Skip to content

Commit 3231ccd

Browse files
atoulmeatoulme
authored
Build Windows image for FIPS use cases (#5725)
* add windows fips image * fix trigger * trigger * matrix * more fixes * ci changes * path to windows executable * build directory * fix working directory * wait for fips image to be ready * missing hyphen * fix the latest tag tagging * more multiarch fixes * remove the branch trigger * add changelog
1 parent 9ad1b28 commit 3231ccd

File tree

2 files changed

+162
-9
lines changed

2 files changed

+162
-9
lines changed

‎.gitlab-ci.yml

Lines changed: 161 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1069,16 +1069,161 @@ build-push-windows-image:
10691069
paths:
10701070
- tags_to_sign_${WIN_VERSION}
10711071

1072+
build-push-windows-fips-image:
1073+
extends: .trigger-filter
1074+
stage: release
1075+
parallel:
1076+
matrix:
1077+
- WIN_VERSION: ["2019", "2022"]
1078+
dependencies:
1079+
- sign-exe
1080+
tags:
1081+
- splunk-otel-collector-windows${WIN_VERSION}
1082+
retry: 2
1083+
variables:
1084+
ErrorActionPreference: stop
1085+
before_script:
1086+
- New-Item -Type dir .\cmd\otelcol\fips\dist
1087+
- Copy-Item .\dist\signed\otelcol-fips_windows_amd64.exe .\cmd\otelcol\fips\dist\otelcol-fips_windows_amd64.exe
1088+
- &get-base-image |
1089+
if ($env:WIN_VERSION -eq "2019") {
1090+
$BASE_IMAGE = $env:WIN_2019_BASE_IMAGE
1091+
} else {
1092+
$BASE_IMAGE = $env:WIN_2022_BASE_IMAGE
1093+
}
1094+
- |
1095+
docker pull $BASE_IMAGE
1096+
if ($LASTEXITCODE -ne 0) { exit 1 }
1097+
- &delete-all-images-except-base |
1098+
# Delete all images except the base image
1099+
$base_id = $(docker images -q $BASE_IMAGE)
1100+
foreach ($id in $(docker images -a -q | Get-Unique)) {
1101+
if ($id -ne $base_id) {
1102+
docker rmi -f $id
1103+
}
1104+
}
1105+
- docker system prune --force
1106+
script:
1107+
- |
1108+
docker login -u $env:CIRCLECI_QUAY_USERNAME -p $env:CIRCLECI_QUAY_PASSWORD quay.io
1109+
if ($LASTEXITCODE -ne 0) { exit 1 }
1110+
- |
1111+
# Set env vars
1112+
if ($env:CI_COMMIT_TAG) {
1113+
$IMAGE_NAME = "quay.io/signalfx/splunk-otel-collector-fips"
1114+
$OLD_IMAGE_NAME = "quay.io/signalfx/splunk-otel-collector-fips-windows"
1115+
$tagNumber = $env:CI_COMMIT_TAG.TrimStart("v")
1116+
$IMAGE_TAG = "${tagNumber}-${env:WIN_VERSION}"
1117+
} else {
1118+
$IMAGE_NAME = "quay.io/signalfx/splunk-otel-collector-fips-dev"
1119+
$OLD_IMAGE_NAME = "quay.io/signalfx/splunk-otel-collector-fips-windows-dev"
1120+
$IMAGE_TAG = "${env:CI_COMMIT_SHA}-${env:WIN_VERSION}"
1121+
}
1122+
$LATEST_TAG = ""
1123+
if ($env:CI_COMMIT_BRANCH -eq "main" -or $env:CI_COMMIT_TAG -match '^v\d+\.\d+\.\d+$') {
1124+
# Only push latest tag for main and stable releases
1125+
$LATEST_TAG = "latest-${env:WIN_VERSION}"
1126+
}
1127+
- $JMX_METRIC_GATHERER_RELEASE = $(Get-Content packaging\jmx-metric-gatherer-release.txt)
1128+
- |
1129+
echo "Building ${IMAGE_NAME}:${IMAGE_TAG}"
1130+
docker build -t ${IMAGE_NAME}:${IMAGE_TAG} --build-arg BASE_IMAGE=${BASE_IMAGE} --build-arg JMX_METRIC_GATHERER_RELEASE=${JMX_METRIC_GATHERER_RELEASE} -f .\cmd\otelcol\fips\Dockerfile.windows .\cmd\otelcol\fips
1131+
if ($LASTEXITCODE -ne 0) { exit 1 }
1132+
- |
1133+
echo "Pushing ${IMAGE_NAME}:${IMAGE_TAG}"
1134+
docker push ${IMAGE_NAME}:${IMAGE_TAG}
1135+
if ($LASTEXITCODE -ne 0) { exit 1 }
1136+
- |
1137+
# DEPRECATED: Push image to the windows repo
1138+
echo "Tagging and pushing ${OLD_IMAGE_NAME}:${IMAGE_TAG}"
1139+
docker tag ${IMAGE_NAME}:${IMAGE_TAG} ${OLD_IMAGE_NAME}:${IMAGE_TAG}
1140+
if ($LASTEXITCODE -ne 0) { exit 1 }
1141+
docker push ${OLD_IMAGE_NAME}:${IMAGE_TAG}
1142+
if ($LASTEXITCODE -ne 0) { exit 1 }
1143+
- |
1144+
echo "Getting os.version from ${BASE_IMAGE}"
1145+
$os_version = (docker manifest inspect $BASE_IMAGE | ConvertFrom-Json).manifests[0].platform."os.version"
1146+
if ($LASTEXITCODE -ne 0) { exit 1 }
1147+
echo "$os_version"
1148+
- |
1149+
echo "Creating and pushing ${IMAGE_NAME}:${IMAGE_TAG} manifest"
1150+
docker manifest rm ${IMAGE_NAME}:${IMAGE_TAG}
1151+
docker manifest create ${IMAGE_NAME}:${IMAGE_TAG} ${IMAGE_NAME}:${IMAGE_TAG}
1152+
if ($LASTEXITCODE -ne 0) { exit 1 }
1153+
docker manifest annotate --os "windows" --arch "amd64" --os-version ${os_version} ${IMAGE_NAME}:${IMAGE_TAG} ${IMAGE_NAME}:${IMAGE_TAG}
1154+
if ($LASTEXITCODE -ne 0) { exit 1 }
1155+
docker manifest push ${IMAGE_NAME}:${IMAGE_TAG} --purge
1156+
if ($LASTEXITCODE -ne 0) { exit 1 }
1157+
- |
1158+
# DEPRECATED: Push manifest to the windows repo
1159+
echo "Creating and pushing ${OLD_IMAGE_NAME}:${IMAGE_TAG} manifest"
1160+
docker manifest rm ${OLD_IMAGE_NAME}:${IMAGE_TAG}
1161+
docker manifest create ${OLD_IMAGE_NAME}:${IMAGE_TAG} ${OLD_IMAGE_NAME}:${IMAGE_TAG}
1162+
if ($LASTEXITCODE -ne 0) { exit 1 }
1163+
docker manifest annotate --os "windows" --arch "amd64" --os-version ${os_version} ${OLD_IMAGE_NAME}:${IMAGE_TAG} ${OLD_IMAGE_NAME}:${IMAGE_TAG}
1164+
if ($LASTEXITCODE -ne 0) { exit 1 }
1165+
docker manifest push ${OLD_IMAGE_NAME}:${IMAGE_TAG} --purge
1166+
if ($LASTEXITCODE -ne 0) { exit 1 }
1167+
- |
1168+
if ($LATEST_TAG) {
1169+
echo "Tagging and pushing ${IMAGE_NAME}:${LATEST_TAG}"
1170+
docker tag ${IMAGE_NAME}:${IMAGE_TAG} ${IMAGE_NAME}:${LATEST_TAG}
1171+
if ($LASTEXITCODE -ne 0) { exit 1 }
1172+
docker push ${IMAGE_NAME}:${LATEST_TAG}
1173+
if ($LASTEXITCODE -ne 0) { exit 1 }
1174+
echo "Creating and pushing ${IMAGE_NAME}:${LATEST_TAG} manifest"
1175+
docker manifest rm ${IMAGE_NAME}:${LATEST_TAG}
1176+
docker manifest create ${IMAGE_NAME}:${LATEST_TAG} ${IMAGE_NAME}:${LATEST_TAG}
1177+
if ($LASTEXITCODE -ne 0) { exit 1 }
1178+
docker manifest annotate --os "windows" --arch "amd64" --os-version ${os_version} ${IMAGE_NAME}:${LATEST_TAG} ${IMAGE_NAME}:${LATEST_TAG}
1179+
if ($LASTEXITCODE -ne 0) { exit 1 }
1180+
docker manifest push ${IMAGE_NAME}:${LATEST_TAG} --purge
1181+
if ($LASTEXITCODE -ne 0) { exit 1 }
1182+
}
1183+
- |
1184+
# DEPRECATED: Push latest tag to the windows repo
1185+
if ($LATEST_TAG) {
1186+
echo "Tagging and pushing ${OLD_IMAGE_NAME}:${LATEST_TAG}"
1187+
docker tag ${OLD_IMAGE_NAME}:${IMAGE_TAG} ${OLD_IMAGE_NAME}:${LATEST_TAG}
1188+
if ($LASTEXITCODE -ne 0) { exit 1 }
1189+
docker push ${OLD_IMAGE_NAME}:${LATEST_TAG}
1190+
if ($LASTEXITCODE -ne 0) { exit 1 }
1191+
echo "Creating and pushing ${OLD_IMAGE_NAME}:${LATEST_TAG} manifest"
1192+
docker manifest rm ${OLD_IMAGE_NAME}:${LATEST_TAG}
1193+
docker manifest create ${OLD_IMAGE_NAME}:${LATEST_TAG} ${OLD_IMAGE_NAME}:${LATEST_TAG}
1194+
if ($LASTEXITCODE -ne 0) { exit 1 }
1195+
docker manifest annotate --os "windows" --arch "amd64" --os-version ${os_version} ${OLD_IMAGE_NAME}:${LATEST_TAG} ${OLD_IMAGE_NAME}:${LATEST_TAG}
1196+
if ($LASTEXITCODE -ne 0) { exit 1 }
1197+
docker manifest push ${OLD_IMAGE_NAME}:${LATEST_TAG} --purge
1198+
if ($LASTEXITCODE -ne 0) { exit 1 }
1199+
}
1200+
- echo "${IMAGE_NAME}:${IMAGE_TAG}" > tags
1201+
- echo "${OLD_IMAGE_NAME}:${IMAGE_TAG}" >> tags
1202+
- (Get-Content -Raw -Path tags) -replace "`r`n", "`n"| Set-Content -NoNewline tags_to_sign_${env:WIN_VERSION}-fips
1203+
after_script:
1204+
- *get-base-image
1205+
- *delete-all-images-except-base
1206+
- docker system prune --force
1207+
- |
1208+
if (Test-Path -Path C:\Users\Administrator\Desktop\ops-scripts\docker-leak-check.exe) {
1209+
C:\Users\Administrator\Desktop\ops-scripts\docker-leak-check.exe -remove
1210+
}
1211+
artifacts:
1212+
paths:
1213+
- tags_to_sign_${WIN_VERSION}-fips
1214+
10721215
sign-windows-image:
10731216
extends: .sign-docker
10741217
stage: release
10751218
parallel:
10761219
matrix:
10771220
- WIN_VERSION: ["2019", "2022"]
1221+
FIPS: ["-fips", ""]
10781222
needs:
10791223
- build-push-windows-image
1224+
- build-push-windows-fips-image
10801225
before_script:
1081-
- mv tags_to_sign_${WIN_VERSION} tags_to_sign
1226+
- mv tags_to_sign_${WIN_VERSION}${FIPS} tags_to_sign
10821227

10831228
release-debs:
10841229
extends:
@@ -1244,6 +1389,7 @@ push-multiarch-manifest:
12441389
parallel:
12451390
matrix:
12461391
- MANIFEST: [multiarch, windows_multiarch]
1392+
FIPS: ["-fips",""]
12471393
needs:
12481394
- sign-linux-image
12491395
- sign-windows-image
@@ -1256,12 +1402,12 @@ push-multiarch-manifest:
12561402
- |
12571403
# Set env vars
12581404
if [[ -n "${CI_COMMIT_TAG:-}" ]]; then
1259-
MANIFEST_NAME="quay.io/signalfx/splunk-otel-collector"
1260-
WIN_MANIFEST_NAME="quay.io/signalfx/splunk-otel-collector-windows"
1405+
MANIFEST_NAME="quay.io/signalfx/splunk-otel-collector${FIPS}"
1406+
WIN_MANIFEST_NAME="quay.io/signalfx/splunk-otel-collector${FIPS}-windows"
12611407
MANIFEST_TAG=${CI_COMMIT_TAG#v}
12621408
else
1263-
MANIFEST_NAME="quay.io/signalfx/splunk-otel-collector-dev"
1264-
WIN_MANIFEST_NAME="quay.io/signalfx/splunk-otel-collector-windows-dev"
1409+
MANIFEST_NAME="quay.io/signalfx/splunk-otel-collector${FIPS}-dev"
1410+
WIN_MANIFEST_NAME="quay.io/signalfx/splunk-otel-collector${FIPS}-windows-dev"
12651411
MANIFEST_TAG=${CI_COMMIT_SHA}
12661412
fi
12671413
LATEST_TAG=""
@@ -1303,14 +1449,19 @@ push-multiarch-manifest:
13031449
echo "$json"
13041450
# Check number of images in the manifest
13051451
count=$( echo "$json" | jq -r ".manifests | length" )
1306-
if [[ "$MANIFEST" = "multiarch" && $count -ne 5 ]]; then
1452+
if [[ "$MANIFEST" = "multiarch" && "$FIPS" == "" && $count -ne 5 ]]; then
1453+
exit 1
1454+
elif [[ "$MANIFEST" = "multiarch" && "$FIPS" == "-fips" && $count -ne 4 ]]; then
13071455
exit 1
13081456
elif [[ "$MANIFEST" = "windows_multiarch" && $count -ne 2 ]]; then
13091457
exit 1
13101458
fi
13111459
# Check the manifest for the linux images
13121460
if [[ "$MANIFEST" != "windows_multiarch" ]]; then
13131461
for arch in "amd64" "arm64" "ppc64le"; do
1462+
if [[ "$FIPS" != "" && "$arch" == "ppc64le" ]]; then
1463+
continue
1464+
fi
13141465
found=$( echo "$json" | jq -r ".manifests[] | select(.platform.architecture == \"${arch}\" and .platform.os == \"linux\")" )
13151466
if [[ -z "$found" ]]; then
13161467
echo "linux/${arch} not found in ${MANIFEST_NAME}:${tag}"
@@ -1342,7 +1493,7 @@ push-multiarch-manifest:
13421493
fi
13431494
- mkdir -p dist
13441495
- echo "[${MANIFEST_NAME}@${digest}]" | tee dist/${MANIFEST}_digest.txt
1345-
- echo "${MANIFEST_NAME}:${MANIFEST_TAG}" > tags_to_sign_${MANIFEST}
1496+
- echo "${MANIFEST_NAME}:${MANIFEST_TAG}" > tags_to_sign_${MANIFEST}${FIPS}
13461497
- if [[ "$CI_COMMIT_BRANCH" != "main" || "$MANIFEST" != "multiarch" ]]; then exit 0; fi
13471498
# Push the multiarch manifest for the main branch to the docker-test artifactory repo for xray scanning
13481499
# TODO: Add new job to trigger xray scanning for the manifest whenever it is supported
@@ -1354,18 +1505,19 @@ push-multiarch-manifest:
13541505
artifacts:
13551506
paths:
13561507
- dist/${MANIFEST}_digest.txt
1357-
- tags_to_sign_${MANIFEST}
1508+
- tags_to_sign_${MANIFEST}${FIPS}
13581509

13591510
sign-multiarch-manifest:
13601511
extends: .sign-docker
13611512
stage: docker-manifest-release
13621513
parallel:
13631514
matrix:
13641515
- MANIFEST: [multiarch, windows_multiarch]
1516+
FIPS: ["-fips",""]
13651517
needs:
13661518
- push-multiarch-manifest
13671519
before_script:
1368-
- mv tags_to_sign_${MANIFEST} tags_to_sign
1520+
- mv tags_to_sign_${MANIFEST}${FIPS} tags_to_sign
13691521

13701522
xray-scan-docker:
13711523
only:

‎CHANGELOG.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,7 @@
3838
port: 8888
3939
```
4040
This also removes a warning about deprecated `service::telemetry::metrics::address`.
41+
- (Splunk) Publish a FIPS-140 compliant Docker [images](https://quay.io/repository/signalfx/splunk-otel-collector-fips?tab=tags) and binaries for Linux and Windows. ([#5725](https://github.com/signalfx/splunk-otel-collector/pull/5725))
4142
- (Core) `exporterqueue`: Introduce a feature gate exporter.UsePullingBasedExporterQueueBatcher to use the new pulling model in exporter queue batching. ([#8122](https://github.com/open-telemetry/opentelemetry-collector/pull/8122), [#10368](https://github.com/open-telemetry/opentelemetry-collector/pull/10368))
4243
If both queuing and batching is enabled for exporter, we now use a pulling model instead of a
4344
pushing model. num_consumer in queue configuration is now used to specify the maximum number of

0 commit comments

Comments
 (0)