Skip to content

Commit aa44252

Browse files
rajrohanyadavrajrohanyadav
committed
feat(fips): update tests to run for fips packages (#1980)
* update harvest tests to run for fips packages * chore: update action versions * update packaging tests * assume role for 2 hours as tests can take longer than 1 hour
1 parent fb4bec6 commit aa44252

File tree

19 files changed

+264
-149
lines changed

19 files changed

+264
-149
lines changed

‎.github/workflows/component_prerelease_testing.yml

+13-12
Original file line numberDiff line numberDiff line change
@@ -39,10 +39,10 @@ jobs:
3939
provision:
4040
runs-on: ubuntu-20.04
4141
steps:
42-
- uses: actions/checkout@v2
42+
- uses: actions/checkout@v4
4343

4444
- name: Configure AWS Credentials
45-
uses: aws-actions/configure-aws-credentials@v1
45+
uses: aws-actions/configure-aws-credentials@v4
4646
with:
4747
role-to-assume: ${{ env.AWS_ASSUME_ROLE }}
4848
aws-region: us-east-2
@@ -79,10 +79,10 @@ jobs:
7979
needs: [ provision ]
8080
runs-on: ubuntu-20.04
8181
steps:
82-
- uses: actions/checkout@v2
82+
- uses: actions/checkout@v4
8383

8484
- name: Configure AWS Credentials
85-
uses: aws-actions/configure-aws-credentials@v1
85+
uses: aws-actions/configure-aws-credentials@v4
8686
with:
8787
role-to-assume: ${{ env.AWS_ASSUME_ROLE }}
8888
aws-region: us-east-2
@@ -120,13 +120,14 @@ jobs:
120120
needs: [ harvest-tests ]
121121
runs-on: ubuntu-20.04
122122
steps:
123-
- uses: actions/checkout@v2
123+
- uses: actions/checkout@v4
124124

125125
- name: Configure AWS Credentials
126-
uses: aws-actions/configure-aws-credentials@v1
126+
uses: aws-actions/configure-aws-credentials@v4
127127
with:
128128
role-to-assume: ${{ env.AWS_ASSUME_ROLE }}
129129
aws-region: us-east-2
130+
role-duration-seconds: 7200
130131

131132
- name: Set branch name
132133
run: |
@@ -154,10 +155,10 @@ jobs:
154155
needs: [ harvest-tests ]
155156
runs-on: ubuntu-20.04
156157
steps:
157-
- uses: actions/checkout@v2
158+
- uses: actions/checkout@v4
158159

159160
- name: Configure AWS Credentials
160-
uses: aws-actions/configure-aws-credentials@v1
161+
uses: aws-actions/configure-aws-credentials@v4
161162
with:
162163
role-to-assume: ${{ env.AWS_ASSUME_ROLE }}
163164
aws-region: us-east-2
@@ -188,10 +189,10 @@ jobs:
188189
needs: [ packaging-tests-linux ]
189190
runs-on: ubuntu-20.04
190191
steps:
191-
- uses: actions/checkout@v2
192+
- uses: actions/checkout@v4
192193

193194
- name: Configure AWS Credentials
194-
uses: aws-actions/configure-aws-credentials@v1
195+
uses: aws-actions/configure-aws-credentials@v4
195196
with:
196197
role-to-assume: ${{ env.AWS_ASSUME_ROLE }}
197198
aws-region: us-east-2
@@ -229,10 +230,10 @@ jobs:
229230
needs: [ packaging-tests-windows ]
230231
runs-on: ubuntu-20.04
231232
steps:
232-
- uses: actions/checkout@v2
233+
- uses: actions/checkout@v4
233234

234235
- name: Configure AWS Credentials
235-
uses: aws-actions/configure-aws-credentials@v1
236+
uses: aws-actions/configure-aws-credentials@v4
236237
with:
237238
role-to-assume: ${{ env.AWS_ASSUME_ROLE }}
238239
aws-region: us-east-2

‎build/build.mk

+6
Original file line numberDiff line numberDiff line change
@@ -174,6 +174,12 @@ build-harvest-tests: CGO_ENABLED=0
174174
build-harvest-tests: deps
175175
$(GO_BIN) test -c ./test/harvest -tags="harvest" -v
176176

177+
.PHONY: build-harvest-tests-fips
178+
build-harvest-tests-fips: CGO_ENABLED=1
179+
build-harvest-tests-fips: GOEXPERIMENT=boringcrypto
180+
build-harvest-tests-fips: deps
181+
$(GO_BIN) test -c ./test/harvest -tags="harvest,fips" -v
182+
177183

178184
.PHONY: proxy-test
179185
proxy-test:

‎test/automated/ansible/group_vars/localhost/main.yml

+20
Original file line numberDiff line numberDiff line change
@@ -271,6 +271,16 @@ instances:
271271
platform: "linux"
272272
python_interpreter: "/usr/bin/python3"
273273
launch_template: "LaunchTemplateId=lt-0b00afb3f5110a0e6,Version=3"
274+
#################################
275+
# amazon linux 2023 amd64 FIPS
276+
#################################
277+
- ami: "ami-085fa628e46dcb929"
278+
type: "t3a.small"
279+
name: "amd64:al-2023-fips"
280+
username: "ec2-user"
281+
platform: "linux"
282+
python_interpreter: "/usr/bin/python3"
283+
launch_template: "LaunchTemplateId=lt-0b00afb3f5110a0e6,Version=3"
274284
############################
275285
# amazon linux 2023 arm64
276286
############################
@@ -281,6 +291,16 @@ instances:
281291
platform: "linux"
282292
python_interpreter: "/usr/bin/python3"
283293
launch_template: "LaunchTemplateId=lt-0b00afb3f5110a0e6,Version=3"
294+
#################################
295+
# amazon linux 2023 arm64 FIPS
296+
#################################
297+
- ami: "ami-06014e12b8efb52e2"
298+
type: "t4g.small"
299+
name: "arm64:al-2023-fips"
300+
username: "ec2-user"
301+
platform: "linux"
302+
python_interpreter: "/usr/bin/python3"
303+
launch_template: "LaunchTemplateId=lt-0b00afb3f5110a0e6,Version=3"
284304
############################
285305
# windows amd64
286306
############################

‎test/harvest/ansible/README.md

+2-1
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,8 @@ localhost ansible_connection=local
1010
1111
[testing_hosts]
1212
amd64:debian-buster ansible_host=192.168.1.12 ansible_user=admin ansible_python_interpreter=/usr/bin/python3
13-
amd64:centos7 ansible_host=192.168.1.13 ansible_user=centos ansible_python_interpreter=/usr/bin/python
13+
amd64:centos7 ansible_host=192.168.1.13 ansible_user=centos ansible_python_interpreter=/usr/bin/python
14+
amd64:al-2023-fips ansible_host=192.168.1.14 ansible_user=ec2-user ansible_python_interpreter=/usr/bin/python3 ansible_ssh_common_args='-o Ciphers=aes256-ctr,aes192-ctr,aes128-ctr -o KexAlgorithms=ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521 -o MACs=hmac-sha2-256,hmac-sha2-512'
1415
```
1516

1617
## Playbooks

‎test/harvest/ansible/roles/build-harvest-tests/tasks/main.yml

+26-6
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,41 @@
11
---
22

3-
- name: build harvest tests for every os/arch combination
4-
ansible.builtin.shell: "CGO_ENABLED=0 GOOS=linux GOARCH={{item}} make build-harvest-tests && mv {{ default_binary_name }} {{ os_arch_binary_name_tpl | replace('%GOOS%', 'linux') | replace('%GOARCH%', item) }}"
3+
- name: Build harvest tests for Linux arch combination
4+
ansible.builtin.shell: >
5+
CGO_ENABLED=0 GOOS=linux GOARCH={{ item }} make build-harvest-tests &&
6+
mv {{ default_binary_name }} {{ os_arch_binary_name_tpl | replace('%GOOS%', 'linux') | replace('%GOARCH%', item) }}
57
args:
68
chdir: "{{ agent_root_dir }}"
9+
creates: "{{ os_arch_binary_name_tpl | replace('%GOOS%', 'linux') | replace('%GOARCH%', item) }}"
710
loop: "{{ goos_arch.linux }}"
811

9-
- name: build harvest tests for every os/arch combination
10-
ansible.builtin.shell: "GOOS=darwin GOARCH={{item}} make build-harvest-tests && mv {{ default_binary_name }} {{ os_arch_binary_name_tpl | replace('%GOOS%', 'darwin') | replace('%GOARCH%', item) }}"
12+
- name: Build harvest tests for Linux arch combination - FIPS
13+
ansible.builtin.shell: >
14+
CGO_ENABLED=1 GOEXPERIMENT=boringcrypto GOOS=linux GOARCH={{ item }}
15+
{% if item == 'arm64' %}CC=aarch64-linux-gnu-gcc{% endif %}
16+
make build-harvest-tests-fips &&
17+
mv {{ default_binary_name }} {{ os_arch_binary_name_tpl_fips | replace('%GOOS%', 'linux') | replace('%GOARCH%', item) }}
1118
args:
1219
chdir: "{{ agent_root_dir }}"
20+
creates: "{{ os_arch_binary_name_tpl_fips | replace('%GOOS%', 'linux') | replace('%GOARCH%', item) }}"
21+
loop: "{{ goos_arch.linux_fips }}"
22+
23+
- name: Build harvest tests for Darwin arch combination
24+
ansible.builtin.shell: >
25+
GOOS=darwin GOARCH={{ item }} make build-harvest-tests &&
26+
mv {{ default_binary_name }} {{ os_arch_binary_name_tpl | replace('%GOOS%', 'darwin') | replace('%GOARCH%', item) }}
27+
args:
28+
chdir: "{{ agent_root_dir }}"
29+
creates: "{{ os_arch_binary_name_tpl | replace('%GOOS%', 'darwin') | replace('%GOARCH%', item) }}"
1330
loop: "{{ goos_arch.darwin }}"
1431

15-
- name: build harvest tests for every os/arch combination
16-
ansible.builtin.shell: "GOOS=windows GOARCH={{item}} make build-harvest-tests && mv {{ default_binary_name }}.exe {{ os_arch_binary_name_tpl | replace('%GOOS%', 'win32nt') | replace('%GOARCH%', item) }}.exe"
32+
- name: Build harvest tests for Windows arch combination
33+
ansible.builtin.shell: >
34+
GOOS=windows GOARCH={{ item }} make build-harvest-tests &&
35+
mv {{ default_binary_name }}.exe {{ os_arch_binary_name_tpl | replace('%GOOS%', 'win32nt') | replace('%GOARCH%', item) }}.exe
1736
args:
1837
chdir: "{{ agent_root_dir }}"
38+
creates: "{{ os_arch_binary_name_tpl | replace('%GOOS%', 'win32nt') | replace('%GOARCH%', item) }}.exe"
1939
loop: "{{ goos_arch.windows }}"
2040

2141

‎test/harvest/ansible/roles/build-harvest-tests/vars/main.yml

+4
Original file line numberDiff line numberDiff line change
@@ -3,11 +3,15 @@
33
agent_root_dir: ""
44
default_binary_name: "harvest.test"
55
os_arch_binary_name_tpl: "harvest_%GOOS%_%GOARCH%.test"
6+
os_arch_binary_name_tpl_fips: "harvest_%GOOS%-fips_%GOARCH%.test"
67
goos_arch:
78
linux:
89
- "amd64"
910
- "arm"
1011
- "arm64"
12+
linux_fips:
13+
- "amd64"
14+
- "arm64"
1115
darwin:
1216
- "amd64"
1317
- "arm64"

‎test/harvest/ansible/roles/run-harvest-tests/tasks/main.yml

+16-5
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,26 @@
11
---
22

3-
- name: register os/arch specific binary name
4-
set_fact:
5-
os_arch_binary_name: "{{ os_arch_binary_name_tpl | replace('%GOOS%',ansible_system|lower) | replace('%GOARCH%',architecture_map[ansible_architecture]) }}"
3+
- name: Register os/arch specific binary name
4+
ansible.builtin.set_fact:
5+
os_arch_binary_name: "{{ os_arch_binary_name_tpl
6+
| replace('%GOOS%', ansible_system | lower)
7+
| replace('%GOARCH%', architecture_map[ansible_architecture]) }}"
8+
when: "'-fips' not in inventory_hostname"
69

7-
- name: copy binary
10+
- name: Register os/arch specific binary name - FIPS
11+
ansible.builtin.set_fact:
12+
os_arch_binary_name: "{{ os_arch_binary_name_tpl_fips
13+
| replace('%GOOS%', ansible_system | lower)
14+
| replace('%GOARCH%', architecture_map[ansible_architecture]) }}"
15+
when: "'-fips' in inventory_hostname"
16+
17+
- name: Copy binary
818
ansible.builtin.copy:
919
src: "{{ agent_root_dir }}/{{ os_arch_binary_name }}"
1020
dest: "{{ ansible_user_dir }}/{{ os_arch_binary_name }}"
1121
mode: '0755'
1222

13-
- include_tasks: "execute-tests-{{ ansible_system }}.yaml"
23+
- name: Include OS-specific test tasks
24+
ansible.builtin.include_tasks: "execute-tests-{{ ansible_system }}.yaml"
1425

1526
...

‎test/harvest/ansible/roles/run-harvest-tests/vars/main.yml

+1
Original file line numberDiff line numberDiff line change
@@ -6,4 +6,5 @@ architecture_map:
66
64-bit: "amd64"
77

88
os_arch_binary_name_tpl: "harvest_%GOOS%_%GOARCH%.test{{ '.exe' if ansible_system == 'Win32NT' else '' }}"
9+
os_arch_binary_name_tpl_fips: "harvest_%GOOS%-fips_%GOARCH%.test{{ '.exe' if ansible_system == 'Win32NT' else '' }}"
910
tests_to_run_regex: ".*"

‎test/harvest/ansible/test.yml

+10-8
Original file line numberDiff line numberDiff line change
@@ -4,22 +4,24 @@
44
# It will build the harvest tests binaries for specified architectures/os combinations
55
# and copy and run them in the testing_hosts hosts
66

7-
- hosts: localhost
7+
- name: Build harvest tests on localhost
8+
hosts: localhost
89
become: false
9-
gather_facts: no
10+
gather_facts: false
1011

1112
tasks:
12-
- name: build harvest tests
13-
include_role:
13+
- name: Build harvest tests
14+
ansible.builtin.include_role:
1415
name: build-harvest-tests
1516

1617

17-
- hosts: testing_hosts
18-
gather_facts: yes
18+
- name: Copy and run harvest tests on testing hosts
19+
hosts: testing_hosts
20+
gather_facts: true
1921

2022
tasks:
21-
- name: copy and run harvest tests
22-
include_role:
23+
- name: Copy and run harvest tests
24+
ansible.builtin.include_role:
2325
name: run-harvest-tests
2426

2527
...

‎test/packaging/ansible/README.md

+2-1
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,8 @@ localhost ansible_connection=local
99
1010
[testing_hosts]
1111
amd64:debian-buster ansible_host=192.168.1.12 ansible_user=admin ansible_python_interpreter=/usr/bin/python3
12-
amd64:centos7 ansible_host=192.168.1.13 ansible_user=centos ansible_python_interpreter=/usr/bin/python
12+
amd64:centos7 ansible_host=192.168.1.13 ansible_user=centos ansible_python_interpreter=/usr/bin/python
13+
amd64:al-2023-fips ansible_host=192.168.1.14 ansible_user=ec2-user ansible_python_interpreter=/usr/bin/python3 ansible_ssh_common_args='-o Ciphers=aes256-ctr,aes192-ctr,aes128-ctr -o KexAlgorithms=ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521 -o MACs=hmac-sha2-256,hmac-sha2-512'
1314
```
1415

1516
## Playbooks

‎test/packaging/ansible/agent-upgrade.yml

+2
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,8 @@
1414

1515
tasks:
1616
- name: agent upgrade tests suite
17+
# TODO: https://new-relic.atlassian.net/browse/NR-355851 Update when two releases with FIPS are done
18+
# Also add FIPS tests
1719
vars:
1820
target_agent_version: "1.57.1"
1921

‎test/packaging/ansible/installation-pinned.yml

+17-8
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,12 @@
11
---
2-
3-
- name: installation-pinned
2+
- name: Installation-pinned
43
hosts: testing_hosts_linux
54
become: true
6-
gather_facts: yes
5+
gather_facts: true
76

87
pre_tasks:
98
- name: Initial cleanup
10-
include_role:
9+
ansible.builtin.include_role:
1110
name: caos.ansible_roles.infra_agent
1211
vars:
1312
uninstall: true
@@ -18,16 +17,26 @@
1817
target_agent_version: "1.57.1" # minimum version for ubuntu sles 15.6
1918

2019
block:
21-
22-
- name: install agent
23-
include_role:
20+
- name: Install agent
21+
# when: "'-fips' not in inventory_hostname"
22+
ansible.builtin.include_role:
2423
name: caos.ansible_roles.infra_agent
2524
vars:
2625
target_version: "{{ target_agent_version }}"
2726
repo_endpoint: "http://nr-downloads-ohai-staging.s3-website-us-east-1.amazonaws.com/infrastructure_agent"
2827

28+
# TODO: https://new-relic.atlassian.net/browse/NR-355845 Uncomment when FIPS version is available for the minimum version
29+
# - name: Install agent - FIPS
30+
# when: "'-fips' in inventory_hostname"
31+
# ansible.builtin.include_role:
32+
# name: caos.ansible_roles.infra_agent
33+
# vars:
34+
# target_version: "{{ target_agent_version }}"
35+
# repo_endpoint: "http://nr-downloads-ohai-staging.s3-website-us-east-1.amazonaws.com/infrastructure_agent"
36+
# fips_enabled: true
37+
2938
- name: Assert version
30-
include_role:
39+
ansible.builtin.include_role:
3140
name: caos.ansible_roles.assert_version
3241
vars:
3342
target_versions:

0 commit comments

Comments
 (0)