Skip to content

Commit 47e45e6

Browse files
zreigzmaciaszczykm
zreigz
and
maciaszczykm
authored
feat: create fips binary for deployment operator (#308)
* create fips binary for deployment operator * improvments * disable flags * add github action * fix github action * improve github action * fix github action * go-fips static version * fix static version * on push tag * move go-fips to another repo * add fips ansible * workflow for harness fips * fix ansible * fix tag * add supported versions --------- Co-authored-by: Marcin Maciaszczyk <[email protected]>
1 parent ffd5ede commit 47e45e6

File tree

6 files changed

+380
-0
lines changed

6 files changed

+380
-0
lines changed

‎.github/workflows/publish-fips.yaml‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
name: Publish agent FIPS
2+
3+
on:
4+
push:
5+
tags:
6+
- 'v*.*.*'
7+
8+
env:
9+
GOPATH: /home/runner/go/
10+
GOPROXY: "https://proxy.golang.org"
11+
12+
jobs:
13+
publish-agent-fips:
14+
name: Build and push agent FIPS container
15+
runs-on: ubuntu-20.04
16+
permissions:
17+
contents: 'read'
18+
id-token: 'write'
19+
packages: 'write'
20+
outputs:
21+
version: ${{ steps.meta.outputs.version }}
22+
steps:
23+
- name: Checkout
24+
uses: actions/checkout@v4
25+
with:
26+
fetch-depth: 0
27+
- name: Docker meta
28+
id: meta
29+
uses: docker/metadata-action@v5
30+
with:
31+
images: |
32+
ghcr.io/pluralsh/deployment-operator
33+
docker.io/pluralsh/deployment-operator
34+
tags: |
35+
type=semver,pattern={{version}},suffix=-fips,priority=1000
36+
- name: Set up QEMU
37+
uses: docker/setup-qemu-action@v3
38+
- name: Set up Docker Buildx
39+
uses: docker/setup-buildx-action@v3
40+
- name: Login to GHCR
41+
uses: docker/login-action@v3
42+
with:
43+
registry: ghcr.io
44+
username: ${{ github.repository_owner }}
45+
password: ${{ secrets.GITHUB_TOKEN }}
46+
- name: Login to Docker
47+
uses: docker/login-action@v3
48+
with:
49+
username: mjgpluralsh
50+
password: ${{ secrets.DOCKER_ACCESS_TOKEN }}
51+
- name: Build and push
52+
uses: docker/build-push-action@v5
53+
with:
54+
context: "."
55+
file: "./dockerfiles/agent/fips.Dockerfile"
56+
push: true
57+
tags: ${{ steps.meta.outputs.tags }}
58+
labels: ${{ steps.meta.outputs.labels }}
59+
platforms: linux/amd64,linux/arm64
60+
cache-from: type=gha
61+
cache-to: type=gha,mode=max
62+
build-args: |
63+
GO_FIPS_IMAGE_REPO=ghcr.io/pluralsh/go-fips
64+
GO_FIPS_IMAGE_TAG=1.23.2
65+

‎.github/workflows/publish-harness-fips.yaml‎

Lines changed: 143 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,143 @@
1+
name: Publish Harness FIPS
2+
on:
3+
pull_request:
4+
branches:
5+
- "main"
6+
push:
7+
tags:
8+
- 'v*.*.*'
9+
env:
10+
GOPATH: /home/runner/go/
11+
GOPROXY: "https://proxy.golang.org"
12+
jobs:
13+
14+
publish-harness-base:
15+
name: Build and push harness base FIPS container
16+
runs-on: ubuntu-20.04
17+
permissions:
18+
contents: 'read'
19+
id-token: 'write'
20+
packages: 'write'
21+
outputs:
22+
version: ${{ steps.meta.outputs.version }}
23+
steps:
24+
- name: Checkout
25+
uses: actions/checkout@v4
26+
with:
27+
fetch-depth: 0
28+
- name: Docker meta
29+
id: meta
30+
uses: docker/metadata-action@v5
31+
with:
32+
# list of Docker images to use as base name for tags
33+
images: |
34+
ghcr.io/pluralsh/stackrun-harness-base
35+
docker.io/pluralsh/stackrun-harness-base
36+
tags: |
37+
type=semver,pattern={{version}},suffix=-fips,priority=1000
38+
type=sha,suffix=-fips,priority=800
39+
type=ref,event=pr,suffix=-fips,priority=600
40+
- name: Set up QEMU
41+
uses: docker/setup-qemu-action@v3
42+
- name: Set up Docker Buildx
43+
uses: docker/setup-buildx-action@v3
44+
- name: Login to GHCR
45+
uses: docker/login-action@v3
46+
with:
47+
registry: ghcr.io
48+
username: ${{ github.repository_owner }}
49+
password: ${{ secrets.GITHUB_TOKEN }}
50+
- name: Login to Docker
51+
uses: docker/login-action@v3
52+
with:
53+
username: mjgpluralsh
54+
password: ${{ secrets.DOCKER_ACCESS_TOKEN }}
55+
- name: Build and push
56+
uses: docker/build-push-action@v5
57+
with:
58+
context: "."
59+
file: "./dockerfiles/harness/base.fips.Dockerfile"
60+
push: true
61+
tags: ${{ steps.meta.outputs.tags }}
62+
labels: ${{ steps.meta.outputs.labels }}
63+
platforms: linux/amd64,linux/arm64
64+
cache-from: type=gha
65+
cache-to: type=gha,mode=max
66+
build-args: |
67+
VERSION=${{ steps.meta.outputs.version }}
68+
GO_FIPS_IMAGE_REPO=ghcr.io/pluralsh/go-fips
69+
GO_FIPS_IMAGE_TAG=1.23.2
70+
71+
publish-harness-ansible:
72+
name: Build and push harness ansible FIPS container
73+
runs-on: ubuntu-20.04
74+
needs: [publish-harness-base]
75+
strategy:
76+
matrix:
77+
versions:
78+
- ansible: '7.7.0'
79+
python: '3.11'
80+
tag: '7.7'
81+
- ansible: '8.7.0'
82+
python: '3.11'
83+
tag: '8.7'
84+
- ansible: '9.0.0'
85+
python: '3.12'
86+
tag: '9.0'
87+
- ansible: '10.0.0'
88+
python: '3.12'
89+
tag: '10.0'
90+
permissions:
91+
contents: write
92+
discussions: write
93+
pull-requests: write
94+
packages: write
95+
steps:
96+
- name: Checkout
97+
uses: actions/checkout@v4
98+
with:
99+
fetch-depth: 0
100+
- name: Docker meta
101+
id: meta
102+
uses: docker/metadata-action@v5
103+
with:
104+
images: |
105+
ghcr.io/pluralsh/harness
106+
docker.io/pluralsh/harness
107+
tags: |
108+
type=semver,pattern={{version}},suffix=-ansible-${{ matrix.versions.tag }}-fips,priority=1000
109+
type=sha,suffix=-ansible-${{ matrix.versions.tag }}-fips,priority=800
110+
type=ref,event=pr,suffix=-ansible-${{ matrix.versions.tag }}-fips,priority=600
111+
- name: Set up QEMU
112+
uses: docker/setup-qemu-action@v3
113+
- name: Set up Docker Buildx
114+
uses: docker/setup-buildx-action@v3
115+
- name: Login to GHCR
116+
uses: docker/login-action@v3
117+
with:
118+
registry: ghcr.io
119+
username: ${{ github.repository_owner }}
120+
password: ${{ secrets.GITHUB_TOKEN }}
121+
- name: Login to Docker
122+
uses: docker/login-action@v3
123+
with:
124+
username: mjgpluralsh
125+
password: ${{ secrets.DOCKER_ACCESS_TOKEN }}
126+
- name: Build and push
127+
uses: docker/build-push-action@v5
128+
with:
129+
context: "."
130+
file: "./dockerfiles/harness/ansible.fips.Dockerfile"
131+
push: true
132+
tags: ${{ steps.meta.outputs.tags }}
133+
labels: ${{ steps.meta.outputs.labels }}
134+
platforms: linux/amd64,linux/arm64
135+
cache-from: type=gha
136+
cache-to: type=gha,mode=max
137+
build-args: |
138+
ANSIBLE_VERSION=${{ matrix.versions.ansible }}
139+
PYTHON_VERSION=${{ matrix.versions.python }}
140+
HARNESS_BASE_IMAGE_REPO=ghcr.io/pluralsh/stackrun-harness-base
141+
HARNESS_BASE_IMAGE_TAG=${{ needs.publish-harness-base.outputs.version }}
142+
GO_FIPS_IMAGE_REPO=ghcr.io/pluralsh/go-fips
143+
GO_FIPS_IMAGE_TAG=1.23.2

‎Makefile‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -91,6 +91,24 @@ docker-build: ## build image
9191
docker-push: ## push image
9292
docker push ${IMG}
9393

94+
.PHONY: docker-build-harness-base-fips
95+
docker-build-harness-base-fips: ## build fips base docker harness image
96+
docker build \
97+
--no-cache \
98+
--build-arg=VERSION="0.0.0-dev" \
99+
-t harness-base-fips \
100+
-f dockerfiles/harness/base.fips.Dockerfile \
101+
.
102+
103+
.PHONY: docker-build-harness-ansible-fips
104+
docker-build-harness-ansible-fips: docker-build-harness-base-fips ## build fips ansible docker harness image
105+
docker build \
106+
--no-cache \
107+
--build-arg=HARNESS_IMAGE_TAG="latest" \
108+
-t harness-fips \
109+
-f dockerfiles/harness/ansible.fips.Dockerfile \
110+
.
111+
94112
.PHONY: docker-build-harness-base
95113
docker-build-harness-base: ## build base docker harness image
96114
docker build \
@@ -124,6 +142,13 @@ docker-run-harness: docker-build-harness-terraform docker-build-harness-ansible
124142
--console-token=${PLURAL_DEPLOY_TOKEN} \
125143
--stack-run-id=${PLURAL_STACK_RUN_ID}
126144

145+
.PHONY: docker-build-agent-fips
146+
docker-build-agent-fips: ## build docker fips agent image
147+
docker build \
148+
-t deployment-agent-fips \
149+
-f dockerfiles/agent/fips.Dockerfile \
150+
.
151+
127152
velero-crds:
128153
@curl -L $(VELERO_CHART_URL) --output velero.tgz
129154
@tar zxvf velero.tgz velero/crds

‎dockerfiles/agent/fips.Dockerfile‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
ARG UBI_MINIMAL_VERSION="latest"
2+
ARG GO_FIPS_IMAGE_TAG=1.23.2
3+
ARG GO_FIPS_IMAGE_REPO=ghcr.io/pluralsh/go-fips
4+
ARG GO_FIPS_BASE_IMAGE=$GO_FIPS_IMAGE_REPO:$GO_FIPS_IMAGE_TAG
5+
6+
FROM ${GO_FIPS_BASE_IMAGE} AS builder
7+
8+
# Set environment variables for FIPS compliance
9+
ENV OPENSSL_FIPS=1
10+
ENV FIPS_MODE=true
11+
# Set up Go environment
12+
ENV CGO_ENABLED=1
13+
ENV CC=gcc
14+
15+
ARG TARGETARCH
16+
17+
WORKDIR /workspace
18+
# Copy the Go Modules manifests
19+
COPY go.mod go.mod
20+
COPY go.sum go.sum
21+
# cache deps before building and copying source so that we don't need to re-download as much
22+
# and so that source changes don't invalidate our downloaded layer
23+
RUN go mod download
24+
25+
# Copy the go source
26+
COPY /cmd/agent cmd/agent
27+
COPY /pkg pkg/
28+
COPY /api api/
29+
COPY /internal internal/
30+
# Build
31+
RUN GOOS=linux GOARCH=${TARGETARCH} GO111MODULE=on go build -a -o deployment-agent cmd/agent/*.go
32+
33+
# This the minimal UBI FIPS compliance image
34+
FROM registry.access.redhat.com/ubi8/ubi-minimal:$UBI_MINIMAL_VERSION
35+
WORKDIR /workspace
36+
37+
RUN microdnf install -y openssl && \
38+
microdnf clean all
39+
40+
RUN mkdir /.kube && chown 65532:65532 /.kube
41+
42+
COPY --from=builder /workspace/deployment-agent .
43+
USER 65532:65532
44+
45+
ENTRYPOINT ["/workspace/deployment-agent"]

‎dockerfiles/harness/ansible.fips.Dockerfile‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
ARG HARNESS_BASE_IMAGE_TAG=latest
2+
ARG HARNESS_BASE_IMAGE_REPO=harness-base-fips
3+
ARG HARNESS_BASE_IMAGE=$HARNESS_BASE_IMAGE_REPO:$HARNESS_BASE_IMAGE_TAG
4+
ARG PYTHON_VERSION=3.12
5+
6+
7+
# Use harness base image
8+
FROM ${HARNESS_BASE_IMAGE} as harness
9+
10+
# Build Ansible from Python Image
11+
FROM registry.access.redhat.com/ubi8/ubi:latest as final
12+
13+
# Set environment variables for FIPS compliance
14+
ENV OPENSSL_FIPS=1
15+
ENV FIPS_MODE=true
16+
17+
# Copy Harness bin from the Harness Image
18+
COPY --from=harness /harness /usr/local/bin/harness
19+
# Change ownership of the harness binary to UID/GID 65532
20+
RUN chown -R 65532:65532 /usr/local/bin/harness
21+
22+
# Install build dependencies, Ansible, and openssh-client
23+
ARG ANSIBLE_VERSION=9.0.0
24+
ARG PYTHON_VERSION=3.12
25+
26+
# Install dependencies for building Python
27+
RUN INSTALL_PKGS="python${PYTHON_VERSION} python${PYTHON_VERSION}-devel python${PYTHON_VERSION}-setuptools python${PYTHON_VERSION}-pip nss_wrapper \
28+
httpd httpd-devel mod_ssl mod_auth_gssapi mod_ldap \
29+
mod_session atlas-devel gcc-gfortran libffi-devel libtool-ltdl \
30+
enchant krb5-devel gcc openssl make" && \
31+
yum -y module enable httpd:2.4 && \
32+
yum -y --setopt=tsflags=nodocs install $INSTALL_PKGS && \
33+
rpm -V $INSTALL_PKGS && \
34+
# Remove redhat-logos-httpd (httpd dependency) to keep image size smaller.
35+
rpm -e --nodeps redhat-logos-httpd && \
36+
yum -y clean all --enablerepo='*'
37+
38+
# Install Ansible via Pip.
39+
RUN pip3 install --upgrade pip \
40+
&& pip3 install setuptools-rust
41+
RUN pip3 install --no-cache-dir ansible==${ANSIBLE_VERSION}
42+
43+
# Switch to the non-root user
44+
USER 65532:65532
45+
WORKDIR /plural
46+
47+
ENTRYPOINT ["harness", "--working-dir=/plural"]

‎dockerfiles/harness/base.fips.Dockerfile‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
ARG GO_FIPS_IMAGE_TAG=1.23.2
2+
ARG GO_FIPS_IMAGE_REPO=ghcr.io/pluralsh/go-fips
3+
ARG GO_FIPS_BASE_IMAGE=$GO_FIPS_IMAGE_REPO:$GO_FIPS_IMAGE_TAG
4+
5+
FROM $GO_FIPS_BASE_IMAGE AS builder
6+
7+
# Set environment variables for FIPS compliance
8+
ENV OPENSSL_FIPS=1
9+
ENV FIPS_MODE=true
10+
# Set up Go environment
11+
ENV CGO_ENABLED=1
12+
ENV CC=gcc
13+
14+
ARG TARGETARCH
15+
ARG TARGETOS
16+
ARG VERSION
17+
18+
19+
20+
WORKDIR /workspace
21+
22+
# Retrieve application dependencies.
23+
# This allows the container build to reuse cached dependencies.
24+
# Expecting to copy go.mod and if present go.sum.
25+
COPY go.mod go.mod
26+
COPY go.sum go.sum
27+
RUN go mod download
28+
29+
COPY cmd/harness ./cmd/harness
30+
COPY pkg ./pkg
31+
COPY internal ./internal
32+
COPY api ./api
33+
34+
35+
RUN CGO_ENABLED=1 CC=gcc GOOS=linux GOARCH=${TARGETARCH} GO111MODULE=on go build -a \
36+
-ldflags="-s -w -X github.com/pluralsh/deployment-operator/pkg/harness/environment.Version=${VERSION}" \
37+
-o harness \
38+
cmd/harness/*.go
39+
40+
FROM registry.access.redhat.com/ubi8/ubi-minimal:latest AS final
41+
42+
RUN microdnf install -y git openssl && \
43+
microdnf clean all
44+
45+
# Switch to the nonroot user
46+
USER 65532:65532
47+
48+
# Set up the environment
49+
# 3. copy the harness binary
50+
# 4. copy the terraform binary
51+
COPY --from=builder /workspace/harness /harness
52+
53+
WORKDIR /plural
54+
55+
ENTRYPOINT ["/harness", "--working-dir=/plural"]

0 commit comments

Comments
 (0)