fips-v1.7.1

.acquia/Dockerfile.ci

@@ -0,0 +1,43 @@
+FROM jfrog.ais.acquia.io/devops-pipeline/acq-aws:2 as fips-golang-builder
+
+# Update packages
+USER root
+RUN yum makecache \
+  && yum update -y \
+  && yum install -y tar gcc git curl \
+  && yum clean all \
+  && rm -rf /var/cache/yum
+
+ARG TARGETOS=linux
+ARG TARGETARCH=amd64
+
+# Install Go
+ARG GOLANG_VERSION=1.20
+RUN curl -LO "https://go.dev/dl/go${GOLANG_VERSION}.${TARGETOS}-${TARGETARCH}.tar.gz" && \
+  tar -C /usr/local -xzf "go${GOLANG_VERSION}.${TARGETOS}-${TARGETARCH}.tar.gz" && \
+  rm -f "go${GOLANG_VERSION}.${TARGETOS}-${TARGETARCH}.tar.gz" && \
+  ls -la /usr/local/go/bin && \
+  chmod +x /usr/local/go/bin/go
+
+# Set Golang environment variables
+ENV GOPATH="/go"
+ENV GOROOT="/usr/local/go"
+ENV GOBIN="${GOPATH}/bin"
+ENV GO111MODULE="on"
+ENV GOOS=${TARGETOS}
+ENV GOARCH=${TARGETARCH}
+ENV GOPRIVATE=github.com/acquia
+
+# FIPS
+ENV GOEXPERIMENT=boringcrypto
+ENV CGO_ENABLED=1
+
+# Add path to go binaries
+ENV PATH="${PATH}:${GOROOT}/bin:${GOBIN}"
+
+WORKDIR /argo-rollouts
+
+RUN git config --global --add safe.directory '*'
+
+# Perform the build
+COPY . .

.acquia/pipeline.yaml

@@ -0,0 +1,42 @@
+type: default
+team: KCS
+group: platform
+service: argo-rollouts
+
+# Validate the formatting of the pipeline.yaml file.
+validate_config: true
+
+environment_image:
+  file: ".acquia/Dockerfile.ci"
+  context: "."
+  build_args:
+    - secrets:
+      - type: vault
+        key: SSH_KEY
+        value: GIT_SSH_KEY
+        path: secret/pipeline-default/GIT_SSH_KEY
+
+pre_build:
+  code_analysis:
+    required: false
+  check_fips:
+    - steps:
+      - cd /argo-rollouts
+      - make check-fips
+
+build:
+  service_image:
+    - name: argo-rollouts/rollouts-controller
+      file: "Dockerfile-FIPS"
+      context: "."
+      build_args:
+        - secrets:
+          - type: vault
+            key: SSH_KEY
+            value: GIT_SSH_KEY
+            path: secret/pipeline-default/GIT_SSH_KEY
+
+security_scan:
+  scanner: orca
+  ignore_failures: true
+  reason: This service is only used for building base FIPS complaint image

Dockerfile-FIPS

@@ -0,0 +1,54 @@
+FROM jfrog.ais.acquia.io/devops-pipeline/acq-aws:2 as argo-rollouts-builder
+
+# Update packages
+USER root
+RUN yum makecache \
+  && yum update -y \
+  && yum install -y tar gcc git curl \
+  && yum clean all \
+  && rm -rf /var/cache/yum
+
+ARG TARGETOS=linux
+ARG TARGETARCH=amd64
+
+# Install Go
+ARG GOLANG_VERSION=1.20
+RUN curl -LO "https://go.dev/dl/go${GOLANG_VERSION}.${TARGETOS}-${TARGETARCH}.tar.gz" && \
+  tar -C /usr/local -xzf "go${GOLANG_VERSION}.${TARGETOS}-${TARGETARCH}.tar.gz" && \
+  rm -f "go${GOLANG_VERSION}.${TARGETOS}-${TARGETARCH}.tar.gz" && \
+  ls -la /usr/local/go/bin && \
+  chmod +x /usr/local/go/bin/go
+
+# Set Golang environment variables
+ENV GOPATH="/go"
+ENV GOROOT="/usr/local/go"
+ENV GOBIN="${GOPATH}/bin"
+ENV GO111MODULE="on"
+ENV GOOS=${TARGETOS}
+ENV GOARCH=${TARGETARCH}
+ENV GOPRIVATE=github.com/acquia
+
+# FIPS
+ENV GOEXPERIMENT=boringcrypto
+ENV CGO_ENABLED=1
+
+# Add path to go binaries
+ENV PATH="${PATH}:${GOROOT}/bin:${GOBIN}"
+
+WORKDIR /go/src/github.com/argoproj/argo-rollouts
+
+# Perform the build
+COPY . .
+
+ARG MAKE_TARGET="controller-fips"
+RUN GOOS=$TARGETOS GOARCH=$TARGETARCH make ${MAKE_TARGET}
+
+#####################################################################################################
+## Final image
+#####################################################################################################
+FROM jfrog.ais.acquia.io/devops-pipeline/acq-aws:2
+COPY --from=argo-rollouts-builder /go/src/github.com/argoproj/argo-rollouts/dist/rollouts-controller /bin/
+
+USER 999
+
+ENTRYPOINT [ "/bin/rollouts-controller" ]