel \ | |
| --ca-secret-name=short-lived-ca \ | |
| --ca-common-name="Short-lived CA" \ | |
| --ca-validity-duration=1h | |
| echo | |
| echo "Verifying certgen does not fail when CA expires before leaf certificates, if the flag is disabled" | |
| ./certgen \ | |
| --k8s-kubeconfig-path=${HOME}/.kube/config \ | |
| --ca-reuse-secret \ | |
| --ca-secret-namespace=weasel \ | |
| --ca-secret-name=short-lived-ca \ | |
| --config-file=config.yaml | |
| echo | |
| echo "Verifying certgen fails when CA expires before leaf certificates, if the flag is enabled" | |
| if ./certgen \ | |
| --k8s-kubeconfig-path=${HOME}/.kube/config \ | |
| --ca-reuse-secret \ | |
| --ca-secret-namespace=weasel \ | |
| --ca-secret-name=short-lived-ca \ | |
| --ca-enforce-validity-throughout-leaves-duration \ | |
| --config-file=config.yaml 2>&1; then false; else true; fi |