Add Pipeline to deploy custom agent image for FIPS testing #8035
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,225 @@ | ||
| # yaml-language-server: $schema=https://raw.githubusercontent.com/buildkite/pipeline-schema/main/schema.json | ||
|
|
||
| env: | ||
| DOCKER_REGISTRY: "docker.elastic.co" | ||
| VAULT_PATH: "kv/ci-shared/observability-ingest/cloud/gcp" | ||
| ASDF_MAGE_VERSION: 1.14.0 | ||
| CUSTOM_IMAGE_TAG: "git-${BUILDKITE_COMMIT:0:12}" | ||
| CI_ELASTIC_AGENT_DOCKER_IMAGE: "docker.elastic.co/beats-ci/elastic-agent-fips-cloud" | ||
|
|
||
| IMAGE_UBUNTU_2404_X86_64: "platform-ingest-elastic-agent-ubuntu-2404-1744855248" | ||
| IMAGE_UBUNTU_X86_64_FIPS: "platform-ingest-fleet-server-ubuntu-2204-fips" | ||
| IMAGE_UBUNTU_ARM64_FIPS: "test-platform-ingest-fleet-server-ubuntu-2204-fips-aarch64-1747830486" | ||
|
|
||
| steps: | ||
| - label: Build and push custom elastic-agent image | ||
| key: integration-fips-cloud-image | ||
| env: | ||
| ASDF_TERRAFORM_VERSION: 1.9.2 | ||
| FIPS: "true" | ||
| command: | | ||
| #!/usr/bin/env bash | ||
| set -euo pipefail | ||
| mage cloud:image | ||
|
There was a problem hiding this comment.
There was a problem hiding this comment. We can try, but I'm not sure if the Image step will use artifacts that are already present, @pkoutsovasilis do you know if it will? |
||
| mage cloud:push | ||
| agents: | ||
| provider: "gcp" | ||
| machineType: "n1-standard-8" | ||
| image: "${IMAGE_UBUNTU_2404_X86_64}" | ||
|
|
||
| - label: Start ESS stack for FIPS integration tests | ||
| key: integration-fips-ess | ||
| depends_on: | ||
| - integration-fips-cloud-image | ||
| env: | ||
| ASDF_TERRAFORM_VERSION: 1.9.2 | ||
| TF_VAR_integration_server_docker_image: "${CI_ELASTIC_AGENT_DOCKER_IMAGE}:${CUSTOM_IMAGE_TAG}" | ||
| command: | | ||
| #!/usr/bin/env bash | ||
| set -euo pipefail | ||
| source .buildkite/scripts/steps/ess_start.sh | ||
| artifact_paths: | ||
| - test_infra/ess/*.tfstate | ||
| - test_infra/ess/*.lock.hcl | ||
| agents: | ||
| image: "docker.elastic.co/ci-agent-images/platform-ingest/buildkite-agent-beats-ci-with-hooks:0.5" | ||
| useCustomGlobalHooks: true | ||
|
|
||
| - group: "fips:Stateful:Ubuntu" | ||
|
There was a problem hiding this comment. Do I understand correctly that we run a set integration test groups in the same way and the only difference is in the VM image and the There was a problem hiding this comment. VM image, and i think that |
||
| key: integration-tests-ubuntu-fips | ||
| depends_on: | ||
| - integration-fips-ess | ||
| steps: | ||
| - label: "fips:x86_64:non-sudo:{{matrix}}" | ||
| depends_on: | ||
| - packaging-ubuntu-x86-64-fips | ||
ycombinator marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| env: | ||
| FIPS: "true" | ||
| command: | | ||
| buildkite-agent artifact download build/distributions/** . --step 'packaging-ubuntu-x86-64-fips' | ||
| .buildkite/scripts/steps/integration_tests_tf.sh {{matrix}} false | ||
| artifact_paths: | ||
| - build/** | ||
| - build/diagnostics/** | ||
| retry: | ||
| automatic: | ||
| limit: 1 | ||
| agents: | ||
| provider: "aws" | ||
| imagePrefix: "${IMAGE_UBUNTU_X86_64_FIPS}" | ||
| instanceType: "m5.2xlarge" | ||
| matrix: | ||
| - default | ||
| - upgrade | ||
| - upgrade-flavor | ||
| - standalone-upgrade | ||
| - fleet | ||
| # FIPS tests don't have other groups enabled in order to save resources | ||
|
|
||
| - label: "fips:x86_64:sudo:{{matrix}}" | ||
| depends_on: | ||
| - packaging-ubuntu-x86-64-fips | ||
| env: | ||
| FIPS: "true" | ||
| command: | | ||
| buildkite-agent artifact download build/distributions/** . --step packaging-ubuntu-x86-64-fips | ||
| .buildkite/scripts/steps/integration_tests_tf.sh {{matrix}} true | ||
| artifact_paths: | ||
| - build/** | ||
| - build/diagnostics/** | ||
| retry: | ||
| automatic: | ||
| limit: 1 | ||
| agents: | ||
| provider: "aws" | ||
| imagePrefix: "${IMAGE_UBUNTU_X86_64_FIPS}" | ||
| instanceType: "m5.2xlarge" | ||
| matrix: | ||
| - default | ||
| - upgrade | ||
| - upgrade-flavor | ||
| - standalone-upgrade | ||
| - fleet | ||
|
|
||
| - label: "fips:arm64:non-sudo:{{matrix}}" | ||
| depends_on: | ||
| - packaging-ubuntu-arm64-fips | ||
| env: | ||
| FIPS: "true" | ||
| command: | | ||
| buildkite-agent artifact download build/distributions/** . --step 'packaging-ubuntu-arm64-fips' | ||
| .buildkite/scripts/steps/integration_tests_tf.sh {{matrix}} false | ||
| artifact_paths: | ||
| - build/** | ||
| - build/diagnostics/** | ||
| retry: | ||
| automatic: | ||
| limit: 1 | ||
| agents: | ||
| provider: "aws" | ||
| image: "${IMAGE_UBUNTU_ARM64_FIPS}" | ||
| instanceType: "m6g.2xlarge" | ||
| matrix: | ||
| - default | ||
| - upgrade | ||
| - upgrade-flavor | ||
| - standalone-upgrade | ||
| - fleet | ||
|
|
||
| - label: "fips:arm64:sudo:{{matrix}}" | ||
| depends_on: | ||
| - packaging-ubuntu-arm64-fips | ||
| env: | ||
| FIPS: "true" | ||
| command: | | ||
| buildkite-agent artifact download build/distributions/** . --step packaging-ubuntu-arm64-fips | ||
| .buildkite/scripts/steps/integration_tests_tf.sh {{matrix}} true | ||
| artifact_paths: | ||
| - build/** | ||
| - build/diagnostics/** | ||
| retry: | ||
| automatic: | ||
| limit: 1 | ||
| agents: | ||
| provider: "aws" | ||
| image: "${IMAGE_UBUNTU_ARM64_FIPS}" | ||
| instanceType: "m6g.2xlarge" | ||
| matrix: | ||
| - default | ||
| - upgrade | ||
| - upgrade-flavor | ||
| - standalone-upgrade | ||
| - fleet | ||
|
|
||
| - group: "fips:Kubernetes" | ||
pkoutsovasilis marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| key: integration-tests-kubernetes-fips | ||
| depends_on: | ||
| - integration-fips-ess | ||
| - packaging-containers-x86-64-fips | ||
| steps: | ||
| - label: "fips:{{matrix.version}}:amd64" | ||
| env: | ||
| K8S_VERSION: "{{matrix.version}}" | ||
| ASDF_KIND_VERSION: "0.27.0" | ||
| DOCKER_VARIANTS: "fips" | ||
| TARGET_ARCH: "amd64" | ||
| AGENT_VERSION: "9.1.0-SNAPSHOT" # Set to 9.1.0 as it is the first release in 9.x that supports FIPS | ||
| FIPS: "true" | ||
| command: | | ||
| buildkite-agent artifact download build/distributions/*-linux-amd64.docker.tar.gz . --step 'packaging-containers-x86-64-fips' | ||
| .buildkite/scripts/steps/integration_tests_tf.sh kubernetes false | ||
| artifact_paths: | ||
| - build/** | ||
| - build/diagnostics/** | ||
| - build/*.pod_logs_dump/* | ||
| retry: | ||
| automatic: | ||
| limit: 1 | ||
| agents: | ||
| provider: "aws" | ||
| imagePrefix: "${IMAGE_UBUNTU_X86_64_FIPS}" | ||
| instanceType: "m5.2xlarge" | ||
| diskSizeGb: 80 | ||
| matrix: | ||
| setup: | ||
| version: | ||
| - v1.27.16 | ||
| - v1.28.9 | ||
| - v1.29.8 | ||
| - v1.30.8 | ||
| - v1.31.0 | ||
| - v1.32.0 | ||
|
|
||
| - label: ESS FIPS stack cleanup | ||
| depends_on: | ||
| - integration-tests-ubuntu-fips | ||
| - integration-tests-kubernetes-fips | ||
| allow_dependency_failure: true | ||
| command: | | ||
| buildkite-agent artifact download "test_infra/ess/**" . --step "integration-fips-ess" | ||
| ls -lah test_infra/ess | ||
| .buildkite/scripts/steps/ess_down.sh | ||
| agents: | ||
| image: "docker.elastic.co/ci-agent-images/platform-ingest/buildkite-agent-beats-ci-with-hooks:0.5" | ||
| useCustomGlobalHooks: true | ||
|
|
||
| - label: Aggregate test reports | ||
| # Warning: The key has a hook in pre-command | ||
| key: aggregate-reports-fips | ||
| depends_on: | ||
| - integration-tests-ubuntu-fips | ||
| - integration-tests-kubernetes-fips | ||
| allow_dependency_failure: true | ||
| command: | | ||
| buildkite-agent artifact download "build/*.xml" . | ||
| agents: | ||
| image: "docker.elastic.co/ci-agent-images/platform-ingest/buildkite-agent-beats-ci-with-hooks:0.5" | ||
| useCustomGlobalHooks: true | ||
| soft_fail: | ||
| - exit_status: "*" | ||
| plugins: | ||
| - test-collector#v1.10.1: | ||
| files: "build/*.xml" | ||
| format: "junit" | ||
| branches: "main" | ||
| debug: true | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Is there a known reason why we use a fleet-server image here?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think that the images were created as a result of some experimentation that was being done with the fleet-server repo
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Should I create FIPS-compliant images for elastic-agent to avoid possible problems?