Skip to content

Commit b86d898

Browse files
alvarocabanasrajrohanyadav
alvarocabanas
and
rajrohanyadav
authored
Add prerelease for FIPS with testing and image creation (#1992)
* feat(fips): add fips integrations when building fips infra-agent (#1969) * Nr 351326 linux prerelease fips (#1976) * Create new FIPS packages on prerelease for linux * Add FIPS molecule tests. (#1981) * Create new docker FIPS images (#1982) * feat(fips): update tests to run for fips packages (#1980) * update harvest tests to run for fips packages * chore: update action versions * update packaging tests * assume role for 2 hours as tests can take longer than 1 hour * Add conflicts to the newrelic-infra packages to not allow having both fips and non fips installed at the same time (#1987) * Add fips canaries (#1988) * Add fips canaries * Condition Fips canary previous to have a second release --------- Co-authored-by: Rohan Yadav <[email protected]>
1 parent 8f163fa commit b86d898

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

58 files changed

+468
-188
lines changed

‎.github/workflows/component_canaries.yml

+6-6
Original file line numberDiff line numberDiff line change
@@ -32,10 +32,10 @@ jobs:
3232
runs-on: ubuntu-20.04
3333
if: ${{ inputs.PLATFORM == 'macos' }}
3434
steps:
35-
- uses: actions/checkout@v2
35+
- uses: actions/checkout@v4
3636

3737
- name: Configure AWS Credentials
38-
uses: aws-actions/configure-aws-credentials@v1
38+
uses: aws-actions/configure-aws-credentials@v4
3939
with:
4040
role-to-assume: ${{ env.AWS_ASSUME_ROLE }}
4141
aws-region: us-east-2
@@ -68,10 +68,10 @@ jobs:
6868
runs-on: ubuntu-20.04
6969
if: ${{ inputs.PLATFORM == 'linux' }}
7070
steps:
71-
- uses: actions/checkout@v2
71+
- uses: actions/checkout@v4
7272

7373
- name: Configure AWS Credentials
74-
uses: aws-actions/configure-aws-credentials@v1
74+
uses: aws-actions/configure-aws-credentials@v4
7575
with:
7676
role-to-assume: ${{ env.AWS_ASSUME_ROLE }}
7777
aws-region: us-east-2
@@ -130,10 +130,10 @@ jobs:
130130
runs-on: ubuntu-20.04
131131
if: ${{ inputs.PLATFORM == 'windows' }}
132132
steps:
133-
- uses: actions/checkout@v2
133+
- uses: actions/checkout@v4
134134

135135
- name: Configure AWS Credentials
136-
uses: aws-actions/configure-aws-credentials@v1
136+
uses: aws-actions/configure-aws-credentials@v4
137137
with:
138138
role-to-assume: ${{ env.AWS_ASSUME_ROLE }}
139139
aws-region: us-east-2

‎.github/workflows/component_docker_packaging.yml

+9-4
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,10 @@ on:
1919
TAG:
2020
required: true
2121
type: string
22+
FIPS:
23+
required: false
24+
type: boolean
25+
default: false
2226

2327
env:
2428
GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
@@ -29,6 +33,7 @@ env:
2933
DOCKER_HUB_ID: ${{ secrets.DOCKER_HUB_ID }}
3034
DOCKER_HUB_PASSWORD: ${{ secrets.DOCKER_HUB_PASSWORD }}
3135
DOCKER_PUBLISH: true
36+
FIPS: ${{ inputs.FIPS == true && '-fips' || '' }}
3237

3338
jobs:
3439
packaging:
@@ -47,7 +52,7 @@ jobs:
4752
password: ${{ env.DOCKER_HUB_PASSWORD }}
4853

4954
- name: Compiling binaries for linux amd64, arm, arm64
50-
run: make ci/prerelease/linux-for-docker
55+
run: make ci/prerelease/linux-for-docker${{env.FIPS}}
5156

5257
- name: Set up QEMU
5358
uses: docker/setup-qemu-action@v1
@@ -58,10 +63,10 @@ jobs:
5863
version: v0.9.1
5964

6065
- name: Build and publish Release Candidate (RC) of base Docker image
61-
run: AGENT_VERSION=${{env.TAG}} make -C build/container/ clean publish/multi-arch-base-rc
66+
run: AGENT_VERSION=${{env.TAG}} FIPS=${{env.FIPS}} make -C build/container/ clean publish/multi-arch-base-rc
6267

6368
- name: Build and publish Release Candidate (RC) of forwarder Docker image
64-
run: AGENT_VERSION=${{env.TAG}} make -C build/container/ clean publish/multi-arch-forwarder-rc
69+
run: AGENT_VERSION=${{env.TAG}} FIPS=${{env.FIPS}} make -C build/container/ clean publish/multi-arch-forwarder-rc
6570

6671
- name: Build and publish Release Candidate (RC) of k8s-events-forwarders Docker image
67-
run: AGENT_VERSION=${{env.TAG}} make -C build/container/ clean publish/multi-arch-k8s-events-forwarder-rc
72+
run: AGENT_VERSION=${{env.TAG}} FIPS=${{env.FIPS}} make -C build/container/ clean publish/multi-arch-k8s-events-forwarder-rc

‎.github/workflows/component_docker_publish.yml

+19-1
Original file line numberDiff line numberDiff line change
@@ -53,4 +53,22 @@ jobs:
5353
run: make -C build/container/ clean publish/multi-arch-k8s-events-forwarder-tag AGENT_VERSION=${{env.TAG}}
5454

5555
- name: Publish latest of k8s-events-forwarders Docker image
56-
run: make -C build/container/ clean publish/multi-arch-k8s-events-forwarder-latest AGENT_VERSION=${{env.TAG}}
56+
run: make -C build/container/ clean publish/multi-arch-k8s-events-forwarder-latest AGENT_VERSION=${{env.TAG}}
57+
58+
- name: Publish tag of base Docker image FIPS
59+
run: make -C build/container/ clean publish/multi-arch-base-tag AGENT_VERSION=${{env.TAG}} FIPS=${{env.FIPS}}
60+
61+
- name: Publish latest of base Docker image FIPS
62+
run: make -C build/container/ clean publish/multi-arch-base-latest AGENT_VERSION=${{env.TAG}} FIPS=${{env.FIPS}}
63+
64+
- name: Publish tag of forwarder Docker image FIPS
65+
run: make -C build/container/ clean publish/multi-arch-forwarder-tag AGENT_VERSION=${{env.TAG}} FIPS=${{env.FIPS}}
66+
67+
- name: Publish latest of forwarder Docker image FIPS
68+
run: make -C build/container/ clean publish/multi-arch-forwarder-latest AGENT_VERSION=${{env.TAG}} FIPS=${{env.FIPS}}
69+
70+
- name: Publish tag of k8s-events-forwarders Docker image FIPS
71+
run: make -C build/container/ clean publish/multi-arch-k8s-events-forwarder-tag AGENT_VERSION=${{env.TAG}} FIPS=${{env.FIPS}}
72+
73+
- name: Publish latest of k8s-events-forwarders Docker image FIPS
74+
run: make -C build/container/ clean publish/multi-arch-k8s-events-forwarder-latest AGENT_VERSION=${{env.TAG}} FIPS=${{env.FIPS}}

‎.github/workflows/component_linux_packaging.yml

+7
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,10 @@ on:
2222
ARCH:
2323
required: true
2424
type: string
25+
FIPS:
26+
required: false
27+
type: boolean
28+
default: false
2529

2630
env:
2731
GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
@@ -32,6 +36,7 @@ env:
3236
DOCKER_HUB_ID: ${{ secrets.DOCKER_HUB_ID }}
3337
DOCKER_HUB_PASSWORD: ${{ secrets.DOCKER_HUB_PASSWORD }}
3438
ARCH: ${{ inputs.ARCH }}
39+
FIPS: ${{ inputs.FIPS == true && '-fips' || '' }}
3540

3641
jobs:
3742
packaging:
@@ -49,6 +54,8 @@ jobs:
4954

5055
- name: Preparing linux packages
5156
run: make ci/prerelease/linux-${{ env.ARCH }}
57+
env:
58+
FIPS: ${{ env.FIPS }}
5259

5360
- name: Generate checksum files
5461
uses: ./.github/actions/generate-checksums

‎.github/workflows/component_linux_publish.yml

+5-2
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,9 @@ jobs:
7676
- "targz"
7777
- "deb"
7878
- "rpm"
79+
suffix:
80+
- ""
81+
- "-fips"
7982

8083
steps:
8184
- name: Login to DockerHub
@@ -89,10 +92,10 @@ jobs:
8992
uses: newrelic/[email protected]
9093
with:
9194
tag: ${{env.TAG}}
92-
app_name: "newrelic-infra"
95+
app_name: "newrelic-infra${{ matrix.suffix }}"
9396
repo_name: "newrelic/infrastructure-agent"
9497
schema: "custom"
95-
schema_url: "https://raw.githubusercontent.com/newrelic/infrastructure-agent/${{ env.SCHEMA_BRANCH }}/build/upload-schema-linux-${{ matrix.assetsType }}.yml"
98+
schema_url: "https://raw.githubusercontent.com/newrelic/infrastructure-agent/${{ env.SCHEMA_BRANCH }}/build/upload-schema-linux-${{ matrix.assetsType }}${{ matrix.suffix }}.yml"
9699
aws_access_key_id: ${{ env.AWS_ACCESS_KEY_ID }}
97100
aws_secret_access_key: ${{ env.AWS_SECRET_ACCESS_KEY }}
98101
aws_s3_bucket_name: ${{ env.AWS_S3_BUCKET_NAME }}

‎.github/workflows/component_molecule_packaging.yml

+11-1
Original file line numberDiff line numberDiff line change
@@ -21,10 +21,20 @@ jobs:
2121
name: Test package installation
2222
runs-on: ubuntu-latest
2323
steps:
24-
- uses: newrelic/pkg-installation-testing-action@v1
24+
- name: Test NON-FIPS package installation
25+
uses: newrelic/pkg-installation-testing-action@v1
2526
with:
2627
gpg_key: 'https://download.newrelic.com/infrastructure_agent/gpg/newrelic-infra.gpg'
2728
repo_base_url: ${{ inputs.REPO_ENDPOINT }}
2829
package_name: 'newrelic-infra'
2930
package_version: ${{ inputs.TAG }}
3031
platforms: "al2,al2023,debian-bullseye,debian-bookworm,redhat8,redhat9,suse15.3,suse15.4,suse15.5,suse15.6,ubuntu1604,ubuntu1804,ubuntu2004,ubuntu2204,ubuntu2404"
32+
- name: Test FIPS package installation
33+
uses: newrelic/pkg-installation-testing-action@v1
34+
with:
35+
gpg_key: 'https://download.newrelic.com/infrastructure_agent/gpg/newrelic-infra.gpg'
36+
repo_base_url: ${{ inputs.REPO_ENDPOINT }}
37+
package_name: 'newrelic-infra-fips'
38+
exec_name: 'newrelic-infra'
39+
package_version: ${{ inputs.TAG }}
40+
platforms: "al2,al2023,debian-bullseye,debian-bookworm,redhat8,redhat9,suse15.3,suse15.4,suse15.5,suse15.6,ubuntu1604,ubuntu1804,ubuntu2004,ubuntu2204,ubuntu2404"

‎.github/workflows/component_prerelease_testing.yml

+13-12
Original file line numberDiff line numberDiff line change
@@ -39,10 +39,10 @@ jobs:
3939
provision:
4040
runs-on: ubuntu-20.04
4141
steps:
42-
- uses: actions/checkout@v2
42+
- uses: actions/checkout@v4
4343

4444
- name: Configure AWS Credentials
45-
uses: aws-actions/configure-aws-credentials@v1
45+
uses: aws-actions/configure-aws-credentials@v4
4646
with:
4747
role-to-assume: ${{ env.AWS_ASSUME_ROLE }}
4848
aws-region: us-east-2
@@ -79,10 +79,10 @@ jobs:
7979
needs: [ provision ]
8080
runs-on: ubuntu-20.04
8181
steps:
82-
- uses: actions/checkout@v2
82+
- uses: actions/checkout@v4
8383

8484
- name: Configure AWS Credentials
85-
uses: aws-actions/configure-aws-credentials@v1
85+
uses: aws-actions/configure-aws-credentials@v4
8686
with:
8787
role-to-assume: ${{ env.AWS_ASSUME_ROLE }}
8888
aws-region: us-east-2
@@ -120,13 +120,14 @@ jobs:
120120
needs: [ harvest-tests ]
121121
runs-on: ubuntu-20.04
122122
steps:
123-
- uses: actions/checkout@v2
123+
- uses: actions/checkout@v4
124124

125125
- name: Configure AWS Credentials
126-
uses: aws-actions/configure-aws-credentials@v1
126+
uses: aws-actions/configure-aws-credentials@v4
127127
with:
128128
role-to-assume: ${{ env.AWS_ASSUME_ROLE }}
129129
aws-region: us-east-2
130+
role-duration-seconds: 7200
130131

131132
- name: Set branch name
132133
run: |
@@ -154,10 +155,10 @@ jobs:
154155
needs: [ harvest-tests ]
155156
runs-on: ubuntu-20.04
156157
steps:
157-
- uses: actions/checkout@v2
158+
- uses: actions/checkout@v4
158159

159160
- name: Configure AWS Credentials
160-
uses: aws-actions/configure-aws-credentials@v1
161+
uses: aws-actions/configure-aws-credentials@v4
161162
with:
162163
role-to-assume: ${{ env.AWS_ASSUME_ROLE }}
163164
aws-region: us-east-2
@@ -188,10 +189,10 @@ jobs:
188189
needs: [ packaging-tests-linux ]
189190
runs-on: ubuntu-20.04
190191
steps:
191-
- uses: actions/checkout@v2
192+
- uses: actions/checkout@v4
192193

193194
- name: Configure AWS Credentials
194-
uses: aws-actions/configure-aws-credentials@v1
195+
uses: aws-actions/configure-aws-credentials@v4
195196
with:
196197
role-to-assume: ${{ env.AWS_ASSUME_ROLE }}
197198
aws-region: us-east-2
@@ -229,10 +230,10 @@ jobs:
229230
needs: [ packaging-tests-windows ]
230231
runs-on: ubuntu-20.04
231232
steps:
232-
- uses: actions/checkout@v2
233+
- uses: actions/checkout@v4
233234

234235
- name: Configure AWS Credentials
235-
uses: aws-actions/configure-aws-credentials@v1
236+
uses: aws-actions/configure-aws-credentials@v4
236237
with:
237238
role-to-assume: ${{ env.AWS_ASSUME_ROLE }}
238239
aws-region: us-east-2

‎.github/workflows/component_trivy.yml

+11-4
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,13 @@ on:
1212
severity:
1313
required: true
1414
type: string
15+
FIPS:
16+
required: false
17+
type: boolean
18+
default: false
19+
20+
env:
21+
FIPS: ${{ inputs.FIPS == true && '-fips' || '' }}
1522

1623
jobs:
1724
trivy_scanner:
@@ -22,7 +29,7 @@ jobs:
2229
- name: newrelic/infrastructure
2330
uses: aquasecurity/trivy-action@master
2431
with:
25-
image-ref: "docker.io/newrelic/infrastructure:${{ inputs.tag }}"
32+
image-ref: "docker.io/newrelic/infrastructure${{ env.FIPS }}:${{ inputs.tag }}"
2633
format: 'table'
2734
exit-code: '1'
2835
ignore-unfixed: true
@@ -35,7 +42,7 @@ jobs:
3542
- name: newrelic/k8s-events-forwarder
3643
uses: aquasecurity/trivy-action@master
3744
with:
38-
image-ref: "docker.io/newrelic/k8s-events-forwarder:${{ inputs.tag }}"
45+
image-ref: "docker.io/newrelic/k8s-events-forwarder${{ env.FIPS }}:${{ inputs.tag }}"
3946
format: 'table'
4047
exit-code: '1'
4148
ignore-unfixed: true
@@ -48,7 +55,7 @@ jobs:
4855
- name: newrelic/nri-forwarder
4956
uses: aquasecurity/trivy-action@master
5057
with:
51-
image-ref: "docker.io/newrelic/nri-forwarder:${{ inputs.tag }}"
58+
image-ref: "docker.io/newrelic/nri-forwarder${{ env.FIPS }}:${{ inputs.tag }}"
5259
format: 'table'
5360
exit-code: '1'
5461
ignore-unfixed: true
@@ -69,7 +76,7 @@ jobs:
6976
- name: Sarif newrelic/infrastructure
7077
uses: aquasecurity/trivy-action@master
7178
with:
72-
image-ref: "docker.io/newrelic/infrastructure:${{ inputs.tag }}"
79+
image-ref: "docker.io/newrelic/infrastructure${{ env.FIPS }}:${{ inputs.tag }}"
7380
format: 'sarif'
7481
output: 'trivy-results.sarif'
7582
vuln-type: 'os,library'

‎.github/workflows/prerelease_linux.yml

+53-1
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,21 @@ jobs:
3131
with:
3232
TAG: ${{ github.event.release.tag_name }}
3333
ARCH: 'amd64'
34+
35+
packaging-amd64-fips:
36+
needs: [unit-test, proxy-tests]
37+
uses: ./.github/workflows/component_linux_packaging.yml
38+
secrets:
39+
DOCKER_HUB_ID: ${{secrets.OHAI_DOCKER_HUB_ID}}
40+
DOCKER_HUB_PASSWORD: ${{secrets.OHAI_DOCKER_HUB_PASSWORD}}
41+
GPG_MAIL: '[email protected]'
42+
GPG_PASSPHRASE: ${{ secrets.OHAI_GPG_PASSPHRASE }}
43+
GPG_PRIVATE_KEY_BASE64: ${{ secrets.OHAI_GPG_PRIVATE_KEY_BASE64 }} # base64 encoded
44+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
45+
with:
46+
TAG: ${{ github.event.release.tag_name }}
47+
ARCH: 'amd64'
48+
FIPS: true
3449

3550
packaging-arm:
3651
needs: [unit-test, proxy-tests]
@@ -60,6 +75,21 @@ jobs:
6075
TAG: ${{ github.event.release.tag_name }}
6176
ARCH: 'arm64'
6277

78+
packaging-arm64-fips:
79+
needs: [unit-test, proxy-tests]
80+
uses: ./.github/workflows/component_linux_packaging.yml
81+
secrets:
82+
DOCKER_HUB_ID: ${{secrets.OHAI_DOCKER_HUB_ID}}
83+
DOCKER_HUB_PASSWORD: ${{secrets.OHAI_DOCKER_HUB_PASSWORD}}
84+
GPG_MAIL: '[email protected]'
85+
GPG_PASSPHRASE: ${{ secrets.OHAI_GPG_PASSPHRASE }}
86+
GPG_PRIVATE_KEY_BASE64: ${{ secrets.OHAI_GPG_PRIVATE_KEY_BASE64 }} # base64 encoded
87+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
88+
with:
89+
TAG: ${{ github.event.release.tag_name }}
90+
ARCH: 'arm64'
91+
FIPS: true
92+
6393
packaging-legacy:
6494
needs: [unit-test, proxy-tests]
6595
uses: ./.github/workflows/component_linux_packaging.yml
@@ -94,11 +124,33 @@ jobs:
94124
tag: "${{ github.event.release.tag_name }}-rc"
95125
severity: "CRITICAL"
96126

127+
packaging-docker-fips:
128+
needs: [unit-test, proxy-tests]
129+
uses: ./.github/workflows/component_docker_packaging.yml
130+
secrets:
131+
DOCKER_HUB_ID: ${{secrets.OHAI_DOCKER_HUB_ID}}
132+
DOCKER_HUB_PASSWORD: ${{secrets.OHAI_DOCKER_HUB_PASSWORD}}
133+
GPG_MAIL: '[email protected]'
134+
GPG_PASSPHRASE: ${{ secrets.OHAI_GPG_PASSPHRASE }}
135+
GPG_PRIVATE_KEY_BASE64: ${{ secrets.OHAI_GPG_PRIVATE_KEY_BASE64 }} # base64 encoded
136+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
137+
with:
138+
TAG: ${{ github.event.release.tag_name }}
139+
FIPS: true
140+
141+
docker-fips-trivy-critical:
142+
needs: [packaging-docker-fips]
143+
uses: ./.github/workflows/component_trivy.yml
144+
with:
145+
tag: "${{ github.event.release.tag_name }}-rc"
146+
severity: "CRITICAL"
147+
FIPS: true
148+
97149
publishing-to-s3:
98150
# point to staging after tests
99151
name: Publish linux artifacts into s3 staging bucket
100152
uses: ./.github/workflows/component_linux_publish.yml
101-
needs: [packaging-amd64, packaging-arm, packaging-arm64, packaging-legacy]
153+
needs: [packaging-amd64, packaging-amd64-fips, packaging-arm, packaging-arm64, packaging-arm64-fips, packaging-legacy]
102154
secrets:
103155
DOCKER_HUB_ID: ${{secrets.OHAI_DOCKER_HUB_ID}}
104156
DOCKER_HUB_PASSWORD: ${{secrets.OHAI_DOCKER_HUB_PASSWORD}}

0 commit comments

Comments
 (0)