mirrors/pinniped
1
0
Fork 0
mirror of https://github.com/vmware-tanzu/pinniped.git synced 2026-09-20 15:04:34 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

CI changes for testing GOFIPS140 builds in PR pipeline

Browse Source 
Signed-off-by: Ryan Richard <richardry@vmware.com>
This commit is contained in:
Ryan Richard
2026-07-06 10:32:31 -07:00
parent 82cb634931
commit d9d65c97af
6 changed files with 298 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pipelines/pull-requests/pipeline.yml
+196 -2
View File
@@ -260,6 +260,15 @@ resources:
password: ((ci-ghcr-pusher-token))
tag: latest
- name: ci-gofips140-build-image
type: registry-image
icon: docker
source:
repository: ((ci-ghcr-registry))/test-ci-gofips140-build
username: ((ci-ghcr-pusher-username))
password: ((ci-ghcr-pusher-token))
tag: latest
- name: ci-test-image
type: registry-image
icon: docker
@@ -278,6 +287,15 @@ resources:
password: ((ci-ghcr-pusher-token))
tag: latest
- name: ci-gofips140-test-image
type: registry-image
icon: docker
source:
repository: ((ci-ghcr-registry))/test-ci-gofips140-test-binaries
username: ((ci-ghcr-pusher-username))
password: ((ci-ghcr-pusher-token))
tag: latest
- name: integration-test-runner-image
type: registry-image
icon: docker
@@ -400,6 +418,8 @@ jobs:
- { <<: *pr-status-on-pending, params: { <<: *pr-status-on-pending-params, target_url: "$ATC_EXTERNAL_URL/teams/$BUILD_TEAM_NAME/pipelines/$BUILD_PIPELINE_NAME", context: build-image } }
- { <<: *pr-status-on-pending, params: { <<: *pr-status-on-pending-params, target_url: "$ATC_EXTERNAL_URL/teams/$BUILD_TEAM_NAME/pipelines/$BUILD_PIPELINE_NAME", context: build-fips-image } }
- { <<: *pr-status-on-pending, params: { <<: *pr-status-on-pending-params, target_url: "$ATC_EXTERNAL_URL/teams/$BUILD_TEAM_NAME/pipelines/$BUILD_PIPELINE_NAME", context: build-test-fips-image } }
- { <<: *pr-status-on-pending, params: { <<: *pr-status-on-pending-params, target_url: "$ATC_EXTERNAL_URL/teams/$BUILD_TEAM_NAME/pipelines/$BUILD_PIPELINE_NAME", context: build-gofips140-image } }
- { <<: *pr-status-on-pending, params: { <<: *pr-status-on-pending-params, target_url: "$ATC_EXTERNAL_URL/teams/$BUILD_TEAM_NAME/pipelines/$BUILD_PIPELINE_NAME", context: build-test-gofips140-image } }
- { <<: *pr-status-on-pending, params: { <<: *pr-status-on-pending-params, target_url: "$ATC_EXTERNAL_URL/teams/$BUILD_TEAM_NAME/pipelines/$BUILD_PIPELINE_NAME", context: build-test-binaries } }
#- { <<: *pr-status-on-pending, params: { <<: *pr-status-on-pending-params, target_url: "$ATC_EXTERNAL_URL/teams/$BUILD_TEAM_NAME/pipelines/$BUILD_PIPELINE_NAME", context: scan-image } }
- { <<: *pr-status-on-pending, params: { <<: *pr-status-on-pending-params, target_url: "$ATC_EXTERNAL_URL/teams/$BUILD_TEAM_NAME/pipelines/$BUILD_PIPELINE_NAME", context: integration-test-oldest } }
@@ -407,6 +427,7 @@ jobs:
- { <<: *pr-status-on-pending, params: { <<: *pr-status-on-pending-params, target_url: "$ATC_EXTERNAL_URL/teams/$BUILD_TEAM_NAME/pipelines/$BUILD_PIPELINE_NAME", context: integration-test-latest-arm64 } }
- { <<: *pr-status-on-pending, params: { <<: *pr-status-on-pending-params, target_url: "$ATC_EXTERNAL_URL/teams/$BUILD_TEAM_NAME/pipelines/$BUILD_PIPELINE_NAME", context: integration-test-idps-firewalled } }
- { <<: *pr-status-on-pending, params: { <<: *pr-status-on-pending-params, target_url: "$ATC_EXTERNAL_URL/teams/$BUILD_TEAM_NAME/pipelines/$BUILD_PIPELINE_NAME", context: integration-test-latest-fips } }
- { <<: *pr-status-on-pending, params: { <<: *pr-status-on-pending-params, target_url: "$ATC_EXTERNAL_URL/teams/$BUILD_TEAM_NAME/pipelines/$BUILD_PIPELINE_NAME", context: integration-test-latest-gofips140 } }
- { <<: *pr-status-on-pending, params: { <<: *pr-status-on-pending-params, target_url: "$ATC_EXTERNAL_URL/teams/$BUILD_TEAM_NAME/pipelines/$BUILD_PIPELINE_NAME", context: integration-test-k8s-main } }
- { <<: *pr-status-on-pending, params: { <<: *pr-status-on-pending-params, target_url: "$ATC_EXTERNAL_URL/teams/$BUILD_TEAM_NAME/pipelines/$BUILD_PIPELINE_NAME", context: kubectl-apply-test } }
- { <<: *pr-status-on-pending, params: { <<: *pr-status-on-pending-params, target_url: "$ATC_EXTERNAL_URL/teams/$BUILD_TEAM_NAME/pipelines/$BUILD_PIPELINE_NAME", context: integration-test-changed-api-group-latest } }
@@ -752,8 +773,7 @@ jobs:
image: ci-build-image
pinniped: pinniped-pr
# this job builds pinniped using a different dockerfile
# to test that it is fips compatible.
# this job builds pinniped using a different dockerfile to test that it is fips compatible.
# it uses go-boringcrypto rather than base go.
- name: build-fips-image
on_success: { <<: *pr-status-on-success, params: { <<: *pr-status-on-success-params, context: build-fips-image } }
@@ -797,6 +817,49 @@ jobs:
params:
image: image/image.tar
# This job builds pinniped using GOFIPS140, Go's native FIPS compiler.
- name: build-gofips140-image
on_success: { <<: *pr-status-on-success, params: { <<: *pr-status-on-success-params, context: build-gofips140-image } }
on_failure: { <<: *pr-status-on-failure, params: { <<: *pr-status-on-failure-params, context: build-gofips140-image } }
on_error: { <<: *pr-status-on-error, params: { <<: *pr-status-on-error-params, context: build-gofips140-image } }
on_abort: { <<: *pr-status-on-abort, params: { <<: *pr-status-on-abort-params, context: build-gofips140-image } }
public: true # all logs are publicly visible
plan:
- in_parallel:
- get: pinniped-pr
trigger: true
version: every
passed: [ start ]
- get: pinniped-ci
- { <<: *pr-status-on-pending, params: { <<: *pr-status-on-pending-params, context: build-gofips140-image } }
- task: build-gofips140-image
privileged: true
config:
platform: linux
image_resource:
type: registry-image
source:
repository: concourse/oci-build-task
inputs:
- name: pinniped-ci
- name: pinniped-pr
outputs:
- name: image
run:
path: build
caches:
- path: cache
params:
CONTEXT: pinniped-pr
UNPACK_ROOTFS: true
BUILD_ARG_GOFIPS140: certified
- task: confirm-built-with-gofips140
file: pinniped-ci/pipelines/shared-tasks/confirm-built-with-gofips140/task.yml
- put: ci-gofips140-build-image
get_params: { skip_download: true }
params:
image: image/image.tar
- name: build-test-image
on_success: { <<: *pr-status-on-success, params: { <<: *pr-status-on-success-params, context: build-test-binaries } }
on_failure: { <<: *pr-status-on-failure, params: { <<: *pr-status-on-failure-params, context: build-test-binaries } }
@@ -877,6 +940,47 @@ jobs:
params:
image: image/image.tar
- name: build-test-gofips140-image
on_success: { <<: *pr-status-on-success, params: { <<: *pr-status-on-success-params, context: build-test-gofips140-image } }
on_failure: { <<: *pr-status-on-failure, params: { <<: *pr-status-on-failure-params, context: build-test-gofips140-image } }
on_error: { <<: *pr-status-on-error, params: { <<: *pr-status-on-error-params, context: build-test-gofips140-image } }
on_abort: { <<: *pr-status-on-abort, params: { <<: *pr-status-on-abort-params, context: build-test-gofips140-image } }
public: true # all logs are publicly visible
plan:
- in_parallel:
- get: pinniped-pr
trigger: true
version: every
passed: [ start ]
- get: pinniped-ci
- { <<: *pr-status-on-pending, params: { <<: *pr-status-on-pending-params, context: build-test-gofips140-image } }
- in_parallel:
- task: build-test-fips-image
privileged: true
config:
platform: linux
image_resource:
type: registry-image
source:
repository: concourse/oci-build-task
inputs:
- name: pinniped-pr
- name: pinniped-ci
outputs:
- name: image
run:
path: build
caches:
- path: cache
params:
CONTEXT: pinniped-pr
BUILD_ARG_GOFIPS140: certified
DOCKERFILE: pinniped-ci/pipelines/shared-helpers/test-binaries-image/Dockerfile
- put: ci-gofips140-test-image
get_params: { skip_download: true }
params:
image: image/image.tar
- name: ready-for-int # fan-in to make pass constraints for the rest of the pipeline easier to reason about
public: true # all logs are publicly visible
plan:
@@ -894,6 +998,8 @@ jobs:
- build-test-image
- build-fips-image
- build-test-fips-image
- build-gofips140-image
- build-test-gofips140-image
trigger: true
- get: ci-build-image
passed: [ check-image-version ]
@@ -907,10 +1013,18 @@ jobs:
passed: [ build-fips-image ]
params:
skip_download: true
- get: ci-gofips140-build-image
passed: [ build-gofips140-image ]
params:
skip_download: true
- get: ci-fips-test-image
passed: [ build-test-fips-image ]
params:
skip_download: true
- get: ci-gofips140-test-image
passed: [ build-test-gofips140-image ]
params:
skip_download: true
# Splitting the integration tests into two columns to reduce parallelism of those jobs,
# so we can have a single worker to reduce costs, and to reduce the number of jobs
@@ -937,7 +1051,9 @@ jobs:
- check-image-version
- build-test-image
- build-fips-image
- build-gofips140-image
- build-test-fips-image
- build-test-gofips140-image
trigger: true
- get: ci-build-image
passed: [ check-image-version ]
@@ -951,10 +1067,18 @@ jobs:
passed: [ build-fips-image ]
params:
skip_download: true
- get: ci-gofips140-build-image
passed: [ build-gofips140-image ]
params:
skip_download: true
- get: ci-fips-test-image
passed: [ build-test-fips-image ]
params:
skip_download: true
- get: ci-gofips140-test-image
passed: [ build-test-gofips140-image ]
params:
skip_download: true
# - name: scan-image
# on_success: { <<: *pr-status-on-success, params: { <<: *pr-status-on-success-params, context: scan-image } }
@@ -1403,6 +1527,75 @@ jobs:
params:
<<: *gcp_account_params
- name: integration-test-latest-gofips140
on_success: { <<: *pr-status-on-success, params: { <<: *pr-status-on-success-params, context: integration-test-latest-gofips140 } }
on_failure: { <<: *pr-status-on-failure, params: { <<: *pr-status-on-failure-params, context: integration-test-latest-gofips140 } }
on_error: { <<: *pr-status-on-error, params: { <<: *pr-status-on-error-params, context: integration-test-latest-gofips140 } }
on_abort: { <<: *pr-status-on-abort, params: { <<: *pr-status-on-abort-params, context: integration-test-latest-gofips140 } }
public: true # all logs are publicly visible
plan:
- in_parallel:
- get: pinniped-pr
version: every
passed: [ ready-for-int2 ]
trigger: true
- get: pinniped-ci
- get: kind-release
- get: gcloud-image
- get: k8s-app-deployer-image
- get: ci-gofips140-build-image
passed: [ ready-for-int2 ]
params:
skip_download: true
- get: ci-gofips140-test-image
passed: [ ready-for-int2 ]
- get: integration-test-runner-image
- { <<: *pr-status-on-pending, params: { <<: *pr-status-on-pending-params, context: integration-test-latest-gofips140 } }
- task: deploy-kind-instance
attempts: 5
timeout: 30m
file: pinniped-ci/pipelines/shared-tasks/deploy-kind-cluster-vm/task.yml
image: gcloud-image
params:
<<: *latest_kind_kube_version
<<: *gcp_account_params
- task: deploy
input_mapping:
ci-build-image: ci-gofips140-build-image
cluster-pool: deploy-kind-cluster-vm-output
pinniped: pinniped-pr
params:
SUPERVISOR_AND_CONCIERGE_GODEBUG_FIPS140_ONLY: "yes"
CLUSTER_CAPABILITIES_PATH: pinniped/test/cluster_capabilities/kind.yaml
file: pinniped-ci/pipelines/shared-tasks/deploy-to-integration/task.yml
image: integration-test-runner-image
- task: run-integration-tests
timeout: 75m
file: pinniped-ci/pipelines/shared-tasks/run-integration-tests/task.yml
input_mapping:
pinniped: pinniped-pr
ci-test-image: ci-gofips140-test-image
image: integration-test-runner-image
params:
START_GCLOUD_PROXY: "yes"
<<: *gcp_account_params
ensure:
task: export-cluster-diagnostics
<<: *cluster_diagnostics_task
input_mapping:
ci-build-image: ci-gofips140-build-image
cluster-pool: deploy-kind-cluster-vm-output
ensure:
task: remove-kind-instance
attempts: 2
timeout: 20m
file: pinniped-ci/pipelines/shared-tasks/remove-kind-cluster-vm/task.yml
image: gcloud-image
input_mapping:
kind-cluster-pool: deploy-kind-cluster-vm-output
params:
<<: *gcp_account_params
- name: integration-test-k8s-main
on_success: { <<: *pr-status-on-success, params: { <<: *pr-status-on-success-params, context: integration-test-k8s-main } }
on_failure: { <<: *pr-status-on-failure, params: { <<: *pr-status-on-failure-params, context: integration-test-k8s-main } }
@@ -1915,6 +2108,7 @@ jobs:
- integration-test-idps-firewalled
- integration-test-multiple-pinnipeds
- integration-test-latest-fips
- integration-test-latest-gofips140
- uninstall-test
- uninstall-existing-ns-test
# integration-test-k8s-main is purposefully excluded. Failures are informational, not blocking.