Skip to content

USHIFT-2464: scan FIPS on container images #3110

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
openshift-merge-bot merged 1 commit into from
Mar 8, 2024
Merged

USHIFT-2464: scan FIPS on container images #3110

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions test/image-blueprints/layer3-periodic/group1/rhel92-source-isolated.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,10 @@ version = "{{ .Env.SOURCE_VERSION }}"
name = "microshift-test-agent"
version = "*"

[[packages]]
name = "microshift-release-info"
version = "*"

[[packages]]
name = "qemu-guest-agent"
version = "*"
Expand Down
39 changes: 36 additions & 3 deletions test/suites/fips/validate-fips.robot
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@ ${USHIFT_USER} ${EMPTY}
${USHIFT_LIBS_DUMP_FILE} /tmp/microshift-libs
${FIPS_PATTERN} ossl-modules/fips.so$
${CHECK_PAYLOAD_IMAGE} registry.ci.openshift.org/ci/check-payload:latest
${PULL_SECRET_PATH} /etc/crio/openshift-pull-secret


*** Test Cases ***
Expand All @@ -32,15 +33,19 @@ Verify Node RPMs FIPS Compliant
[Documentation] Performs a FIPS validation against the Installed RPMs
Check Payload Tool Must Pass

Verify Container Images FIPS Compliant
[Documentation] Performs a FIPS validation against the Released payload
Check Container Images In Release Must Pass


*** Keywords ***
Setup
[Documentation] Test suite setup
Check Required Env Variables
Login MicroShift Host
Setup Kubeconfig
Start MicroShift
Wait Until Greenboot Health Check Exited
Stop MicroShift

Teardown
[Documentation] Test suite teardown
Expand All @@ -49,6 +54,8 @@ Teardown
... SSHLibrary.Get File ${USHIFT_LIBS_DUMP_FILE}* ${OUTPUTDIR}/
Run Keyword And Ignore Error
... SSHLibrary.Get File ${CHECK_PAYLOAD_OUTPUT_FILE} ${OUTPUTDIR}/check-payload.log
Run Keyword And Ignore Error
... SSHLibrary.Get File ${CHECK_PAYLOAD_REL_OUTPUT_FILE} ${OUTPUTDIR}/check-release-payload.log
Start MicroShift
Wait For MicroShift
Logout MicroShift Host
Expand All @@ -57,8 +64,7 @@ Check Payload Tool Must Pass
[Documentation] Run check-paylod Tool
${podman_args}= Set Variable --authfile /etc/crio/openshift-pull-secret --privileged -i -v /:/myroot
${scan_command}= Set Variable scan node --root /myroot
${rand}= Generate Random String
${path}= Join Path /tmp ${rand}
${path}= Create Random Temp File
Set Global Variable ${CHECK_PAYLOAD_OUTPUT_FILE} ${path}
${rc}= Execute Command rpm -qi microshift >${CHECK_PAYLOAD_OUTPUT_FILE} 2>&1
... sudo=True return_rc=True return_stdout=False return_stderr=False
Expand All @@ -68,6 +74,22 @@ Check Payload Tool Must Pass
... sudo=True return_rc=True return_stdout=False return_stderr=False
Should Be Equal As Integers 0 ${rc}

Check Container Images In Release Must Pass
[Documentation] Run check-paylod Tool for Release containers
${podman_pull_secret}= Set Variable /root/.config/containers/auth.json
${podman_mounts}= Set Variable -v ${PULL_SECRET_PATH}:${podman_pull_secret}
${podman_args}= Set Variable --rm --authfile ${PULL_SECRET_PATH} --privileged ${podman_mounts}
${path}= Create Random Temp File
Set Global Variable ${CHECK_PAYLOAD_REL_OUTPUT_FILE} ${path}
@{images}= Get Images From Release File
FOR ${image} IN @{images}
${scan_command}= Set Variable scan operator --spec ${image}
${rc}= Execute Command
... podman run ${podman_args} ${CHECK_PAYLOAD_IMAGE} ${scan_command} >>${CHECK_PAYLOAD_REL_OUTPUT_FILE} 2>&1
... sudo=True return_rc=True return_stdout=False return_stderr=False
Should Be Equal As Integers 0 ${rc}
END

Microshift Binary Should Dynamically Link FIPS Ossl Module
[Documentation] Check if Microshift binary is FIPS compliant.
${stdout} ${stderr} ${rc}= Execute Command
Expand All @@ -86,3 +108,14 @@ Fips Should Be Enabled
... sudo=True return_rc=True return_stdout=True return_stderr=True
Should Be Equal As Integers 0 ${rc}
Should Match ${stdout} FIPS mode is enabled.

Get Images From Release File
[Documentation] Obtains list of Images from Release.
${stdout} ${stderr} ${rc}= Execute Command
... jq -r '.images | .[]' /usr/share/microshift/release/release-$(uname -m).json
... return_stdout=True return_stderr=True return_rc=True
Should Be Equal As Integers 0 ${rc}
Log Many ${stdout} ${stderr} ${rc}

@{images}= Split String ${stdout} \n
RETURN @{images}