Skip to content

Commit 43f292b

Browse files
zhaohuabingzhaohuabing
authored
Merge pull request #28 from tetrateio/fips
Build and test fips images
2 parents 2f6e3d2 + 39cfd26 commit 43f292b

3 files changed

Lines changed: 240 additions & 4 deletions

File tree

‎.github/workflows/release-fips.yaml‎

Lines changed: 173 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,173 @@
1+
name: "FIPS Release"
2+
3+
on:
4+
push:
5+
# Sequence of patterns matched against refs/tags
6+
tags:
7+
- "v*.*.*"
8+
9+
permissions:
10+
contents: read
11+
12+
env:
13+
PLATFORMS: "linux_amd64"
14+
IMAGE_PLATFORMS: "linux/amd64"
15+
16+
jobs:
17+
lint:
18+
runs-on: [self-hosted, linux, x64]
19+
steps:
20+
- uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
21+
- uses: ./tools/github-actions/setup-deps
22+
- uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # v4.2.0
23+
with:
24+
version: v3.5.0
25+
# Generate the install manifests first so it can checked
26+
# for errors while running `make -k lint`
27+
- run: make generate-manifests
28+
- run: make lint-deps
29+
- run: make -k lint
30+
31+
gen-check:
32+
runs-on: [self-hosted, linux, x64]
33+
steps:
34+
- uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
35+
- uses: ./tools/github-actions/setup-deps
36+
- uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # v4.2.0
37+
with:
38+
version: v3.5.0
39+
- run: make -k gen-check
40+
41+
license-check:
42+
runs-on: [self-hosted, linux, x64]
43+
steps:
44+
- uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
45+
- uses: ./tools/github-actions/setup-deps
46+
- run: make -k licensecheck
47+
48+
coverage-test:
49+
runs-on: [self-hosted, linux, x64]
50+
steps:
51+
- uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
52+
- uses: ./tools/github-actions/setup-deps
53+
54+
# test
55+
- name: Run Coverage Tests
56+
run: make go.test.coverage
57+
- name: Upload coverage to Codecov
58+
uses: codecov/codecov-action@4fe8c5f003fae66aa5ebb77cfd3e7bfbbda0b6b0 # v3.1.5
59+
with:
60+
fail_ci_if_error: false
61+
files: ./coverage.xml
62+
name: codecov-envoy-gateway
63+
verbose: true
64+
65+
build:
66+
runs-on: [self-hosted, linux, x64]
67+
needs: [lint, gen-check, license-check, coverage-test]
68+
steps:
69+
- uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
70+
- uses: ./tools/github-actions/setup-deps
71+
72+
- name: Build EG Multiarch Binaries
73+
run: make build-multiarch PLATFORMS=${{ env.PLATFORMS }}
74+
75+
- name: Upload EG Binaries
76+
uses: actions/upload-artifact@1746f4ab65b179e0ea60a494b83293b640dd5bba # v4.3.2
77+
with:
78+
name: envoy-gateway
79+
path: bin/
80+
81+
# Enable once https://github.com/tetrateio/gateway/issues/15 is completed
82+
conformance-test:
83+
runs-on: [self-hosted, linux, x64]
84+
needs: [build]
85+
strategy:
86+
matrix:
87+
version: [ v1.26.14, v1.27.11, v1.28.7, v1.29.2 ]
88+
steps:
89+
- uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
90+
- uses: ./tools/github-actions/setup-deps
91+
- uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # v4.2.0
92+
with:
93+
version: v3.5.0
94+
- name: Download EG Binaries
95+
uses: actions/download-artifact@8caf195ad4b1dee92908e23f56eeb0696f1dd42d # v4.1.5
96+
with:
97+
name: envoy-gateway
98+
path: bin/
99+
- name: Give Privileges To EG Binaries
100+
run: chmod +x bin/linux/amd64/envoy-gateway
101+
102+
# conformance
103+
# - name: Run Standard Conformance Tests
104+
# env:
105+
# KIND_NODE_TAG: ${{ matrix.version }}
106+
# IMAGE_PULL_POLICY: IfNotPresent
107+
# run: make conformance
108+
109+
e2e-test:
110+
runs-on: [self-hosted, linux, x64]
111+
needs: [build]
112+
strategy:
113+
matrix:
114+
version: [ v1.26.14, v1.27.11, v1.28.7, v1.29.2 ]
115+
steps:
116+
- uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
117+
- uses: ./tools/github-actions/setup-deps
118+
- uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # v4.2.0
119+
with:
120+
version: v3.5.0
121+
- name: Download EG Binaries
122+
uses: actions/download-artifact@8caf195ad4b1dee92908e23f56eeb0696f1dd42d # v4.1.5
123+
with:
124+
name: envoy-gateway
125+
path: bin/
126+
- name: Give Privileges To EG Binaries
127+
run: chmod +x bin/linux/amd64/envoy-gateway
128+
129+
# E2E
130+
# - name: Run E2E Tests
131+
# env:
132+
# KIND_NODE_TAG: ${{ matrix.version }}
133+
# IMAGE_PULL_POLICY: IfNotPresent
134+
# run: make e2e
135+
136+
publish:
137+
runs-on: [self-hosted, linux, x64]
138+
needs: [conformance-test, e2e-test]
139+
steps:
140+
- uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
141+
- uses: ./tools/github-actions/setup-deps
142+
143+
- name: Download EG Binaries
144+
uses: actions/download-artifact@8caf195ad4b1dee92908e23f56eeb0696f1dd42d # v4.1.5
145+
with:
146+
name: envoy-gateway
147+
path: bin/
148+
149+
- name: Give Privileges To EG Binaries
150+
run: chmod +x bin/linux/amd64/envoy-gateway
151+
152+
- name: Setup Multiarch Environment
153+
if: github.event_name == 'push'
154+
run: make image.multiarch.setup
155+
156+
- name: Extract Release Tag
157+
id: vars
158+
shell: bash
159+
run: echo "release_tag=$(echo ${GITHUB_REF##*/})" >> $GITHUB_ENV
160+
161+
# build and push image
162+
- name: Login to Cloudsmith Registry
163+
if: github.event_name == 'push'
164+
uses: docker/login-action@v2
165+
with:
166+
registry: docker.cloudsmith.io
167+
username: ${{ secrets.CLOUDSMITH_USERNAME }}
168+
password: ${{ secrets.CLOUDSMITH_SECRET }}
169+
170+
- name: Build and Push TEG Commit Image to Cloudsmith Registry
171+
if: github.event_name == 'push'
172+
# tag is set to the short SHA of the commit
173+
run: make image.push.multiarch TAG=${{ env.release_tag }} PLATFORMS=${{ env.PLATFORMS }} IMAGE_PLATFORMS=${{ env.IMAGE_PLATFORMS }} IMAGE=fips-containers.teg.tetratelabs.com/gateway

‎tools/hack/verify_fips.sh‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
#!/bin/bash
2+
3+
binary=$1
4+
5+
echo "Checking whether compiled binaries have BoringSSL enabled ..."
6+
echo "* checking ${binary} ..."
7+
8+
echo " * checking 'go version' ..."
9+
if ! go version "${binary}" | grep 'X:boringcrypto' ; then
10+
echo " ! 'go version <binary>' returned value without 'X:boringcrypto': $(go version "${binary}")"
11+
exit 2
12+
fi
13+
14+
echo " * checking 'strings' ..."
15+
if ! strings "${binary}" | grep --quiet '_Cfunc__goboringcrypto_' ; then
16+
echo " ! 'strings <binary>' did not return expected BoringSSL symbol names"
17+
exit 2
18+
fi
19+
20+
echo " + BoringSSL is enabled in ${binary}"

‎tools/make/golang.mk‎

Lines changed: 47 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44

55
VERSION_PACKAGE := github.com/envoyproxy/gateway/internal/cmd/version
66

7-
GO_LDFLAGS += -X $(VERSION_PACKAGE).envoyGatewayVersion=$(shell cat VERSION) \
7+
GO_LD_FLAGS += -X $(VERSION_PACKAGE).envoyGatewayVersion=$(shell cat VERSION) \
88
-X $(VERSION_PACKAGE).shutdownManagerVersion=$(TAG) \
99
-X $(VERSION_PACKAGE).gitCommitID=$(GIT_COMMIT)
1010

@@ -17,9 +17,18 @@ endif
1717

1818
GO_VERSION = $(shell grep -oE "^go [[:digit:]]*\.[[:digit:]]*" go.mod | cut -d' ' -f2)
1919

20+
DEBUG ?= false
21+
22+
# as per https://projectcontour.io/docs/1.24/guides/fips/
23+
FIPS_BUILD_FLAGS = CGO_ENABLED=1 GOEXPERIMENT=boringcrypto VERIFY_FIPS=true
24+
FIPS_LD_FLAGS = GO_LD_FLAGS
25+
ifneq ($(DEBUG),true)
26+
FIPS_LD_FLAGS += -extldflags -static -s -w -linkmode=external
27+
endif
28+
2029
# Build the target binary in target platform.
2130
# The pattern of build.% is `build.{Platform}.{Command}`.
22-
# If we want to build envoy-gateway in linux amd64 platform,
31+
# If we want to build envoy-gateway in linux amd64 platform,
2332
# just execute make go.build.linux_amd64.envoy-gateway.
2433
.PHONY: go.build.%
2534
go.build.%:
@@ -29,17 +38,43 @@ go.build.%:
2938
$(eval OS := $(word 1,$(subst _, ,$(PLATFORM))))
3039
$(eval ARCH := $(word 2,$(subst _, ,$(PLATFORM))))
3140
@$(call log, "Building binary $(COMMAND) with commit $(REV) for $(OS) $(ARCH)")
32-
CGO_ENABLED=0 GOOS=$(OS) GOARCH=$(ARCH) go build -o $(OUTPUT_DIR)/$(OS)/$(ARCH)/$(COMMAND) -ldflags "$(GO_LDFLAGS)" $(ROOT_PACKAGE)/cmd/$(COMMAND)
41+
CGO_ENABLED=0 GOOS=$(OS) GOARCH=$(ARCH) go build -o $(OUTPUT_DIR)/$(OS)/$(ARCH)/$(COMMAND) -ldflags "$(GO_LD_FLAGS)" $(ROOT_PACKAGE)/cmd/$(COMMAND)
42+
43+
.PHONY: go.fips.build.%
44+
go.fips.build.%:
45+
@$(LOG_TARGET)
46+
$(eval COMMAND := $(word 2,$(subst ., ,$*)))
47+
$(eval PLATFORM := $(word 1,$(subst ., ,$*)))
48+
$(eval OS := $(word 1,$(subst _, ,$(PLATFORM))))
49+
$(eval ARCH := $(word 2,$(subst _, ,$(PLATFORM))))
50+
@$(call log, "Building binary $(COMMAND) with commit $(REV) for $(OS) $(ARCH)")
51+
CGO_ENABLED=0 GOOS=$(OS) GOARCH=$(ARCH) $(FIPS_BUILD_FLAGS) go build -o $(OUTPUT_DIR)/$(OS)/$(ARCH)/$(COMMAND) -ldflags "$(FIPS_LD_FLAGS)" $(ROOT_PACKAGE)/cmd/$(COMMAND)
52+
53+
go.fips.verify.%:
54+
@$(LOG_TARGET)
55+
$(eval COMMAND := $(word 2,$(subst ., ,$*)))
56+
$(eval PLATFORM := $(word 1,$(subst ., ,$*)))
57+
$(eval OS := $(word 1,$(subst _, ,$(PLATFORM))))
58+
$(eval ARCH := $(word 2,$(subst _, ,$(PLATFORM))))
59+
@$(call log, "Verifying binary $(COMMAND)")
60+
tools/hack/verify_fips.sh $(OUTPUT_DIR)/$(OS)/$(ARCH)/$(COMMAND)
3361

3462
# Build the envoy-gateway binaries in the hosted platforms.
3563
.PHONY: go.build
3664
go.build: $(addprefix go.build., $(addprefix $(PLATFORM)., $(BINS)))
3765

66+
# Build the FIPS envoy-gateway binaries in the hosted platforms.
67+
.PHONY: go.fips.build
68+
go.fips.build: $(addprefix go.fips.build., $(addprefix $(PLATFORM)., $(BINS))) $(addprefix go.fips.verify., $(addprefix $(PLATFORM)., $(BINS)))
69+
3870
# Build the envoy-gateway binaries in multi platforms
3971
# It will build the linux/amd64, linux/arm64, darwin/amd64, darwin/arm64 binaries out.
4072
.PHONY: go.build.multiarch
4173
go.build.multiarch: $(foreach p,$(PLATFORMS),$(addprefix go.build., $(addprefix $(p)., $(BINS))))
4274

75+
# Build the FIPS envoy-gateway binaries in multi platforms.
76+
.PHONY: go.fips.build.multiarch
77+
go.fips.build.multiarch: $(foreach p,$(PLATFORMS),$(addprefix go.fips.build., $(addprefix $(p)., $(BINS)))) $(foreach p,$(PLATFORMS),$(addprefix go.fips.verify., $(addprefix $(p)., $(BINS))))
4378

4479
.PHONY: go.test.unit
4580
go.test.unit: ## Run go unit tests
@@ -101,10 +136,18 @@ go.generate: ## Generate code from templates
101136
build: ## Build envoy-gateway for host platform. See Option PLATFORM and BINS.
102137
build: go.build
103138

139+
.PHONY: fips.build
140+
fips.build: ## Build FIPS envoy-gateway for host platform. See Option PLATFORM and BINS.
141+
fips.build: go.fips.build
142+
104143
.PHONY: build-multiarch
105144
build-multiarch: ## Build envoy-gateway for multiple platforms. See Option PLATFORMS and IMAGES.
106145
build-multiarch: go.build.multiarch
107146

147+
.PHONY: fips.build-multiarch
148+
fips.build-multiarch: ## Build FIPS envoy-gateway for multiple platforms. See Option PLATFORMS and IMAGES.
149+
fips.build-multiarch: go.fips.build.multiarch
150+
108151
.PHONY: test
109152
test: ## Run all Go test of code sources.
110153
test: go.test.unit
@@ -119,4 +162,4 @@ clean: go.clean
119162

120163
.PHONY: testdata
121164
testdata: ## Override the testdata with new configurations.
122-
testdata: go.testdata.complete
165+
testdata: go.testdata.complete

0 commit comments

Comments
 (0)