Skip to content

Commit 52d56fd

Browse files
alvarocabanasrajrohanyadav
alvarocabanas
authored and
rajrohanyadav
committed
Create new docker FIPS images (#1982)
1 parent cc50acc commit 52d56fd

8 files changed

+117
-12
lines changed

‎.github/workflows/component_docker_packaging.yml

+9-4
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,10 @@ on:
1919
TAG:
2020
required: true
2121
type: string
22+
FIPS:
23+
required: false
24+
type: boolean
25+
default: false
2226

2327
env:
2428
GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
@@ -29,6 +33,7 @@ env:
2933
DOCKER_HUB_ID: ${{ secrets.DOCKER_HUB_ID }}
3034
DOCKER_HUB_PASSWORD: ${{ secrets.DOCKER_HUB_PASSWORD }}
3135
DOCKER_PUBLISH: true
36+
FIPS: ${{ inputs.FIPS == true && '-fips' || '' }}
3237

3338
jobs:
3439
packaging:
@@ -47,7 +52,7 @@ jobs:
4752
password: ${{ env.DOCKER_HUB_PASSWORD }}
4853

4954
- name: Compiling binaries for linux amd64, arm, arm64
50-
run: make ci/prerelease/linux-for-docker
55+
run: make ci/prerelease/linux-for-docker${{env.FIPS}}
5156

5257
- name: Set up QEMU
5358
uses: docker/setup-qemu-action@v1
@@ -58,10 +63,10 @@ jobs:
5863
version: v0.9.1
5964

6065
- name: Build and publish Release Candidate (RC) of base Docker image
61-
run: AGENT_VERSION=${{env.TAG}} make -C build/container/ clean publish/multi-arch-base-rc
66+
run: AGENT_VERSION=${{env.TAG}} FIPS=${{env.FIPS}} make -C build/container/ clean publish/multi-arch-base-rc
6267

6368
- name: Build and publish Release Candidate (RC) of forwarder Docker image
64-
run: AGENT_VERSION=${{env.TAG}} make -C build/container/ clean publish/multi-arch-forwarder-rc
69+
run: AGENT_VERSION=${{env.TAG}} FIPS=${{env.FIPS}} make -C build/container/ clean publish/multi-arch-forwarder-rc
6570

6671
- name: Build and publish Release Candidate (RC) of k8s-events-forwarders Docker image
67-
run: AGENT_VERSION=${{env.TAG}} make -C build/container/ clean publish/multi-arch-k8s-events-forwarder-rc
72+
run: AGENT_VERSION=${{env.TAG}} FIPS=${{env.FIPS}} make -C build/container/ clean publish/multi-arch-k8s-events-forwarder-rc

‎.github/workflows/component_docker_publish.yml

+19-1
Original file line numberDiff line numberDiff line change
@@ -53,4 +53,22 @@ jobs:
5353
run: make -C build/container/ clean publish/multi-arch-k8s-events-forwarder-tag AGENT_VERSION=${{env.TAG}}
5454

5555
- name: Publish latest of k8s-events-forwarders Docker image
56-
run: make -C build/container/ clean publish/multi-arch-k8s-events-forwarder-latest AGENT_VERSION=${{env.TAG}}
56+
run: make -C build/container/ clean publish/multi-arch-k8s-events-forwarder-latest AGENT_VERSION=${{env.TAG}}
57+
58+
- name: Publish tag of base Docker image FIPS
59+
run: make -C build/container/ clean publish/multi-arch-base-tag AGENT_VERSION=${{env.TAG}} FIPS=${{env.FIPS}}
60+
61+
- name: Publish latest of base Docker image FIPS
62+
run: make -C build/container/ clean publish/multi-arch-base-latest AGENT_VERSION=${{env.TAG}} FIPS=${{env.FIPS}}
63+
64+
- name: Publish tag of forwarder Docker image FIPS
65+
run: make -C build/container/ clean publish/multi-arch-forwarder-tag AGENT_VERSION=${{env.TAG}} FIPS=${{env.FIPS}}
66+
67+
- name: Publish latest of forwarder Docker image FIPS
68+
run: make -C build/container/ clean publish/multi-arch-forwarder-latest AGENT_VERSION=${{env.TAG}} FIPS=${{env.FIPS}}
69+
70+
- name: Publish tag of k8s-events-forwarders Docker image FIPS
71+
run: make -C build/container/ clean publish/multi-arch-k8s-events-forwarder-tag AGENT_VERSION=${{env.TAG}} FIPS=${{env.FIPS}}
72+
73+
- name: Publish latest of k8s-events-forwarders Docker image FIPS
74+
run: make -C build/container/ clean publish/multi-arch-k8s-events-forwarder-latest AGENT_VERSION=${{env.TAG}} FIPS=${{env.FIPS}}

‎.github/workflows/component_trivy.yml

+11-4
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,13 @@ on:
1212
severity:
1313
required: true
1414
type: string
15+
FIPS:
16+
required: false
17+
type: boolean
18+
default: false
19+
20+
env:
21+
FIPS: ${{ inputs.FIPS == true && '-fips' || '' }}
1522

1623
jobs:
1724
trivy_scanner:
@@ -22,7 +29,7 @@ jobs:
2229
- name: newrelic/infrastructure
2330
uses: aquasecurity/trivy-action@master
2431
with:
25-
image-ref: "docker.io/newrelic/infrastructure:${{ inputs.tag }}"
32+
image-ref: "docker.io/newrelic/infrastructure${{ env.FIPS }}:${{ inputs.tag }}"
2633
format: 'table'
2734
exit-code: '1'
2835
ignore-unfixed: true
@@ -35,7 +42,7 @@ jobs:
3542
- name: newrelic/k8s-events-forwarder
3643
uses: aquasecurity/trivy-action@master
3744
with:
38-
image-ref: "docker.io/newrelic/k8s-events-forwarder:${{ inputs.tag }}"
45+
image-ref: "docker.io/newrelic/k8s-events-forwarder${{ env.FIPS }}:${{ inputs.tag }}"
3946
format: 'table'
4047
exit-code: '1'
4148
ignore-unfixed: true
@@ -48,7 +55,7 @@ jobs:
4855
- name: newrelic/nri-forwarder
4956
uses: aquasecurity/trivy-action@master
5057
with:
51-
image-ref: "docker.io/newrelic/nri-forwarder:${{ inputs.tag }}"
58+
image-ref: "docker.io/newrelic/nri-forwarder${{ env.FIPS }}:${{ inputs.tag }}"
5259
format: 'table'
5360
exit-code: '1'
5461
ignore-unfixed: true
@@ -69,7 +76,7 @@ jobs:
6976
- name: Sarif newrelic/infrastructure
7077
uses: aquasecurity/trivy-action@master
7178
with:
72-
image-ref: "docker.io/newrelic/infrastructure:${{ inputs.tag }}"
79+
image-ref: "docker.io/newrelic/infrastructure${{ env.FIPS }}:${{ inputs.tag }}"
7380
format: 'sarif'
7481
output: 'trivy-results.sarif'
7582
vuln-type: 'os,library'

‎.github/workflows/prerelease_linux.yml

+22
Original file line numberDiff line numberDiff line change
@@ -124,6 +124,28 @@ jobs:
124124
tag: "${{ github.event.release.tag_name }}-rc"
125125
severity: "CRITICAL"
126126

127+
packaging-docker-fips:
128+
needs: [unit-test, proxy-tests]
129+
uses: ./.github/workflows/component_docker_packaging.yml
130+
secrets:
131+
DOCKER_HUB_ID: ${{secrets.OHAI_DOCKER_HUB_ID}}
132+
DOCKER_HUB_PASSWORD: ${{secrets.OHAI_DOCKER_HUB_PASSWORD}}
133+
GPG_MAIL: '[email protected]'
134+
GPG_PASSPHRASE: ${{ secrets.OHAI_GPG_PASSPHRASE }}
135+
GPG_PRIVATE_KEY_BASE64: ${{ secrets.OHAI_GPG_PRIVATE_KEY_BASE64 }} # base64 encoded
136+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
137+
with:
138+
TAG: ${{ github.event.release.tag_name }}
139+
FIPS: true
140+
141+
docker-fips-trivy-critical:
142+
needs: [packaging-docker-fips]
143+
uses: ./.github/workflows/component_trivy.yml
144+
with:
145+
tag: "${{ github.event.release.tag_name }}-rc"
146+
severity: "CRITICAL"
147+
FIPS: true
148+
127149
publishing-to-s3:
128150
# point to staging after tests
129151
name: Publish linux artifacts into s3 staging bucket

‎build/ci.mk

+4
Original file line numberDiff line numberDiff line change
@@ -84,6 +84,10 @@ ci/prerelease/linux-legacy:
8484
ci/prerelease/linux-for-docker:
8585
TARGET_OS=linux-for-docker $(MAKE) ci/prerelease
8686

87+
.PHONY : ci/prerelease/linux-for-docker-fips
88+
ci/prerelease/linux-for-docker-fips:
89+
TARGET_OS=linux-for-docker-fips $(MAKE) ci/prerelease
90+
8791

8892
.PHONY : ci/prerelease/macos
8993
ci/prerelease/macos:

‎build/container/Dockerfile

+4
Original file line numberDiff line numberDiff line change
@@ -36,8 +36,12 @@ RUN apk add --no-cache --upgrade \
3636
# libpthread.so.0 => /lib64/ld-linux-x86-64.so.2 (0x7f2bbbd0f000)
3737
# libc.so.6 => /lib64/ld-linux-x86-64.so.2 (0x7f2bbbd0f000)
3838
# As musl and glibc are compatible, this symlink fixes the missing dependency
39+
# The simlink is added both for amd64 and arm64 architectures
3940
&& mkdir /lib64 \
4041
&& ln -s /lib/libc.musl-x86_64.so.1 /lib64/ld-linux-x86-64.so.2 \
42+
&& ln -s /lib/libc.musl-aarch64.so.1 /lib64/ld-linux-aarch64.so.1 \
43+
# libresolv.so.2 is needed when CGO is enabled so we add the glibc compatibility for Alpine
44+
&& apk add --no-cache gcompat \
4145
&& apk add --no-cache tini
4246

4347
# Tini is now available at /sbin/tini

‎build/container/Makefile

+32-3
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ DOCKER_BUILD_TAG_PREFIX ?= build
1616
DOCKER_TAG_LATEST ?= latest
1717
USE_BUILDX ?= false
1818
DOCKER_PUBLISH ?= false
19+
FIPS ?=
1920

2021
AGENT_ARCH ?= $(DOCKER_ARCH)
2122

@@ -50,12 +51,12 @@ AGENT_VERSION ?= 0.0.0
5051
IMAGE_VERSION ?= $(AGENT_VERSION)
5152

5253
NS ?= newrelic
53-
REPO ?= infrastructure
54+
REPO ?= infrastructure${FIPS}
5455
IMAGE_NAME ?= ${NS}/${REPO}
5556
CORE_IMAGE_NAME ?= ${IMAGE_NAME}-core
5657
BASE_IMAGE_NAME ?= ${IMAGE_NAME}
57-
K8S_FWD_IMAGE_NAME ?= ${NS}/k8s-events-forwarder
58-
FWD_IMAGE_NAME ?= ${NS}/nri-forwarder
58+
K8S_FWD_IMAGE_NAME ?= ${NS}/k8s-events-forwarder${FIPS}
59+
FWD_IMAGE_NAME ?= ${NS}/nri-forwarder${FIPS}
5960
DOCKER_IMAGE_NAME ?= ${BASE_IMAGE_NAME}
6061

6162
AGENT_BIN ?= newrelic-infra
@@ -265,19 +266,29 @@ publish/multi-arch-base-manifest :
265266
@printf 'Target: publish/base-manifest\n'
266267
@printf 'Image: $(DOCKER_IMAGE_NAME):$(IMAGE_VERSION)'
267268
@printf '\n================================================================\n'
269+
ifeq ($(FIPS),)
268270
@(docker manifest create \
269271
$(DOCKER_IMAGE_NAME):$(IMAGE_VERSION) \
270272
$(DOCKER_IMAGE_NAME):$(DOCKER_BUILD_TAG_PREFIX)-arm64 \
271273
$(DOCKER_IMAGE_NAME):$(DOCKER_BUILD_TAG_PREFIX)-arm \
272274
$(DOCKER_IMAGE_NAME):$(DOCKER_BUILD_TAG_PREFIX)-amd64)
275+
else
276+
@(docker manifest create \
277+
$(DOCKER_IMAGE_NAME):$(IMAGE_VERSION) \
278+
$(DOCKER_IMAGE_NAME):$(DOCKER_BUILD_TAG_PREFIX)-arm64 \
279+
$(DOCKER_IMAGE_NAME):$(DOCKER_BUILD_TAG_PREFIX)-amd64)
280+
endif
273281
@docker manifest push $(DOCKER_IMAGE_NAME):$(IMAGE_VERSION)
274282

283+
275284
# [RC] Shortcut to build all supported multi arch bases and publish as RC
276285
.PHONY : publish/multi-arch-base-rc
277286
publish/multi-arch-base-rc : export IMAGE_VERSION=$(AGENT_VERSION)-rc
278287
publish/multi-arch-base-rc : export DOCKER_BUILD_TAG_PREFIX=$(IMAGE_VERSION)
279288
publish/multi-arch-base-rc : build/base-arm64
289+
ifeq ($(FIPS),)
280290
publish/multi-arch-base-rc : build/base-arm
291+
endif
281292
publish/multi-arch-base-rc : build/base-amd64
282293
publish/multi-arch-base-rc : publish/multi-arch-base-manifest
283294

@@ -301,19 +312,28 @@ publish/multi-arch-k8s-events-forwarder-manifest :
301312
@printf 'Target: publish/k8s-events-forwarder-manifest\n'
302313
@printf 'Image: $(DOCKER_IMAGE_NAME):$(IMAGE_VERSION)'
303314
@printf '\n================================================================\n'
315+
ifeq ($(FIPS),)
304316
@(docker manifest create \
305317
$(DOCKER_IMAGE_NAME):$(IMAGE_VERSION) \
306318
$(DOCKER_IMAGE_NAME):$(DOCKER_BUILD_TAG_PREFIX)-arm64 \
307319
$(DOCKER_IMAGE_NAME):$(DOCKER_BUILD_TAG_PREFIX)-arm \
308320
$(DOCKER_IMAGE_NAME):$(DOCKER_BUILD_TAG_PREFIX)-amd64)
321+
else
322+
@(docker manifest create \
323+
$(DOCKER_IMAGE_NAME):$(IMAGE_VERSION) \
324+
$(DOCKER_IMAGE_NAME):$(DOCKER_BUILD_TAG_PREFIX)-arm64 \
325+
$(DOCKER_IMAGE_NAME):$(DOCKER_BUILD_TAG_PREFIX)-amd64)
326+
endif
309327
@docker manifest push $(DOCKER_IMAGE_NAME):$(IMAGE_VERSION)
310328

311329
# [RC] Shortcut to build all supported multi arch k8s-events-forwarders and publish as RC
312330
.PHONY : publish/multi-arch-k8s-events-forwarder-rc
313331
publish/multi-arch-k8s-events-forwarder-rc : export IMAGE_VERSION=$(AGENT_VERSION)-rc
314332
publish/multi-arch-k8s-events-forwarder-rc : export DOCKER_BUILD_TAG_PREFIX=$(IMAGE_VERSION)
315333
publish/multi-arch-k8s-events-forwarder-rc : build/k8s-events-forwarder-arm64
334+
ifeq ($(FIPS),)
316335
publish/multi-arch-k8s-events-forwarder-rc : build/k8s-events-forwarder-arm
336+
endif
317337
publish/multi-arch-k8s-events-forwarder-rc : build/k8s-events-forwarder-amd64
318338
publish/multi-arch-k8s-events-forwarder-rc : publish/multi-arch-k8s-events-forwarder-manifest
319339

@@ -337,11 +357,18 @@ publish/multi-arch-forwarder-manifest :
337357
@printf 'Target: publish/forwarder-manifest\n'
338358
@printf 'Image: $(DOCKER_IMAGE_NAME):$(IMAGE_VERSION)'
339359
@printf '\n================================================================\n'
360+
ifeq ($(FIPS),)
340361
@(docker manifest create \
341362
$(DOCKER_IMAGE_NAME):$(IMAGE_VERSION) \
342363
$(DOCKER_IMAGE_NAME):$(DOCKER_BUILD_TAG_PREFIX)-arm64 \
343364
$(DOCKER_IMAGE_NAME):$(DOCKER_BUILD_TAG_PREFIX)-arm \
344365
$(DOCKER_IMAGE_NAME):$(DOCKER_BUILD_TAG_PREFIX)-amd64)
366+
else
367+
@(docker manifest create \
368+
$(DOCKER_IMAGE_NAME):$(IMAGE_VERSION) \
369+
$(DOCKER_IMAGE_NAME):$(DOCKER_BUILD_TAG_PREFIX)-arm64 \
370+
$(DOCKER_IMAGE_NAME):$(DOCKER_BUILD_TAG_PREFIX)-amd64)
371+
endif
345372
@docker manifest push $(DOCKER_IMAGE_NAME):$(IMAGE_VERSION)
346373

347374

@@ -350,7 +377,9 @@ publish/multi-arch-forwarder-manifest :
350377
publish/multi-arch-forwarder-rc : export IMAGE_VERSION=$(AGENT_VERSION)-rc
351378
publish/multi-arch-forwarder-rc : export DOCKER_BUILD_TAG_PREFIX=$(IMAGE_VERSION)
352379
publish/multi-arch-forwarder-rc : build/forwarder-arm64
380+
ifeq ($(FIPS),)
353381
publish/multi-arch-forwarder-rc : build/forwarder-arm
382+
endif
354383
publish/multi-arch-forwarder-rc : build/forwarder-amd64
355384
publish/multi-arch-forwarder-rc : publish/multi-arch-forwarder-manifest
356385

‎build/release.mk

+16
Original file line numberDiff line numberDiff line change
@@ -110,6 +110,11 @@ release/pkg-linux-for-docker: release/deps release/clean generate-goreleaser-for
110110
@echo "=== [release/pkg-linux-for-docker] PRE-RELEASE compiling all binaries"
111111
$(GORELEASER_BIN) release --config $(GORELEASER_CONFIG_LINUX) $(PKG_FLAGS)
112112

113+
.PHONY : release/pkg-linux-for-docker-fips
114+
release/pkg-linux-for-docker-fips: release/deps release/clean generate-goreleaser-for-docker-fips
115+
@echo "=== [release/pkg-linux-for-docker-fips] PRE-RELEASE compiling all binaries"
116+
$(GORELEASER_BIN) release --config $(GORELEASER_CONFIG_LINUX) $(PKG_FLAGS)
117+
113118
.PHONY : release/pkg-macos
114119
release/pkg-macos: release/deps release/clean
115120
#release/pkg-macos: release/get-integrations-amd64-macos NO ASSETS AVAILABLE FOR NOW
@@ -169,6 +174,10 @@ release-linux-arm64: release/pkg-linux-arm64 release/fix-tarballs-linux release/
169174
release-linux-for-docker: release/pkg-linux-for-docker
170175
@echo "=== [release-linux-for-docker] compiling assets for docker"
171176

177+
.PHONY : release-linux-for-docker-fips
178+
release-linux-for-docker-fips: release/pkg-linux-for-docker-fips
179+
@echo "=== [release-linux-for-docker-fips] compiling assets for docker - FIPS"
180+
172181
.PHONY : release-macos
173182
release-macos: release/pkg-macos release/fix-tarballs-macos
174183
@echo "=== [release-macos] full pre-release cycle complete for macOS"
@@ -371,6 +380,13 @@ generate-goreleaser-for-docker:
371380
$(CURDIR)/build/goreleaser/linux/build_arm64.yml\
372381
> $(GORELEASER_CONFIG_LINUX)
373382

383+
.PHONY : generate-goreleaser-for-docker-fips
384+
generate-goreleaser-for-docker-fips:
385+
cat $(CURDIR)/build/goreleaser/linux/header.yml\
386+
$(CURDIR)/build/goreleaser/linux/build_amd64_fips.yml\
387+
$(CURDIR)/build/goreleaser/linux/build_arm64_fips.yml\
388+
> $(GORELEASER_CONFIG_LINUX)
389+
374390
ifndef SNAPSHOT
375391
$(error SNAPSHOT is undefined)
376392
endif

0 commit comments

Comments
 (0)