Skip to content

Commit ca6b275

Browse files
rahulreddy15rahulreddy15
authored
feat(fips): add fips compliant packages (#187)
* added FIPS image release to the Dockerfile and workflow * Build FIPS compatible nri-ecs * Added FIPS build step * Changelog * changelog * split the release into two steps
1 parent 7fe94cf commit ca6b275

File tree

5 files changed

+117
-1
lines changed

5 files changed

+117
-1
lines changed

‎.github/workflows/release.yml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,11 +34,49 @@ jobs:
3434
docker buildx build --push --platform=$DOCKER_PLATFORMS \
3535
-t $DOCKER_IMAGE_NAME:latest \
3636
.
37+
3738
fi
3839
3940
# Upload configuration files
4041
make upload_manifests RELEASE_VERSION=$VERSION NRI_ECS_IMAGE_TAG=$DOCKER_IMAGE_TAG
4142
43+
secrets:
44+
docker_username: ${{ secrets.FSI_DOCKERHUB_USERNAME }}
45+
docker_password: ${{ secrets.FSI_DOCKERHUB_TOKEN }}
46+
bot_token: ${{ secrets.COREINT_BOT_TOKEN }}
47+
aws_access_key_id: ${{ secrets.COREINT_AWS_ACCESS_KEY_ID }}
48+
aws_access_key_secret: ${{ secrets.COREINT_AWS_SECRET_ACCESS_KEY }}
49+
slack_channel: ${{ secrets.COREINT_SLACK_CHANNEL }}
50+
slack_token: ${{ secrets.COREINT_SLACK_TOKEN }}
51+
52+
fips-release-pipeline:
53+
name: Release Pipeline for FIPS compatible image
54+
uses: newrelic/coreint-automation/.github/workflows/reusable_image_release.yaml@v3
55+
with:
56+
original_repo_name: "newrelic/nri-ecs"
57+
docker_image_name: "newrelic/nri-ecs-fips"
58+
docker_platforms: "linux/amd64,linux/arm64"
59+
60+
release_command_sh: |
61+
62+
# Build the integration
63+
make compile-multiarch-fips RELEASE_VERSION=$VERSION
64+
65+
# Build and push FIPS image with / without "-pre" suffix based on if its a pre release
66+
docker buildx build --push --platform=$DOCKER_PLATFORMS \
67+
-t $DOCKER_IMAGE_NAME:$DOCKER_IMAGE_TAG \
68+
-f Dockerfile.fips \
69+
.
70+
71+
# Push latest tag if its a release
72+
if [[ "${{ github.event.release.prerelease }}" == "false" ]]; then
73+
# Push latest for FIPS image
74+
docker buildx build --push --platform=$DOCKER_PLATFORMS \
75+
-t $DOCKER_IMAGE_NAME:latest \
76+
-f Dockerfile.fips \
77+
.
78+
fi
79+
4280
secrets:
4381
docker_username: ${{ secrets.FSI_DOCKERHUB_USERNAME }}
4482
docker_password: ${{ secrets.FSI_DOCKERHUB_TOKEN }}

‎CHANGELOG.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,9 @@ Unreleased section should follow
1010

1111
## Unreleased
1212

13+
### enhancements
14+
- Added FIPS compliant image
15+
1316
## v1.12.27 - 2025-09-22
1417

1518
### ⛓️ Dependencies

‎Dockerfile.fips‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
ARG BASE_IMAGE=newrelic/infrastructure-bundle-fips:3.3.2
2+
3+
FROM $BASE_IMAGE AS base
4+
5+
# Set by docker automatically
6+
# If building with `docker build`, make sure to set GOOS/GOARCH explicitly when calling make:
7+
# `make compile GOOS=something GOARCH=something`
8+
# Otherwise the makefile will not append them to the binary name and docker build will fail.
9+
ARG TARGETOS
10+
ARG TARGETARCH
11+
12+
# Add the nri-ecs integration binary to the default folders.
13+
ADD --chmod=755 bin/nri-ecs-fips-${TARGETOS}-${TARGETARCH} /var/db/newrelic-infra/newrelic-integrations/bin/
14+
RUN mv /var/db/newrelic-infra/newrelic-integrations/bin/nri-ecs-fips-${TARGETOS}-${TARGETARCH} \
15+
/var/db/newrelic-infra/newrelic-integrations/bin/nri-ecs
16+
17+
RUN rm /etc/newrelic-infra/integrations.d/docker-config.yml
18+
19+
# Activates the nri-ecs integration in the image by default.
20+
# Some Envars needed to configure the integration are set in the deployment task
21+
# and added to NRIA_PASSTHROUGH_ENVIRONMENT.
22+
ADD nri-ecs-config.yml /var/db/newrelic-infra/integrations.d/nri-ecs-config.yml
23+
ADD nri-docker-config.yml /var/db/newrelic-infra/integrations.d/nri-docker-config.yml

‎Makefile‎

Lines changed: 42 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,10 @@ RELEASE_STRING := ${RELEASE_VERSION}
88
COMMIT ?= $(shell git rev-parse HEAD || echo "unknown")
99
LD_FLAGS ?= "-X 'main.integrationVersion=$(RELEASE_VERSION)' -X 'main.gitCommit=$(COMMIT)'"
1010

11+
# FIPS builder image configuration
12+
GO_VERSION ?= $(shell grep '^go ' go.mod | awk '{print $$2}')
13+
BUILDER_IMAGE ?= "ghcr.io/newrelic/coreint-automation:latest-go$(GO_VERSION)-ubuntu16.04"
14+
1115
NRI_ECS_IMAGE_REPO ?= newrelic/nri-ecs
1216
NRI_ECS_IMAGE_TAG ?= "dev"
1317
NRI_ECS_IMAGE := $(NRI_ECS_IMAGE_REPO):$(NRI_ECS_IMAGE_TAG)
@@ -86,6 +90,43 @@ compile-multiarch:
8690
$(MAKE) compile GOOS=linux GOARCH=arm64
8791
$(MAKE) compile GOOS=linux GOARCH=arm
8892

93+
compile-multiarch-fips:
94+
$(MAKE) compile-fips-docker-amd64
95+
$(MAKE) compile-fips-docker-arm64
96+
@echo "All FIPS binaries compiled."
97+
98+
compile-all-multiarch:
99+
$(MAKE) compile-multiarch
100+
$(MAKE) compile-multiarch-fips
101+
102+
compile-fips-docker-amd64:
103+
@echo "=== $(INTEGRATION) === [ compile-fips-docker-amd64 ]: Building FIPS binary for linux/amd64 using builder image..."
104+
docker run --rm \
105+
--platform linux/amd64 \
106+
-v $(PWD):/src \
107+
-w /src \
108+
-e GOOS=linux \
109+
-e GOARCH=amd64 \
110+
-e CGO_ENABLED=1 \
111+
-e CC=gcc \
112+
-e GOEXPERIMENT=boringcrypto \
113+
$(BUILDER_IMAGE) \
114+
go build -o bin/$(BINARY_NAME)-fips-linux-amd64 -ldflags $(LD_FLAGS) -tags fips ./cmd
115+
116+
compile-fips-docker-arm64:
117+
@echo "=== $(INTEGRATION) === [ compile-fips-docker-arm64 ]: Building FIPS binary for linux/arm64 using builder image..."
118+
docker run --rm \
119+
--platform linux/amd64 \
120+
-v $(PWD):/src \
121+
-w /src \
122+
-e GOOS=linux \
123+
-e GOARCH=arm64 \
124+
-e CGO_ENABLED=1 \
125+
-e CC=aarch64-linux-gnu-gcc \
126+
-e GOEXPERIMENT=boringcrypto \
127+
$(BUILDER_IMAGE) \
128+
go build -o bin/$(BINARY_NAME)-fips-linux-arm64 -ldflags $(LD_FLAGS) -tags fips ./cmd
129+
89130
## GOOS and GOARCH are manually set so the output BINARY_NAME includes them as suffixes.
90131
## Additionally, DOCKER_BUILDKIT is set since it's needed for Docker to populate TARGETOS and TARGETARCH ARGs.
91132
## Here we call $(MAKE) build instead of using a dependency because the latter would, for some reason, prevent
@@ -119,4 +160,4 @@ buildThirdPartyNotice:
119160
rt-update-changelog:
120161
curl "https://raw.githubusercontent.com/newrelic/release-toolkit/v1/contrib/ohi-release-notes/run.sh" | bash -s -- $(filter-out $@,$(MAKECMDGOALS))
121162

122-
.PHONY: all build clean image compile compile-multiarch test buildLicenseNotice
163+
.PHONY: all build clean image compile compile-multiarch compile-multiarch-fips compile-all-multiarch compile-fips-docker-amd64 compile-fips-docker-arm64 test buildLicenseNotice

‎cmd/fips.go‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
// Copyright 2025 New Relic Corporation. All rights reserved.
2+
// SPDX-License-Identifier: Apache-2.0
3+
4+
//go:build fips
5+
// +build fips
6+
7+
package main
8+
9+
import (
10+
_ "crypto/tls/fipsonly"
11+
)

0 commit comments

Comments
 (0)