Skip to content

Add DRA FIPS artifacts to package pipeline #4574

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 13 commits into from
Mar 25, 2025

Conversation

michel-laterman
Copy link
Contributor

@michel-laterman michel-laterman commented Mar 12, 2025

What is the problem this PR solves?

Provide FIPS dra artifacts.

How does this PR solve the problem?

Add FIPS="true" env flag to packageing pipeline.
Packaging pipline uses microsoft/go instead of golang/go to build DRA artifacts for FIPS.
Change package name from fleet-server-*-fips to fleet-server-fips-*.

Design Checklist

  • I have ensured my design is stateless and will work when multiple fleet-server instances are behind a load balancer.
  • I have or intend to scale test my changes, ensuring it will work reliably with 100K+ agents connected.
  • I have included fail safe mechanisms to limit the load on fleet-server: rate limiting, circuit breakers, caching, load shedding, etc.

Checklist

  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • I have made corresponding change to the default configuration files
  • I have added tests that prove my fix is effective or that my feature works
  • I have added an entry in ./changelog/fragments using the changelog tool

Related issues

@michel-laterman michel-laterman added Team:Elastic-Agent-Control-Plane Label for the Agent Control Plane team tech debt labels Mar 12, 2025
Copy link
Contributor

mergify bot commented Mar 12, 2025

This pull request does not have a backport label. Could you fix it @michel-laterman? 🙏
To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

  • backport-./d./d is the label to automatically backport to the 8./d branch. /d is the digit
  • backport-active-all is the label that automatically backports to all active branches.
  • backport-active-8 is the label that automatically backports to all active minor branches for the 8 major.
  • backport-active-9 is the label that automatically backports to all active minor branches for the 9 major.

@michel-laterman michel-laterman marked this pull request as ready for review March 17, 2025 17:37
@michel-laterman michel-laterman requested a review from a team as a code owner March 17, 2025 17:37
@michel-laterman michel-laterman added backport-8.x Automated backport to the 8.x branch with mergify backport-9.0 Automated backport to the 9.0 branch labels Mar 17, 2025
@jlind23 jlind23 requested a review from simitt March 17, 2025 19:27
@jlind23
Copy link
Contributor

jlind23 commented Mar 18, 2025

@michel-laterman please do not merge https://github.com/elastic/infra/pull/42160 before this gets merged/backported or you'll block the unified release. The same happened to @pchila

@michel-laterman michel-laterman requested a review from pchila March 21, 2025 15:56
@pchila
Copy link
Member

pchila commented Mar 24, 2025

@michel-laterman could you please test this PR on buildkite to see if all the artifacts are correctly generated?
Use fleet-server-package-mbp pipeline with:

BRANCH="main"
BUILDKITE_PULL_REQUEST="true"

ref. .buildkite/scripts/dra_release.sh

@michel-laterman
Copy link
Contributor Author

@michel-laterman
Copy link
Contributor Author

Currently the FIPS dra is failing as the package step uses make release, however we need to use the microsoft/go toolchain in order to build a FIPS compliant artifact. I'll add this in, I'll copy the with_msft_go (common.sh) command I've added into another PR to resolve this

Copy link
Contributor Author

@michel-laterman michel-laterman left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The FIPS artifact builds are now completing, however it is havin issues authenticating with GCP at the end to upload
.buildkite/scripts/common.sh: line 112: PRIVATE_CI_GCS_CREDENTIALS_SECRET: unbound variable
https://buildkite.com/elastic/fleet-server-package-mbp/builds/1743

My next commit fixed this issue, successful build available: https://buildkite.com/elastic/fleet-server-package-mbp/builds/1744

@michel-laterman michel-laterman requested a review from v1v March 24, 2025 21:11
@michel-laterman
Copy link
Contributor Author

Thanks a @v1v I changed all our FIPS var checks to use false as a default

pchila
pchila previously approved these changes Mar 25, 2025
Copy link
Member

@pchila pchila left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A couple of nitpicks mostly on the PATH env var building.
No blockers.

v1v
v1v previously approved these changes Mar 25, 2025
@michel-laterman michel-laterman dismissed stale reviews from v1v and pchila via 7970f5b March 25, 2025 16:55
@michel-laterman michel-laterman enabled auto-merge (squash) March 25, 2025 16:59
Copy link

@michel-laterman michel-laterman removed the backport-9.0 Automated backport to the 9.0 branch label Mar 25, 2025
@michel-laterman michel-laterman merged commit 8bb8c74 into elastic:main Mar 25, 2025
9 checks passed
@michel-laterman michel-laterman deleted the fips-dra branch March 25, 2025 17:46
mergify bot pushed a commit that referenced this pull request Mar 25, 2025
Add FIPS="true" env flag to packageing pipeline.
Packaging pipline uses microsoft/go instead of golang/go to build DRA artifacts for FIPS.
Change package name from fleet-server-*-fips to fleet-server-fips-*.

(cherry picked from commit 8bb8c74)
michel-laterman added a commit that referenced this pull request Mar 25, 2025
Add FIPS="true" env flag to packageing pipeline.
Packaging pipline uses microsoft/go instead of golang/go to build DRA artifacts for FIPS.
Change package name from fleet-server-*-fips to fleet-server-fips-*.

(cherry picked from commit 8bb8c74)

Co-authored-by: Michel Laterman <[email protected]>
@v1v
Copy link
Member

v1v commented May 19, 2025

@Mergifyio backport 9.0

Copy link
Contributor

mergify bot commented May 19, 2025

backport 9.0

✅ Backports have been created

mergify bot pushed a commit that referenced this pull request May 19, 2025
Add FIPS="true" env flag to packageing pipeline.
Packaging pipline uses microsoft/go instead of golang/go to build DRA artifacts for FIPS.
Change package name from fleet-server-*-fips to fleet-server-fips-*.

(cherry picked from commit 8bb8c74)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
backport-8.x Automated backport to the 8.x branch with mergify Team:Elastic-Agent-Control-Plane Label for the Agent Control Plane team tech debt
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants