From 294e23aaa671cecf7a546300ddc9b450d5bfa71c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Carlos=20=C3=81lvaro?= <carlos@cdalvaro.io>
Date: Fri, 2 Oct 2020 16:32:58 +0200
Subject: [PATCH 1/3] doc: Fix Salt-API documentation

---
 README.md | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index a82e8ff..8b628a6 100644
--- a/README.md
+++ b/README.md
@@ -171,9 +171,10 @@ your `docker run` command or in your `docker-compose.yml` file.
 docker run --name salt_stack --detach \
     --publish 4505:4505 --publish 4506:4506 --publish 8000:8000 \
     --env 'SALT_API_SERVICE_ENABLED=true' \
-    --env 'SALT_API_USER_PASS=SuperCool/Password10'
+    --env 'SALT_API_USER_PASS=SuperCool/Password10' \
     --volume $(pwd)/roots/:/home/salt/data/srv/ \
     --volume $(pwd)/keys/:/home/salt/data/keys/ \
+    --volume $(pwd)/config/:/home/salt/data/config/ \
     cdalvaro/docker-salt-master:3001.1
 ```
 
@@ -194,6 +195,9 @@ external_auth:
   pam:
     salt_api:
       - .*
+      - '@runner'
+      - '@wheel'
+      - '@jobs'
 ```
 
 More information is available in the following link: [External Authentication System (eAuth)](https://docs.saltstack.com/en/latest/topics/eauth/index.html#acl-eauth).

From 5b949b7db1616d9a40b6c8169c7243ee77546bd8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Carlos=20=C3=81lvaro?= <carlos@cdalvaro.io>
Date: Fri, 2 Oct 2020 16:53:38 +0200
Subject: [PATCH 2/3] ci/cd: Add test for salt-api

---
 .github/workflows/build-and-test.yml | 42 +++++++++++++++++++++++++++-
 1 file changed, 41 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/build-and-test.yml b/.github/workflows/build-and-test.yml
index e34109c..58820ae 100644
--- a/.github/workflows/build-and-test.yml
+++ b/.github/workflows/build-and-test.yml
@@ -69,6 +69,7 @@ jobs:
         platform: [linux/amd64, linux/arm64]
     env:
       DOCKER_CLI_EXPERIMENTAL: enabled
+      SALT_API_PASSWORD: 4wesome-Pass0rd
     steps:
       - name: Download Docker registry data from build job
         uses: actions/download-artifact@v2
@@ -95,7 +96,26 @@ jobs:
         run: docker pull --platform ${{ matrix.platform }} ${IMAGE_NAME}
 
       - name: Launch docker container
-        run: docker run --rm -d --name saltstack_master ${IMAGE_NAME}
+        run: |
+          # Create configuration files
+          mkdir -p config/
+          cat > config/salt-api.conf <<EOF
+          external_auth:
+            pam:
+              salt_api:
+                - .*
+                - '@runner'
+                - '@wheel'
+                - '@jobs'
+          EOF
+
+          # Run test instance
+          docker run --rm --detach --name saltstack_master \
+            --publish 4505:4505 --publish 4506:4506 --publish 8000:8000 \
+            --env 'SALT_API_SERVICE_ENABLED=true' \
+            --env "SALT_API_USER_PASS='${SALT_API_PASSWORD}'" \
+            --volume $(pwd)/config/:/home/salt/data/config/ \
+             ${IMAGE_NAME}
 
       - name: Show container info
         run: docker container ls
@@ -109,6 +129,26 @@ jobs:
       - name: Test image calling healthcheck
         run: docker exec saltstack_master /usr/local/sbin/healthcheck
 
+      - name: Test salt-api authentication
+        id: salt_api_auth
+        run: |
+          SALT_API_TOKEN=$(curl -sSk https://localhost:8000/login \
+            -H 'Accept: application/x-yaml' \
+            -d username=salt_api \
+            -d password="'${SALT_API_PASSWORD}'" \
+            -d eauth=pam | grep 'token:' | cut -d' ' -f 4)
+          [ -n "${SALT_API_TOKEN}" ] || exit 1
+          echo "::set-output name=token::${SALT_API_TOKEN}"
+
+      - name: Test salt-api command
+        run: |
+          curl -sSk https://localhost:8000 \
+            -H 'Accept: application/x-yaml' \
+            -H 'X-Auth-Token: ${{ steps.salt_api_auth.outputs.token }}' \
+            -d client=runner \
+            -d tgt='*' \
+            -d fun=test.stream
+
       - name: Cleanup
         run: |
           docker stop saltstack_master registry

From a9fbefee9a5ad799f57f764740366fd1b1533d6a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Carlos=20=C3=81lvaro?= <carlos@cdalvaro.io>
Date: Fri, 2 Oct 2020 18:09:41 +0200
Subject: [PATCH 3/3] ci/cd: Add salt-pepper test

---
 .github/workflows/build-and-test.yml | 42 ++++++++++++++++++++--------
 1 file changed, 31 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/build-and-test.yml b/.github/workflows/build-and-test.yml
index 58820ae..e64a3a0 100644
--- a/.github/workflows/build-and-test.yml
+++ b/.github/workflows/build-and-test.yml
@@ -69,7 +69,10 @@ jobs:
         platform: [linux/amd64, linux/arm64]
     env:
       DOCKER_CLI_EXPERIMENTAL: enabled
-      SALT_API_PASSWORD: 4wesome-Pass0rd
+      SALTAPI_URL: https://localhost:8000/
+      SALTAPI_USER: salt_api
+      SALTAPI_PASS: 4wesome-Pass0rd
+      SALTAPI_EAUTH: pam
     steps:
       - name: Download Docker registry data from build job
         uses: actions/download-artifact@v2
@@ -101,8 +104,8 @@ jobs:
           mkdir -p config/
           cat > config/salt-api.conf <<EOF
           external_auth:
-            pam:
-              salt_api:
+            ${SALTAPI_EAUTH}:
+              ${SALTAPI_USER}:
                 - .*
                 - '@runner'
                 - '@wheel'
@@ -113,7 +116,7 @@ jobs:
           docker run --rm --detach --name saltstack_master \
             --publish 4505:4505 --publish 4506:4506 --publish 8000:8000 \
             --env 'SALT_API_SERVICE_ENABLED=true' \
-            --env "SALT_API_USER_PASS='${SALT_API_PASSWORD}'" \
+            --env 'SALT_API_USER_PASS=${{ env.SALTAPI_PASS }}' \
             --volume $(pwd)/config/:/home/salt/data/config/ \
              ${IMAGE_NAME}
 
@@ -132,13 +135,13 @@ jobs:
       - name: Test salt-api authentication
         id: salt_api_auth
         run: |
-          SALT_API_TOKEN=$(curl -sSk https://localhost:8000/login \
+          SALTAPI_TOKEN=$(curl -sSk https://localhost:8000/login \
             -H 'Accept: application/x-yaml' \
-            -d username=salt_api \
-            -d password="'${SALT_API_PASSWORD}'" \
-            -d eauth=pam | grep 'token:' | cut -d' ' -f 4)
-          [ -n "${SALT_API_TOKEN}" ] || exit 1
-          echo "::set-output name=token::${SALT_API_TOKEN}"
+            -d username=${{ env.SALTAPI_USER }} \
+            -d password=${{ env.SALTAPI_PASS }} \
+            -d eauth=${{ env.SALTAPI_EAUTH }} | grep 'token:' | cut -d' ' -f 4)
+          [ -n "${SALTAPI_TOKEN}" ] || exit 1
+          echo "::set-output name=token::${SALTAPI_TOKEN}"
 
       - name: Test salt-api command
         run: |
@@ -149,6 +152,17 @@ jobs:
             -d tgt='*' \
             -d fun=test.stream
 
+      - name: Setup Python
+        uses: actions/setup-python@v2
+        with:
+          python-version: 3.8
+
+      - name: Install salt-pepper
+        run: pip install salt-pepper
+
+      - name: Test salt-pepper
+        run:  pepper --client runner test.stream
+
       - name: Cleanup
         run: |
           docker stop saltstack_master registry
@@ -178,7 +192,13 @@ jobs:
           docker run -d -p 5000:5000 -v ${REGISTRY_PATH}:/var/lib/registry --name registry registry:2
 
       - name: Import Docker images
-        run: docker pull --platform linux/amd64 ${IMAGE_NAME}
+        run: |
+          RETRY_MAX=5
+          for i in $(seq 1 $RETRY_MAX); do
+            [ "$i" != "1" ] && echo "Retrying docker pull"
+            docker pull --platform linux/amd64 ${IMAGE_NAME} && break
+            echo "Command failed with code $?"
+          done
 
       - name: Run Trivy vulnerability scanner
         uses: aquasecurity/trivy-action@master