test

.ci/docker-compose.yml

@@ -55,3 +55,13 @@ services:
       &kong-depends_on
       kong-db:
         condition: service_healthy
+
+  kong-gen-cert:
+    # Using a empty string as the fallback makes this env optional but still fails if not set when used
+    image: "kong/kong:nightly-ubuntu"
+    security_opt:
+      - no-new-privileges:true
+    command: >-
+      sh -c "kong hybrid gen_cert /tmp/hybrid/cluster.crt /tmp/hybrid/cluster.key"
+    volumes:
+      - "${GITHUB_WORKSPACE:-.}/hybrid:/tmp/hybrid:z"

.github/workflows/test_container_perm.yml

@@ -0,0 +1,23 @@
+name: Test Container Perm
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+on:
+  push:
+
+jobs:
+  test-container-perm:
+    name: Test Container Perm
+    runs-on: ubuntu-latest
+    secrets: inherit
+    steps:
+      - name: Test Container Perm
+        timeout-minutes: 10
+        working-directory: ${{ github.workspace }}
+        env:
+          GATEWAY_IMAGE: ${{ inputs.gateway-image }}
+        run: |
+          id
+          docker compose -f .ci/docker-compose.yml up kong-gen-cert