From 9d4418cf89e0e982a0b35b0828a726354390f39f Mon Sep 17 00:00:00 2001 From: Ryan Richard Date: Tue, 7 Jul 2026 14:10:50 -0700 Subject: [PATCH] add native FIPS build/test jobs to main pipeline Signed-off-by: Ryan Richard --- pipelines/main/pipeline.yml | 203 ++++++++++++++++++++++++++++++++++-- 1 file changed, 197 insertions(+), 6 deletions(-) diff --git a/pipelines/main/pipeline.yml b/pipelines/main/pipeline.yml index 4906559f7..2079e28d8 100644 --- a/pipelines/main/pipeline.yml +++ b/pipelines/main/pipeline.yml @@ -15,6 +15,8 @@ groups: - build-test-image - build-fips-image - build-test-fips-image + - build-gofips140-image + - build-test-gofips140-image - build-cli - lint - unit-test @@ -57,6 +59,7 @@ groups: - integration-test-latest-arm64 - integration-test-idps-firewalled - integration-test-latest-fips + - integration-test-latest-gofips140 - integration-test-k8s-main - kubectl-apply-test - integration-test-changed-api-group-oldest @@ -382,6 +385,15 @@ resources: password: ((ci-ghcr-pusher-token)) tag: latest + - name: ci-gofips140-build-image + type: registry-image + icon: docker + source: + repository: ((ci-ghcr-registry))/test-ci-gofips140-build + username: ((ci-ghcr-pusher-username)) + password: ((ci-ghcr-pusher-token)) + tag: latest + - name: ci-test-image type: registry-image icon: docker @@ -400,6 +412,15 @@ resources: password: ((ci-ghcr-pusher-token)) tag: latest + - name: ci-gofips140-test-image + type: registry-image + icon: docker + source: + repository: ((ci-ghcr-registry))/test-ci-gofips140-test-binaries + username: ((ci-ghcr-pusher-username)) + password: ((ci-ghcr-pusher-token)) + tag: latest + - name: integration-test-runner-image type: registry-image icon: docker @@ -747,8 +768,7 @@ jobs: input_mapping: image: ci-build-image - # this job builds pinniped using a different dockerfile - # to test that it is fips compatible. + # this job builds pinniped using a different dockerfile to test that it is fips compatible. # it uses go-boringcrypto rather than base go. - name: build-fips-image public: true # all logs are publicly visible @@ -785,6 +805,42 @@ jobs: params: image: image/image.tar + # This job builds pinniped using GOFIPS140, Go's native FIPS compiler. + - name: build-gofips140-image + public: true # all logs are publicly visible + plan: + - in_parallel: + - get: pinniped + trigger: true + - get: pinniped-ci + - task: build-gofips140-image + privileged: true + config: + platform: linux + image_resource: + type: registry-image + source: + repository: concourse/oci-build-task + inputs: + - name: pinniped-ci + - name: pinniped + outputs: + - name: image + run: + path: build + caches: + - path: cache + params: + CONTEXT: pinniped + UNPACK_ROOTFS: true + BUILD_ARG_GOFIPS140: certified + - task: confirm-built-with-gofips140 + file: pinniped-ci/pipelines/shared-tasks/confirm-built-with-gofips140/task.yml + - put: ci-gofips140-build-image + get_params: { skip_download: true } + params: + image: image/image.tar + - name: build-test-image public: true # all logs are publicly visible plan: @@ -851,6 +907,40 @@ jobs: params: image: image/image.tar + - name: build-test-gofips140-image + public: true # all logs are publicly visible + plan: + - in_parallel: + - get: pinniped + trigger: true + - get: pinniped-ci + - in_parallel: + - task: build-test-fips-image + privileged: true + config: + platform: linux + image_resource: + type: registry-image + source: + repository: concourse/oci-build-task + inputs: + - name: pinniped + - name: pinniped-ci + outputs: + - name: image + run: + path: build + caches: + - path: cache + params: + CONTEXT: pinniped + BUILD_ARG_GOFIPS140: certified + DOCKERFILE: pinniped-ci/pipelines/shared-helpers/test-binaries-image/Dockerfile + - put: ci-gofips140-test-image + get_params: { skip_download: true } + params: + image: image/image.tar + - name: ready-for-int # fan-in to make pass constraints for the rest of the pipeline easier to reason about public: true # all logs are publicly visible plan: @@ -866,23 +956,33 @@ jobs: - build-test-fips-image - build-cli - run-go-vuln-scan + - build-gofips140-image + - build-test-gofips140-image trigger: true - get: ci-build-image passed: [ check-image-version ] params: skip_download: true - - get: ci-fips-build-image - passed: [ build-fips-image ] - params: - skip_download: true - get: ci-test-image passed: [ build-test-image ] params: skip_download: true + - get: ci-fips-build-image + passed: [ build-fips-image ] + params: + skip_download: true + - get: ci-gofips140-build-image + passed: [ build-gofips140-image ] + params: + skip_download: true - get: ci-fips-test-image passed: [ build-test-fips-image ] params: skip_download: true + - get: ci-gofips140-test-image + passed: [ build-test-gofips140-image ] + params: + skip_download: true - name: run-int-misc public: true # all logs are publicly visible @@ -899,6 +999,8 @@ jobs: - build-test-image - build-fips-image - build-test-fips-image + - build-gofips140-image + - build-test-gofips140-image trigger: false # only run on-demand when a human asks for it, e.g. while preparing a release - get: ci-build-image passed: [ check-image-version ] @@ -916,6 +1018,14 @@ jobs: passed: [ build-test-fips-image ] params: skip_download: true + - get: ci-gofips140-build-image + passed: [ build-gofips140-image ] + params: + skip_download: true + - get: ci-gofips140-test-image + passed: [ build-test-gofips140-image ] + params: + skip_download: true - name: run-int-k8s-versions public: true # all logs are publicly visible @@ -932,6 +1042,8 @@ jobs: - build-test-image - build-fips-image - build-test-fips-image + - build-gofips140-image + - build-test-gofips140-image trigger: false # only run on-demand when a human asks for it, e.g. while preparing a release - get: ci-build-image passed: [ check-image-version ] @@ -949,6 +1061,14 @@ jobs: passed: [ build-test-fips-image ] params: skip_download: true + - get: ci-gofips140-build-image + passed: [ build-gofips140-image ] + params: + skip_download: true + - get: ci-gofips140-test-image + passed: [ build-test-gofips140-image ] + params: + skip_download: true - name: run-int-cloud-providers public: true # all logs are publicly visible @@ -965,6 +1085,8 @@ jobs: - build-test-image - build-fips-image - build-test-fips-image + - build-gofips140-image + - build-test-gofips140-image trigger: false # only run on-demand when a human asks for it, e.g. while preparing a release - get: ci-build-image passed: [ check-image-version ] @@ -982,6 +1104,14 @@ jobs: passed: [ build-test-fips-image ] params: skip_download: true + - get: ci-gofips140-build-image + passed: [ build-gofips140-image ] + params: + skip_download: true + - get: ci-gofips140-test-image + passed: [ build-test-gofips140-image ] + params: + skip_download: true # - name: scan-image # public: false # hide security scan results @@ -2165,6 +2295,67 @@ jobs: params: <<: *gcp_account_params + - name: integration-test-latest-gofips140 + public: true # all logs are publicly visible + plan: + - in_parallel: + - get: pinniped + passed: [ run-int-misc ] + trigger: true + - get: pinniped-ci + - get: kind-release + - get: gcloud-image + - get: k8s-app-deployer-image + - get: ci-gofips140-build-image + passed: [ run-int-misc ] + params: + skip_download: true + - get: ci-gofips140-test-image + passed: [ run-int-misc ] + - get: integration-test-runner-image + - task: deploy-kind-instance + attempts: 5 + timeout: 30m + file: pinniped-ci/pipelines/shared-tasks/deploy-kind-cluster-vm/task.yml + image: gcloud-image + params: + <<: *latest_kind_kube_version + <<: *gcp_account_params + - task: deploy + input_mapping: + ci-build-image: ci-gofips140-build-image + cluster-pool: deploy-kind-cluster-vm-output + params: + SUPERVISOR_AND_CONCIERGE_GODEBUG_FIPS140_ONLY: "yes" + CLUSTER_CAPABILITIES_PATH: pinniped/test/cluster_capabilities/kind.yaml + file: pinniped-ci/pipelines/shared-tasks/deploy-to-integration/task.yml + image: integration-test-runner-image + - task: run-integration-tests + timeout: 75m + file: pinniped-ci/pipelines/shared-tasks/run-integration-tests/task.yml + input_mapping: + ci-test-image: ci-gofips140-test-image + image: integration-test-runner-image + params: + START_GCLOUD_PROXY: "yes" + <<: *gcp_account_params + ensure: + task: export-cluster-diagnostics + <<: *cluster_diagnostics_task + input_mapping: + ci-build-image: ci-gofips140-build-image + cluster-pool: deploy-kind-cluster-vm-output + ensure: + task: remove-kind-instance + attempts: 2 + timeout: 20m + file: pinniped-ci/pipelines/shared-tasks/remove-kind-cluster-vm/task.yml + image: gcloud-image + input_mapping: + kind-cluster-pool: deploy-kind-cluster-vm-output + params: + <<: *gcp_account_params + - name: integration-test-k8s-main public: true # all logs are publicly visible plan: