Add KRA and OCSP containers

.github/workflows/acme-container-test.yml

@@ -28,6 +28,18 @@ jobs:
       - name: Create network
         run: docker network create example
 
+      - name: Set up client container
+        run: |
+          tests/bin/runner-init.sh client
+        env:
+          HOSTNAME: client.example.com
+
+      - name: Connect client container to network
+        run: docker network connect example client --alias client.example.com
+
+      - name: Install dependencies in client container
+        run: docker exec client dnf install -y certbot
+
       - name: Create shared folders
         run: |
           mkdir certs
@@ -53,20 +65,7 @@ jobs:
               --detach \
               pki-acme
 
-      - name: Set up client container
-        run: |
-          tests/bin/runner-init.sh client
-        env:
-          HOSTNAME: client.example.com
-
-      - name: Connect client container to network
-        run: docker network connect example client --alias client.example.com
-
-      - name: Install dependencies in client container
-        run: docker exec client dnf install -y certbot
-
-      - name: Wait for ACME container to start
-        run: |
+          # wait for ACME to start
           docker exec client curl \
               --retry 60 \
               --retry-delay 0 \
@@ -166,6 +165,20 @@ jobs:
 
           diff expected output
 
+      - name: Install CA signing cert
+        run: |
+          docker exec client pki \
+              nss-cert-import \
+              --cert $SHARED/certs/ca_signing.crt \
+              --trust CT,C,C \
+              ca_signing
+
+      - name: Check ACME status
+        run: |
+          docker exec client pki \
+              -U https://acme.example.com:8443 \
+              acme-info
+
       - name: Verify certbot in client container
         run: |
           docker exec client certbot register \
@@ -204,6 +217,27 @@ jobs:
               --server http://acme.example.com:8080/acme/directory \
               --non-interactive
 
+      - name: Restart ACME
+        run: |
+          docker restart acme
+          sleep 5
+
+          # wait for ACME to restart
+          docker exec client curl \
+              --retry 60 \
+              --retry-delay 0 \
+              --retry-connrefused \
+              -s \
+              -k \
+              -o /dev/null \
+              http://acme.example.com:8080/acme/directory
+
+      - name: Check ACME status again
+        run: |
+          docker exec client pki \
+              -U https://acme.example.com:8443 \
+              acme-info
+
       - name: Check ACME container logs
         if: always()
         run: |

.github/workflows/build.yml

@@ -115,10 +115,40 @@ jobs:
           cache-from: type=local,src=/tmp/.buildx-cache
           outputs: type=docker
 
+      - name: Build pki-kra image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          build-args: |
+            BASE_IMAGE=${{ env.BASE_IMAGE }}
+            COPR_REPO=${{ env.COPR_REPO }}
+          tags: pki-kra
+          target: pki-kra
+          cache-from: type=local,src=/tmp/.buildx-cache
+          outputs: type=docker
+
+      - name: Build pki-ocsp image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          build-args: |
+            BASE_IMAGE=${{ env.BASE_IMAGE }}
+            COPR_REPO=${{ env.COPR_REPO }}
+          tags: pki-ocsp
+          target: pki-ocsp
+          cache-from: type=local,src=/tmp/.buildx-cache
+          outputs: type=docker
+
       - name: Save PKI images
         run: |
           docker images
-          docker save -o pki-images.tar pki-dist pki-runner pki-server pki-ca
+          docker save -o pki-images.tar \
+              pki-dist \
+              pki-runner \
+              pki-server \
+              pki-ca \
+              pki-kra \
+              pki-ocsp
 
       - name: Store PKI images
         uses: actions/cache@v4

.github/workflows/ca-container-test.yml

@@ -211,8 +211,7 @@ jobs:
               --detach \
               pki-ca
 
-      - name: Wait for CA container to start
-        run: |
+          # wait for CA to start
           docker exec client curl \
               --retry 180 \
               --retry-delay 0 \
@@ -443,20 +442,20 @@ jobs:
               --request $REQUEST_ID
 
       # https://github.com/dogtagpki/pki/wiki/Setting-up-CA-Admin-User
-      - name: Add admin user
+      - name: Add CA admin user
         run: |
           docker exec ca pki-server ca-user-add \
               --full-name Administrator \
               --type adminType \
               admin
 
-      - name: Assign admin cert to admin user
+      - name: Assign admin cert to CA admin user
         run: |
           docker exec ca pki-server ca-user-cert-add \
               --cert /certs/admin.crt \
               admin
 
-      - name: Add admin user into CA groups
+      - name: Add CA admin user into CA groups
         run: |
           docker exec ca pki-server ca-user-role-add admin "Administrators"
           docker exec ca pki-server ca-user-role-add admin "Certificate Manager Agents"
@@ -468,7 +467,7 @@ jobs:
 
       - name: Check admin operations from CA container
         run: |
-          # check admin user
+          # check CA admin user
           docker exec ca pki \
               -n admin \
               ca-user-show \
@@ -496,7 +495,7 @@ jobs:
 
       - name: Check admin operations from client container
         run: |
-          # check admin user
+          # check CA admin user
           docker exec client pki \
               -U https://ca.example.com:8443 \
               -n admin \
@@ -518,6 +517,29 @@ jobs:
               $REQUEST_ID \
               --force
 
+      - name: Restart CA
+        run: |
+          docker restart ca
+          sleep 5
+
+          # wait for CA to restart
+          docker exec client curl \
+              --retry 180 \
+              --retry-delay 0 \
+              --retry-connrefused \
+              -s \
+              -k \
+              -o /dev/null \
+              https://ca.example.com:8443
+
+      - name: Check CA admin user again
+        run: |
+          docker exec client pki \
+              -U https://ca.example.com:8443 \
+              -n admin \
+              ca-user-show \
+              admin
+
       - name: Check DS server systemd journal
         if: always()
         run: |