github/pinniped
1
0
Fork 0
mirror of https://github.com/vmware-tanzu/pinniped.git synced 2026-08-25 23:07:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

add native FIPS build/test jobs to main pipeline

Browse Source 
Signed-off-by: Ryan Richard <richardry@vmware.com>
This commit is contained in:
Ryan Richard
2026-07-07 14:10:50 -07:00
parent 33c27c8929
commit 9d4418cf89
1 changed files with 197 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pipelines/main/pipeline.yml
+197 -6
View File
@@ -15,6 +15,8 @@ groups:
- build-test-image
- build-fips-image
- build-test-fips-image
- build-gofips140-image
- build-test-gofips140-image
- build-cli
- lint
- unit-test
@@ -57,6 +59,7 @@ groups:
- integration-test-latest-arm64
- integration-test-idps-firewalled
- integration-test-latest-fips
- integration-test-latest-gofips140
- integration-test-k8s-main
- kubectl-apply-test
- integration-test-changed-api-group-oldest
@@ -382,6 +385,15 @@ resources:
password: ((ci-ghcr-pusher-token))
tag: latest
- name: ci-gofips140-build-image
type: registry-image
icon: docker
source:
repository: ((ci-ghcr-registry))/test-ci-gofips140-build
username: ((ci-ghcr-pusher-username))
password: ((ci-ghcr-pusher-token))
tag: latest
- name: ci-test-image
type: registry-image
icon: docker
@@ -400,6 +412,15 @@ resources:
password: ((ci-ghcr-pusher-token))
tag: latest
- name: ci-gofips140-test-image
type: registry-image
icon: docker
source:
repository: ((ci-ghcr-registry))/test-ci-gofips140-test-binaries
username: ((ci-ghcr-pusher-username))
password: ((ci-ghcr-pusher-token))
tag: latest
- name: integration-test-runner-image
type: registry-image
icon: docker
@@ -747,8 +768,7 @@ jobs:
input_mapping:
image: ci-build-image
# this job builds pinniped using a different dockerfile
# to test that it is fips compatible.
# this job builds pinniped using a different dockerfile to test that it is fips compatible.
# it uses go-boringcrypto rather than base go.
- name: build-fips-image
public: true # all logs are publicly visible
@@ -785,6 +805,42 @@ jobs:
params:
image: image/image.tar
# This job builds pinniped using GOFIPS140, Go's native FIPS compiler.
- name: build-gofips140-image
public: true # all logs are publicly visible
plan:
- in_parallel:
- get: pinniped
trigger: true
- get: pinniped-ci
- task: build-gofips140-image
privileged: true
config:
platform: linux
image_resource:
type: registry-image
source:
repository: concourse/oci-build-task
inputs:
- name: pinniped-ci
- name: pinniped
outputs:
- name: image
run:
path: build
caches:
- path: cache
params:
CONTEXT: pinniped
UNPACK_ROOTFS: true
BUILD_ARG_GOFIPS140: certified
- task: confirm-built-with-gofips140
file: pinniped-ci/pipelines/shared-tasks/confirm-built-with-gofips140/task.yml
- put: ci-gofips140-build-image
get_params: { skip_download: true }
params:
image: image/image.tar
- name: build-test-image
public: true # all logs are publicly visible
plan:
@@ -851,6 +907,40 @@ jobs:
params:
image: image/image.tar
- name: build-test-gofips140-image
public: true # all logs are publicly visible
plan:
- in_parallel:
- get: pinniped
trigger: true
- get: pinniped-ci
- in_parallel:
- task: build-test-fips-image
privileged: true
config:
platform: linux
image_resource:
type: registry-image
source:
repository: concourse/oci-build-task
inputs:
- name: pinniped
- name: pinniped-ci
outputs:
- name: image
run:
path: build
caches:
- path: cache
params:
CONTEXT: pinniped
BUILD_ARG_GOFIPS140: certified
DOCKERFILE: pinniped-ci/pipelines/shared-helpers/test-binaries-image/Dockerfile
- put: ci-gofips140-test-image
get_params: { skip_download: true }
params:
image: image/image.tar
- name: ready-for-int # fan-in to make pass constraints for the rest of the pipeline easier to reason about
public: true # all logs are publicly visible
plan:
@@ -866,23 +956,33 @@ jobs:
- build-test-fips-image
- build-cli
- run-go-vuln-scan
- build-gofips140-image
- build-test-gofips140-image
trigger: true
- get: ci-build-image
passed: [ check-image-version ]
params:
skip_download: true
- get: ci-fips-build-image
passed: [ build-fips-image ]
params:
skip_download: true
- get: ci-test-image
passed: [ build-test-image ]
params:
skip_download: true
- get: ci-fips-build-image
passed: [ build-fips-image ]
params:
skip_download: true
- get: ci-gofips140-build-image
passed: [ build-gofips140-image ]
params:
skip_download: true
- get: ci-fips-test-image
passed: [ build-test-fips-image ]
params:
skip_download: true
- get: ci-gofips140-test-image
passed: [ build-test-gofips140-image ]
params:
skip_download: true
- name: run-int-misc
public: true # all logs are publicly visible
@@ -899,6 +999,8 @@ jobs:
- build-test-image
- build-fips-image
- build-test-fips-image
- build-gofips140-image
- build-test-gofips140-image
trigger: false # only run on-demand when a human asks for it, e.g. while preparing a release
- get: ci-build-image
passed: [ check-image-version ]
@@ -916,6 +1018,14 @@ jobs:
passed: [ build-test-fips-image ]
params:
skip_download: true
- get: ci-gofips140-build-image
passed: [ build-gofips140-image ]
params:
skip_download: true
- get: ci-gofips140-test-image
passed: [ build-test-gofips140-image ]
params:
skip_download: true
- name: run-int-k8s-versions
public: true # all logs are publicly visible
@@ -932,6 +1042,8 @@ jobs:
- build-test-image
- build-fips-image
- build-test-fips-image
- build-gofips140-image
- build-test-gofips140-image
trigger: false # only run on-demand when a human asks for it, e.g. while preparing a release
- get: ci-build-image
passed: [ check-image-version ]
@@ -949,6 +1061,14 @@ jobs:
passed: [ build-test-fips-image ]
params:
skip_download: true
- get: ci-gofips140-build-image
passed: [ build-gofips140-image ]
params:
skip_download: true
- get: ci-gofips140-test-image
passed: [ build-test-gofips140-image ]
params:
skip_download: true
- name: run-int-cloud-providers
public: true # all logs are publicly visible
@@ -965,6 +1085,8 @@ jobs:
- build-test-image
- build-fips-image
- build-test-fips-image
- build-gofips140-image
- build-test-gofips140-image
trigger: false # only run on-demand when a human asks for it, e.g. while preparing a release
- get: ci-build-image
passed: [ check-image-version ]
@@ -982,6 +1104,14 @@ jobs:
passed: [ build-test-fips-image ]
params:
skip_download: true
- get: ci-gofips140-build-image
passed: [ build-gofips140-image ]
params:
skip_download: true
- get: ci-gofips140-test-image
passed: [ build-test-gofips140-image ]
params:
skip_download: true
# - name: scan-image
# public: false # hide security scan results
@@ -2165,6 +2295,67 @@ jobs:
params:
<<: *gcp_account_params
- name: integration-test-latest-gofips140
public: true # all logs are publicly visible
plan:
- in_parallel:
- get: pinniped
passed: [ run-int-misc ]
trigger: true
- get: pinniped-ci
- get: kind-release
- get: gcloud-image
- get: k8s-app-deployer-image
- get: ci-gofips140-build-image
passed: [ run-int-misc ]
params:
skip_download: true
- get: ci-gofips140-test-image
passed: [ run-int-misc ]
- get: integration-test-runner-image
- task: deploy-kind-instance
attempts: 5
timeout: 30m
file: pinniped-ci/pipelines/shared-tasks/deploy-kind-cluster-vm/task.yml
image: gcloud-image
params:
<<: *latest_kind_kube_version
<<: *gcp_account_params
- task: deploy
input_mapping:
ci-build-image: ci-gofips140-build-image
cluster-pool: deploy-kind-cluster-vm-output
params:
SUPERVISOR_AND_CONCIERGE_GODEBUG_FIPS140_ONLY: "yes"
CLUSTER_CAPABILITIES_PATH: pinniped/test/cluster_capabilities/kind.yaml
file: pinniped-ci/pipelines/shared-tasks/deploy-to-integration/task.yml
image: integration-test-runner-image
- task: run-integration-tests
timeout: 75m
file: pinniped-ci/pipelines/shared-tasks/run-integration-tests/task.yml
input_mapping:
ci-test-image: ci-gofips140-test-image
image: integration-test-runner-image
params:
START_GCLOUD_PROXY: "yes"
<<: *gcp_account_params
ensure:
task: export-cluster-diagnostics
<<: *cluster_diagnostics_task
input_mapping:
ci-build-image: ci-gofips140-build-image
cluster-pool: deploy-kind-cluster-vm-output
ensure:
task: remove-kind-instance
attempts: 2
timeout: 20m
file: pinniped-ci/pipelines/shared-tasks/remove-kind-cluster-vm/task.yml
image: gcloud-image
input_mapping:
kind-cluster-pool: deploy-kind-cluster-vm-output
params:
<<: *gcp_account_params
- name: integration-test-k8s-main
public: true # all logs are publicly visible
plan: