Skip to content

Commit 178c229

Browse files
rajrohanyadavrajrohanyadav
committed
feat(fips): update harvest tests to run for fips packages
1 parent 8869d88 commit 178c229

File tree

10 files changed

+89
-24
lines changed

10 files changed

+89
-24
lines changed

‎build/build.mk‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -174,6 +174,12 @@ build-harvest-tests: CGO_ENABLED=0
174174
build-harvest-tests: deps
175175
$(GO_BIN) test -c ./test/harvest -tags="harvest" -v
176176

177+
.PHONY: build-harvest-tests-fips
178+
build-harvest-tests-fips: CGO_ENABLED=1
179+
build-harvest-tests-fips: GOEXPERIMENT=boringcrypto
180+
build-harvest-tests-fips: deps
181+
$(GO_BIN) test -c ./test/harvest -tags="harvest,fips" -v
182+
177183

178184
.PHONY: proxy-test
179185
proxy-test:

‎test/automated/ansible/group_vars/localhost/main.yml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -271,6 +271,16 @@ instances:
271271
platform: "linux"
272272
python_interpreter: "/usr/bin/python3"
273273
launch_template: "LaunchTemplateId=lt-0b00afb3f5110a0e6,Version=3"
274+
#################################
275+
# amazon linux 2023 amd64 FIPS
276+
#################################
277+
- ami: "ami-085fa628e46dcb929"
278+
type: "t3a.small"
279+
name: "amd64:al-2023-fips"
280+
username: "ec2-user"
281+
platform: "linux"
282+
python_interpreter: "/usr/bin/python3"
283+
launch_template: "LaunchTemplateId=lt-0b00afb3f5110a0e6,Version=3"
274284
############################
275285
# amazon linux 2023 arm64
276286
############################
@@ -281,6 +291,16 @@ instances:
281291
platform: "linux"
282292
python_interpreter: "/usr/bin/python3"
283293
launch_template: "LaunchTemplateId=lt-0b00afb3f5110a0e6,Version=3"
294+
#################################
295+
# amazon linux 2023 arm64 FIPS
296+
#################################
297+
- ami: "ami-06014e12b8efb52e2"
298+
type: "t4g.small"
299+
name: "arm64:al-2023-fips"
300+
username: "ec2-user"
301+
platform: "linux"
302+
python_interpreter: "/usr/bin/python3"
303+
launch_template: "LaunchTemplateId=lt-0b00afb3f5110a0e6,Version=3"
284304
############################
285305
# windows amd64
286306
############################

‎test/harvest/ansible/README.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,8 @@ localhost ansible_connection=local
1010
1111
[testing_hosts]
1212
amd64:debian-buster ansible_host=192.168.1.12 ansible_user=admin ansible_python_interpreter=/usr/bin/python3
13-
amd64:centos7 ansible_host=192.168.1.13 ansible_user=centos ansible_python_interpreter=/usr/bin/python
13+
amd64:centos7 ansible_host=192.168.1.13 ansible_user=centos ansible_python_interpreter=/usr/bin/python
14+
amd64:al-2023-fips ansible_host=192.168.1.14 ansible_user=ec2-user ansible_python_interpreter=/usr/bin/python3 ansible_ssh_common_args='-o Ciphers=aes256-ctr,aes192-ctr,aes128-ctr -o KexAlgorithms=diffie-hellman-group-exchange-sha256 -o MACs=hmac-sha2-256,hmac-sha2-512'
1415
```
1516

1617
## Playbooks

‎test/harvest/ansible/roles/build-harvest-tests/tasks/main.yml‎

Lines changed: 26 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,41 @@
11
---
22

3-
- name: build harvest tests for every os/arch combination
4-
ansible.builtin.shell: "CGO_ENABLED=0 GOOS=linux GOARCH={{item}} make build-harvest-tests && mv {{ default_binary_name }} {{ os_arch_binary_name_tpl | replace('%GOOS%', 'linux') | replace('%GOARCH%', item) }}"
3+
- name: Build harvest tests for Linux arch combination
4+
ansible.builtin.shell: >
5+
CGO_ENABLED=0 GOOS=linux GOARCH={{ item }} make build-harvest-tests &&
6+
mv {{ default_binary_name }} {{ os_arch_binary_name_tpl | replace('%GOOS%', 'linux') | replace('%GOARCH%', item) }}
57
args:
68
chdir: "{{ agent_root_dir }}"
9+
creates: "{{ os_arch_binary_name_tpl | replace('%GOOS%', 'linux') | replace('%GOARCH%', item) }}"
710
loop: "{{ goos_arch.linux }}"
811

9-
- name: build harvest tests for every os/arch combination
10-
ansible.builtin.shell: "GOOS=darwin GOARCH={{item}} make build-harvest-tests && mv {{ default_binary_name }} {{ os_arch_binary_name_tpl | replace('%GOOS%', 'darwin') | replace('%GOARCH%', item) }}"
12+
- name: Build harvest tests for Linux arch combination - FIPS
13+
ansible.builtin.shell: >
14+
CGO_ENABLED=1 GOEXPERIMENT=boringcrypto GOOS=linux GOARCH={{ item }}
15+
{% if item == 'arm64' %}CC=aarch64-linux-gnu-gcc{% endif %}
16+
make build-harvest-tests-fips &&
17+
mv {{ default_binary_name }} {{ os_arch_binary_name_tpl_fips | replace('%GOOS%', 'linux') | replace('%GOARCH%', item) }}
1118
args:
1219
chdir: "{{ agent_root_dir }}"
20+
creates: "{{ os_arch_binary_name_tpl_fips | replace('%GOOS%', 'linux') | replace('%GOARCH%', item) }}"
21+
loop: "{{ goos_arch.linux_fips }}"
22+
23+
- name: Build harvest tests for Darwin arch combination
24+
ansible.builtin.shell: >
25+
GOOS=darwin GOARCH={{ item }} make build-harvest-tests &&
26+
mv {{ default_binary_name }} {{ os_arch_binary_name_tpl | replace('%GOOS%', 'darwin') | replace('%GOARCH%', item) }}
27+
args:
28+
chdir: "{{ agent_root_dir }}"
29+
creates: "{{ os_arch_binary_name_tpl | replace('%GOOS%', 'darwin') | replace('%GOARCH%', item) }}"
1330
loop: "{{ goos_arch.darwin }}"
1431

15-
- name: build harvest tests for every os/arch combination
16-
ansible.builtin.shell: "GOOS=windows GOARCH={{item}} make build-harvest-tests && mv {{ default_binary_name }}.exe {{ os_arch_binary_name_tpl | replace('%GOOS%', 'win32nt') | replace('%GOARCH%', item) }}.exe"
32+
- name: Build harvest tests for Windows arch combination
33+
ansible.builtin.shell: >
34+
GOOS=windows GOARCH={{ item }} make build-harvest-tests &&
35+
mv {{ default_binary_name }}.exe {{ os_arch_binary_name_tpl | replace('%GOOS%', 'win32nt') | replace('%GOARCH%', item) }}.exe
1736
args:
1837
chdir: "{{ agent_root_dir }}"
38+
creates: "{{ os_arch_binary_name_tpl | replace('%GOOS%', 'win32nt') | replace('%GOARCH%', item) }}.exe"
1939
loop: "{{ goos_arch.windows }}"
2040

2141

‎test/harvest/ansible/roles/build-harvest-tests/vars/main.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,11 +3,15 @@
33
agent_root_dir: ""
44
default_binary_name: "harvest.test"
55
os_arch_binary_name_tpl: "harvest_%GOOS%_%GOARCH%.test"
6+
os_arch_binary_name_tpl_fips: "harvest_%GOOS%-fips_%GOARCH%.test"
67
goos_arch:
78
linux:
89
- "amd64"
910
- "arm"
1011
- "arm64"
12+
linux_fips:
13+
- "amd64"
14+
- "arm64"
1115
darwin:
1216
- "amd64"
1317
- "arm64"

‎test/harvest/ansible/roles/run-harvest-tests/tasks/main.yml‎

Lines changed: 16 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,26 @@
11
---
22

3-
- name: register os/arch specific binary name
4-
set_fact:
5-
os_arch_binary_name: "{{ os_arch_binary_name_tpl | replace('%GOOS%',ansible_system|lower) | replace('%GOARCH%',architecture_map[ansible_architecture]) }}"
3+
- name: Register os/arch specific binary name
4+
ansible.builtin.set_fact:
5+
os_arch_binary_name: "{{ os_arch_binary_name_tpl
6+
| replace('%GOOS%', ansible_system | lower)
7+
| replace('%GOARCH%', architecture_map[ansible_architecture]) }}"
8+
when: "'-fips' not in inventory_hostname"
69

7-
- name: copy binary
10+
- name: Register os/arch specific binary name - FIPS
11+
ansible.builtin.set_fact:
12+
os_arch_binary_name: "{{ os_arch_binary_name_tpl_fips
13+
| replace('%GOOS%', ansible_system | lower)
14+
| replace('%GOARCH%', architecture_map[ansible_architecture]) }}"
15+
when: "'-fips' in inventory_hostname"
16+
17+
- name: Copy binary
818
ansible.builtin.copy:
919
src: "{{ agent_root_dir }}/{{ os_arch_binary_name }}"
1020
dest: "{{ ansible_user_dir }}/{{ os_arch_binary_name }}"
1121
mode: '0755'
1222

13-
- include_tasks: "execute-tests-{{ ansible_system }}.yaml"
23+
- name: Include OS-specific test tasks
24+
ansible.builtin.include_tasks: "execute-tests-{{ ansible_system }}.yaml"
1425

1526
...

‎test/harvest/ansible/roles/run-harvest-tests/vars/main.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,4 +6,5 @@ architecture_map:
66
64-bit: "amd64"
77

88
os_arch_binary_name_tpl: "harvest_%GOOS%_%GOARCH%.test{{ '.exe' if ansible_system == 'Win32NT' else '' }}"
9+
os_arch_binary_name_tpl_fips: "harvest_%GOOS%-fips_%GOARCH%.test{{ '.exe' if ansible_system == 'Win32NT' else '' }}"
910
tests_to_run_regex: ".*"

‎test/harvest/ansible/test.yml‎

Lines changed: 10 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -4,22 +4,24 @@
44
# It will build the harvest tests binaries for specified architectures/os combinations
55
# and copy and run them in the testing_hosts hosts
66

7-
- hosts: localhost
7+
- name: Build harvest tests on localhost
8+
hosts: localhost
89
become: false
9-
gather_facts: no
10+
gather_facts: false
1011

1112
tasks:
12-
- name: build harvest tests
13-
include_role:
13+
- name: Build harvest tests
14+
ansible.builtin.include_role:
1415
name: build-harvest-tests
1516

1617

17-
- hosts: testing_hosts
18-
gather_facts: yes
18+
- name: Copy and run harvest tests on testing hosts
19+
hosts: testing_hosts
20+
gather_facts: true
1921

2022
tasks:
21-
- name: copy and run harvest tests
22-
include_role:
23+
- name: Copy and run harvest tests
24+
ansible.builtin.include_role:
2325
name: run-harvest-tests
2426

2527
...

‎test/provision/terraform/caos.auto.tfvars.dist‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,9 @@ ec2_prefix = "PREFIX:TAG_OR_UNIQUE_NAME"
22

33
windows_ec2 = ["windows_2016", "windows_2019", "windows_2022"]
44

5-
linux_ec2_amd = ["amd64:ubuntu24.04", "amd64:ubuntu22.04", "amd64:ubuntu20.04", "amd64:ubuntu18.04", "amd64:ubuntu16.04", "amd64:centos-stream", "amd64:sles-12.5", "amd64:sles-15.3", "amd64:sles-15.4", "amd64:sles-15.5", "amd64:sles-15.6", "amd64:redhat-8.4", "amd64:redhat-9.0", "amd64:debian-bookworm", "amd64:al-2", "amd64:al-2023"]
5+
linux_ec2_amd = ["amd64:ubuntu24.04", "amd64:ubuntu22.04", "amd64:ubuntu20.04", "amd64:ubuntu18.04", "amd64:ubuntu16.04", "amd64:centos-stream", "amd64:sles-12.5", "amd64:sles-15.3", "amd64:sles-15.4", "amd64:sles-15.5", "amd64:sles-15.6", "amd64:redhat-8.4", "amd64:redhat-9.0", "amd64:debian-bookworm", "amd64:al-2", "amd64:al-2023", "amd64:al-2023-fips"]
66

7-
linux_ec2_arm = ["arm64:ubuntu24.04", "arm64:ubuntu22.04", "arm64:ubuntu20.04", "arm64:ubuntu18.04", "arm64:ubuntu16.04", "arm64:centos-stream", "arm64:sles-15.3", "arm64:sles-15.4", "arm64:sles-15.5", "arm64:sles-15.6", "arm64:redhat-9.0", "arm64:debian-bookworm", "arm64:al-2", "arm64:al-2023"]
7+
linux_ec2_arm = ["arm64:ubuntu24.04", "arm64:ubuntu22.04", "arm64:ubuntu20.04", "arm64:ubuntu18.04", "arm64:ubuntu16.04", "arm64:centos-stream", "arm64:sles-15.3", "arm64:sles-15.4", "arm64:sles-15.5", "arm64:sles-15.6", "arm64:redhat-9.0", "arm64:debian-bookworm", "arm64:al-2", "arm64:al-2023", "arm64:al-2023-fips"]
88

99
ssh_pub_key = "AAAAB3NzaC1yc2EAAAADAQABAAABAQDH9C7BS2XrtXGXFFyL0pNku/Hfy84RliqvYKpuslJFeUivf5QY6Ipi8yXfXn6TsRDbdxfGPi6oOR60Fa+4cJmCo6N5g57hBS6f2IdzQBNrZr7i1I/a3cFeK6XOc1G1tQaurx7Pu+qvACfJjLXKG66tHlaVhAHd/1l2FocgFNUDFFuKS3mnzt9hKys7sB4aO3O0OdohN/0NJC4ldV8/OmeXqqfkiPWcgPx3C8bYyXCX7QJNBHKrzbX1jW51Px7SIDWFDV6kxGwpQGGBMJg/k79gjjM+jhn4fg1/VP/Fx37mAnfLqpcTfiOkzSE80ORGefQ1XfGK/Dpa3ITrzRYW8xlR caos-dev-arm"
1010
pvt_key = "~/.ssh/caos-dev-arm.cer"

‎test/provision/terraform/inventory.tmpl‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,12 +15,12 @@ windows_amd64
1515

1616
[linux_amd64]
1717
%{ for index, vms in agent-ids ~}
18-
%{ if platform[index] == "linux" && strcontains(vms, "amd64") }${vms} ansible_user=${agent-user[index]} ansible_host=${agent-private-ip[index]} ansible_python_interpreter=${agent-python[index]} iid=${instance-id[index]}%{ endif }
18+
%{ if platform[index] == "linux" && strcontains(vms, "amd64") }${vms} ansible_user=${agent-user[index]} ansible_host=${agent-private-ip[index]} ansible_python_interpreter=${agent-python[index]} iid=${instance-id[index]}%{ if strcontains(vms, "fips") } ansible_ssh_common_args='-o Ciphers=aes256-ctr,aes192-ctr,aes128-ctr -o KexAlgorithms=diffie-hellman-group-exchange-sha256 -o MACs=hmac-sha2-256,hmac-sha2-512'%{ endif }%{ endif }
1919
%{ endfor ~}
2020

2121
[linux_arm64]
2222
%{ for index, vms in agent-ids ~}
23-
%{ if platform[index] == "linux" && strcontains(vms, "arm64") }${vms} ansible_user=${agent-user[index]} ansible_host=${agent-private-ip[index]} ansible_python_interpreter=${agent-python[index]} iid=${instance-id[index]}%{ endif }
23+
%{ if platform[index] == "linux" && strcontains(vms, "arm64") }${vms} ansible_user=${agent-user[index]} ansible_host=${agent-private-ip[index]} ansible_python_interpreter=${agent-python[index]} iid=${instance-id[index]}%{ if strcontains(vms, "fips") } ansible_ssh_common_args='-o Ciphers=aes256-ctr,aes192-ctr,aes128-ctr -o KexAlgorithms=diffie-hellman-group-exchange-sha256 -o MACs=hmac-sha2-256,hmac-sha2-512'%{ endif }%{ endif }
2424
%{ endfor ~}
2525

2626
[windows_amd64]

0 commit comments

Comments
 (0)