Skip to content

Commit

Permalink
This change ensures the openstack-ansibleee-operator is built with FI…
Browse files Browse the repository at this point in the history
…PS compliance

* Changed the build image to ubi9/go-toolkit
* Changed the base image to ubi9/micro
* Added the default GO_BUILD_EXTRA_ARGS="-tags strictfipsruntime"
* Added the GO_BUILD_EXTRA_ENV_ARGS build argument to allow
  custom build arguments at build time. It defaults to
  "CGO_ENABLED=1 GO111MODULE=on"
* Those default parameters have been added to enable FIPS compliance
* Fixed indentation
* Removed TARGETOS and TARGETARCH env vars
* Added DOCKER_BUILD_ARGS variable in Makefile to pass custom parameters
  during `podman build`
* Added export `FAIL_FIPS_CHECK=true` to `prow_ci.env` file.

Closes: https://issues.redhat.com/browse/OSPRH-3396

Signed-off-by: Roberto Alfieri <[email protected]>
  • Loading branch information
rebtoor committed Feb 1, 2024
1 parent ba3c70f commit 3ed3d6b
Show file tree
Hide file tree
Showing 3 changed files with 18 additions and 14 deletions.
1 change: 1 addition & 0 deletions .prow_ci.env
Original file line number Diff line number Diff line change
@@ -1 +1,2 @@
export USE_IMAGE_DIGESTS=true
export FAIL_FIPS_CHECK=true
26 changes: 13 additions & 13 deletions Dockerfile
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
ARG GOLANG_BUILDER=golang:1.19
ARG OPERATOR_BASE_IMAGE=gcr.io/distroless/static:nonroot
ARG GOLANG_BUILDER=registry.access.redhat.com/ubi9/go-toolset:1.19
ARG OPERATOR_BASE_IMAGE=registry.access.redhat.com/ubi9/ubi-micro:latest

# Build the manager binary
FROM $GOLANG_BUILDER AS builder
Expand All @@ -12,21 +12,21 @@ ARG REMOTE_SOURCE_DIR=/remote-source
ARG REMOTE_SOURCE_SUBDIR=
ARG DEST_ROOT=/dest-root

ARG TARGETOS
ARG TARGETARCH
ARG GO_BUILD_EXTRA_ARGS=
ARG GO_BUILD_EXTRA_ARGS="-tags strictfipsruntime"
ARG GO_BUILD_EXTRA_ENV_ARGS="CGO_ENABLED=1 GO111MODULE=on"

COPY $REMOTE_SOURCE $REMOTE_SOURCE_DIR
WORKDIR $REMOTE_SOURCE_DIR/$REMOTE_SOURCE_SUBDIR

USER root
RUN mkdir -p ${DEST_ROOT}/usr/local/bin/

# cache deps before building and copying source so that we don't need to re-download as much
# and so that source changes don't invalidate our downloaded layer
RUN if [ ! -f $CACHITO_ENV_FILE ]; then go mod download ; fi

# Build manager
RUN if [ -f $CACHITO_ENV_FILE ] ; then source $CACHITO_ENV_FILE ; fi ; CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} GO111MODULE=on go build ${GO_BUILD_EXTRA_ARGS} -a -o ${DEST_ROOT}/manager main.go
RUN if [ -f $CACHITO_ENV_FILE ] ; then source $CACHITO_ENV_FILE ; fi ; env ${GO_BUILD_EXTRA_ENV_ARGS} go build ${GO_BUILD_EXTRA_ARGS} -a -o ${DEST_ROOT}/manager main.go

# Use distroless as minimal base image to package the manager binary
# Refer to https://github.com/GoogleContainerTools/distroless for more details
Expand All @@ -49,16 +49,16 @@ ARG IMAGE_TAGS="cn-openstack openstack"

# Labels required by upstream and osbs build system
LABEL com.redhat.component="${IMAGE_COMPONENT}" \
name="${IMAGE_NAME}" \
version="${IMAGE_VERSION}" \
summary="${IMAGE_SUMMARY}" \
io.k8s.name="${IMAGE_NAME}" \
io.k8s.description="${IMAGE_DESC}" \
io.openshift.tags="${IMAGE_TAGS}"
name="${IMAGE_NAME}" \
version="${IMAGE_VERSION}" \
summary="${IMAGE_SUMMARY}" \
io.k8s.name="${IMAGE_NAME}" \
io.k8s.description="${IMAGE_DESC}" \
io.openshift.tags="${IMAGE_TAGS}"
### DO NOT EDIT LINES ABOVE

ENV USER_UID=$USER_ID \
OPERATOR_TEMPLATES=/usr/share/ansibleee-operator/templates/
OPERATOR_TEMPLATES=/usr/share/ansibleee-operator/templates/

WORKDIR /

Expand Down
5 changes: 4 additions & 1 deletion Makefile
Original file line number Diff line number Diff line change
Expand Up @@ -78,6 +78,9 @@ endif
SHELL = /usr/bin/env bash -o pipefail
.SHELLFLAGS = -ec

# Extra vars which will be passed to the Docker-build
DOCKER_BUILD_ARGS ?=

.PHONY: all
all: build

Expand Down Expand Up @@ -141,7 +144,7 @@ run: manifests generate fmt vet ## Run a controller from your host.

.PHONY: docker-build
docker-build: test ## Build docker image with the manager.
podman build -t ${IMG} .
podman build -t ${IMG} . ${DOCKER_BUILD_ARGS}

.PHONY: docker-push
docker-push: ## Push docker image with the manager.
Expand Down

0 comments on commit 3ed3d6b

Please sign in to comment.