Skip to content

Commit 9d6f0f2

Browse files
openshift-merge-robotopenshift-merge-robot
authored
Merge pull request #436 from supreeth7/fips
Feat: Ensure FIPS compliance
2 parents acff74b + 7fe4e7d commit 9d6f0f2

12 files changed

Lines changed: 45 additions & 59 deletions

‎.ci-operator.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
11
build_root_image:
2-
name: release
3-
namespace: openshift
4-
tag: rhel-8-release-golang-1.19-openshift-4.12
2+
name: builder
3+
namespace: ocp
4+
tag: rhel-8-golang-1.20-openshift-4.14

‎Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ GOLANGCI_LINT_VERSION:=v1.43.0
1111
OPM_VERSION:=v1.24.0
1212

1313
# Build Flags
14-
export CGO_ENABLED:=0
14+
export CGO_ENABLED:=1
1515
BRANCH=$(shell git rev-parse --abbrev-ref HEAD)
1616
SHORT_SHA=$(shell git rev-parse --short HEAD)
1717
VERSION?=${SHORT_SHA}

‎apis/go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
module github.com/openshift/addon-operator/apis
22

3-
go 1.19
3+
go 1.20
44

55
require (
66
github.com/rhobs/obo-prometheus-operator/pkg/apis/monitoring v0.61.1-rhobs1

‎config/docker/Dockerfile.src.ci‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1-
FROM src
1+
FROM registry.access.redhat.com/ubi8/ubi-minimal:8.8-1037
2+
23
RUN yum update -y && yum install -y python3 python3-pip
4+
35
RUN pip3 install pre-commit

‎config/docker/addon-operator-bundle.Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM scratch
1+
FROM registry.access.redhat.com/ubi8/ubi-minimal:8.8-1037
22

33
LABEL operators.operatorframework.io.bundle.mediatype.v1=registry+v1
44
LABEL operators.operatorframework.io.bundle.manifests.v1=manifests/

‎config/docker/addon-operator-manager.Dockerfile‎

Lines changed: 6 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,14 @@
1-
FROM registry.access.redhat.com/ubi8/ubi-minimal:8.8-1014
2-
3-
# shadow-utils contains adduser and groupadd binaries
4-
RUN microdnf install shadow-utils \
5-
&& groupadd --gid 1000 noroot \
6-
&& adduser \
7-
--no-create-home \
8-
--no-user-group \
9-
--uid 1000 \
10-
--gid 1000 \
11-
noroot
1+
FROM registry.access.redhat.com/ubi8/ubi-minimal:8.8-1037
122

133
WORKDIR /
144

155
COPY addon-operator-manager /usr/local/bin/
166

177
USER 1001
188

9+
ENV CGO_ENABLED=1
10+
11+
# force the binary to behave as if FIPS mode were enabled.
12+
ENV OPENSSL_FORCE_FIPS_MODE=1
13+
1914
ENTRYPOINT ["/usr/local/bin/addon-operator-manager"]

‎config/docker/addon-operator-webhook.Dockerfile‎

Lines changed: 6 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,14 @@
1-
FROM registry.access.redhat.com/ubi8/ubi-minimal:8.8-1014
2-
3-
# shadow-utils contains adduser and groupadd binaries
4-
RUN microdnf install shadow-utils \
5-
&& groupadd --gid 1000 noroot \
6-
&& adduser \
7-
--no-create-home \
8-
--no-user-group \
9-
--uid 1000 \
10-
--gid 1000 \
11-
noroot
1+
FROM registry.access.redhat.com/ubi8/ubi-minimal:8.8-1037
122

133
WORKDIR /
144

155
COPY addon-operator-webhook /usr/local/bin/
166

177
USER 1001
188

9+
ENV CGO_ENABLED=1
10+
11+
# force the binary to behave as if FIPS mode were enabled.
12+
ENV OPENSSL_FORCE_FIPS_MODE=1
13+
1914
ENTRYPOINT ["/usr/local/bin/addon-operator-webhook"]

‎config/docker/api-mock.Dockerfile‎

Lines changed: 6 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,14 @@
1-
FROM registry.access.redhat.com/ubi8/ubi-minimal:8.8-1014
2-
3-
# shadow-utils contains adduser and groupadd binaries
4-
RUN microdnf install shadow-utils \
5-
&& groupadd --gid 1000 noroot \
6-
&& adduser \
7-
--no-create-home \
8-
--no-user-group \
9-
--uid 1000 \
10-
--gid 1000 \
11-
noroot
1+
FROM registry.access.redhat.com/ubi8/ubi-minimal:8.8-1037
122

133
WORKDIR /
144

155
COPY api-mock /usr/local/bin/
166

177
USER 1001
188

9+
ENV CGO_ENABLED=1
10+
11+
# force the binary to behave as if FIPS mode were enabled.
12+
ENV OPENSSL_FORCE_FIPS_MODE=1
13+
1914
ENTRYPOINT ["/usr/local/bin/api-mock"]

‎config/docker/app-interface-push-images.Dockerfile‎

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
1-
FROM quay.io/podman/stable
1+
FROM registry.access.redhat.com/ubi8/ubi-minimal:8.8-1037
22

3-
RUN yum install -y \
4-
python3-pip make ncurses git && \
5-
pip3 install pre-commit && \
6-
curl -L --fail https://go.dev/dl/go1.19.7.linux-amd64.tar.gz > /tmp/go.tar.gz && \
7-
rm -rf /usr/local/go && tar -C /usr/local -xzf /tmp/go.tar.gz
3+
# Install go1.20.6
4+
RUN dnf install -y \
5+
http://download.eng.bos.redhat.com/brewroot/vol/rhel-8/packages/golang/1.20.6/1.module+el8.9.0+19500+fa91430b/x86_64/golang-1.20.6-1.module+el8.9.0+19500+fa91430b.x86_64.rpm \
6+
http://download.eng.bos.redhat.com/brewroot/vol/rhel-8/packages/golang/1.20.6/1.module+el8.9.0+19500+fa91430b/x86_64/golang-bin-1.20.6-1.module+el8.9.0+19500+fa91430b.x86_64.rpm \
7+
http://download.eng.bos.redhat.com/brewroot/vol/rhel-8/packages/golang/1.20.6/1.module+el8.9.0+19500+fa91430b/noarch/golang-src-1.20.6-1.module+el8.9.0+19500+fa91430b.noarch.rpm \
8+
python3-pip make ncurses git podman gcc && \
9+
pip3 install pre-commit
810

911
ENV PATH="/usr/local/go/bin:${PATH}"
1012

13+
ENV CGO_ENABLED=1
14+
1115
WORKDIR /workdir
1216

1317
COPY . .

‎config/docker/prometheus-remote-storage-mock.Dockerfile‎

Lines changed: 6 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,14 @@
1-
FROM registry.access.redhat.com/ubi8/ubi-minimal:8.8-1014
2-
3-
# shadow-utils contains adduser and groupadd binaries
4-
RUN microdnf install shadow-utils \
5-
&& groupadd --gid 1000 noroot \
6-
&& adduser \
7-
--no-create-home \
8-
--no-user-group \
9-
--uid 1000 \
10-
--gid 1000 \
11-
noroot
1+
FROM registry.access.redhat.com/ubi8/ubi-minimal:8.8-1037
122

133
WORKDIR /
144

155
COPY prometheus-remote-storage-mock /usr/local/bin/
166

177
USER 1001
188

9+
ENV CGO_ENABLED=1
10+
11+
# force the binary to behave as if FIPS mode were enabled.
12+
ENV OPENSSL_FORCE_FIPS_MODE=1
13+
1914
ENTRYPOINT ["/usr/local/bin/prometheus-remote-storage-mock"]

0 commit comments

Comments
 (0)