Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[8.16](backport #4472) Fix docker image build for FIPS variants #4504

Closed
wants to merge 1 commit into from

Conversation

mergify[bot]
Copy link
Contributor

@mergify mergify bot commented Feb 20, 2025

What is the problem this PR solves?

Multiple -tags= flags are used if FIPS and SNAPSHOT are set.
Correct the resulting docker image that's created when FIPS is used.
Add fips e2e test that verifies a binary.

How does this PR solve the problem?

Merge tags used for all go build commands into a comma separated list.
Change resulting docker base image to a fips enabled one.
Add e2e test that will run after a FIPS binary has been compiled, test will use go version to ensure the go binary has the expected FIPS indicators (build tag and expriement), and will check the binary's symbols (if present) for OpenSSL_version.

Design Checklist

  • I have ensured my design is stateless and will work when multiple fleet-server instances are behind a load balancer.
  • I have or intend to scale test my changes, ensuring it will work reliably with 100K+ agents connected.
  • I have included fail safe mechanisms to limit the load on fleet-server: rate limiting, circuit breakers, caching, load shedding, etc.

Checklist

  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • I have made corresponding change to the default configuration files
  • I have added tests that prove my fix is effective or that my feature works
  • I have added an entry in ./changelog/fragments using the changelog tool
    This is an automatic backport of pull request Fix docker image build for FIPS variants #4472 done by Mergify.

Fix multiple -tags= flags occurances.
Correct the resulting docker image that's created when FIPS is used.
Add fips e2e test that verifies a binary.

(cherry picked from commit c83472b)

# Conflicts:
#	Dockerfile.fips
#	Makefile
@mergify mergify bot requested a review from a team as a code owner February 20, 2025 18:12
@mergify mergify bot added backport conflicts There is a conflict in the backported pull request labels Feb 20, 2025
Copy link
Contributor Author

mergify bot commented Feb 20, 2025

Cherry-pick of c83472b has failed:

On branch mergify/bp/8.16/pr-4472
Your branch is up to date with 'origin/8.16'.

You are currently cherry-picking commit c83472b.
  (fix conflicts and run "git cherry-pick --continue")
  (use "git cherry-pick --skip" to skip this patch)
  (use "git cherry-pick --abort" to cancel the cherry-pick operation)

Changes to be committed:
	modified:   .buildkite/pipeline.yml
	modified:   .github/workflows/golangci-lint.yml
	modified:   .golangci.yml
	modified:   dev-tools/e2e/Dockerfile
	modified:   dev-tools/e2e/build.sh
	modified:   testing/e2e/agent_container_test.go
	modified:   testing/e2e/agent_install_test.go
	new file:   testing/e2e/fips_test.go
	modified:   testing/e2e/stand_alone_api_test.go
	modified:   testing/e2e/stand_alone_container_test.go
	modified:   testing/e2e/stand_alone_test.go
	modified:   testing/e2e/statusProxy.go

Unmerged paths:
  (use "git add/rm <file>..." as appropriate to mark resolution)
	deleted by us:   Dockerfile.fips
	both modified:   Makefile

To fix up this pull request, you can check it out locally. See documentation: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally

@michel-laterman
Copy link
Contributor

Don't need to reelase on 8.16

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
backport conflicts There is a conflict in the backported pull request
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant