Skip to content

Commit 21736d1

Browse files
davidsandilandsdavidsandilands
authored
Merge pull request #280 from ody/install_fips
Support the installation of PE on FIPS enabled RHEL
2 parents 4c6d32d + bb14e7c commit 21736d1

File tree

4 files changed

+169
-4
lines changed

4 files changed

+169
-4
lines changed

Diff for: ‎.fixtures.yml

+1
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ fixtures:
44
ruby_task_helper: "puppetlabs/ruby_task_helper"
55
service: "puppetlabs/service"
66
package: "puppetlabs/package"
7+
reboot: "puppetlabs/reboot"
78
repositories:
89
facts: 'https://github.com/puppetlabs/puppetlabs-facts.git'
910
puppet_agent: 'https://github.com/puppetlabs/puppetlabs-puppet_agent.git'

Diff for: ‎.github/workflows/test-fips-install-matrix.yaml

+152
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,152 @@
1+
---
2+
name: "Install fips test matrix"
3+
4+
on:
5+
pull_request:
6+
branches: [main]
7+
types: [review_requested]
8+
workflow_dispatch: {}
9+
10+
env:
11+
HONEYCOMB_WRITEKEY: 7f3c63a70eecc61d635917de46bea4e6
12+
HONEYCOMB_DATASET: litmus tests
13+
14+
jobs:
15+
test-install:
16+
name: "PE ${{ matrix.version }} ${{ matrix.architecture }} on ${{ matrix.image }} with fips ${{ matrix.fips }}"
17+
runs-on: ubuntu-20.04
18+
env:
19+
BOLT_GEM: true
20+
BOLT_DISABLE_ANALYTICS: true
21+
BUILDEVENT_FILE: '../buildevents.txt'
22+
LANG: 'en_US.UTF-8'
23+
strategy:
24+
fail-fast: false
25+
matrix:
26+
architecture:
27+
- standard-with-dr
28+
- large
29+
- extra-large-with-dr
30+
version:
31+
- 2019.8.11
32+
- 2021.6.0
33+
image:
34+
- rhel-8
35+
fips:
36+
- enable
37+
38+
steps:
39+
- name: "Honeycomb: Start recording"
40+
uses: puppetlabs/kvrhdn-gha-buildevents@pdk-templates-v1
41+
with:
42+
apikey: ${{ env.HONEYCOMB_WRITEKEY }}
43+
dataset: ${{ env.HONEYCOMB_DATASET }}
44+
job-status: ${{ job.status }}
45+
46+
- name: "Honeycomb: Start first step"
47+
run: |
48+
echo STEP_ID=setup-test-cluster >> $GITHUB_ENV
49+
echo STEP_START=$(date +%s) >> $GITHUB_ENV
50+
51+
- name: "Checkout Source"
52+
uses: actions/checkout@v2
53+
54+
- name: "Activate Ruby 2.7"
55+
uses: ruby/setup-ruby@v1
56+
with:
57+
ruby-version: "2.7"
58+
bundler-cache: true
59+
60+
- name: "Print bundle environment"
61+
if: ${{ github.repository_owner == 'puppetlabs' }}
62+
run: |
63+
echo ::group::info:bundler
64+
buildevents cmd $TRACE_ID $STEP_ID 'bundle env' -- bundle env
65+
echo ::endgroup::
66+
67+
- name: "Honeycomb: Record environment setup time"
68+
if: ${{ always() }}
69+
run: |
70+
echo ::group::honeycomb
71+
buildevents step $TRACE_ID $STEP_ID $STEP_START 'Set up environment'
72+
echo STEP_ID=${{ matrix.architecture }}-${{ matrix.image }}-fips_${{ matrix.fips }}-provision >> $GITHUB_ENV
73+
echo STEP_START=$(date +%s) >> $GITHUB_ENV
74+
echo ::endgroup::
75+
76+
- name: 'Provision test cluster'
77+
timeout-minutes: 15
78+
run: |
79+
echo ::group::prepare
80+
mkdir -p $HOME/.ssh
81+
echo 'Host *' > $HOME/.ssh/config
82+
echo ' ServerAliveInterval 150' >> $HOME/.ssh/config
83+
echo ' ServerAliveCountMax 2' >> $HOME/.ssh/config
84+
buildevents cmd $TRACE_ID $STEP_ID 'rake spec_prep' -- bundle exec rake spec_prep
85+
echo ::endgroup::
86+
87+
echo ::group::provision
88+
buildevents cmd $TRACE_ID $STEP_ID 'bolt plan run peadm_spec::provision_test_cluster' -- \
89+
bundle exec bolt plan run peadm_spec::provision_test_cluster \
90+
--modulepath spec/fixtures/modules \
91+
provider=provision_service \
92+
image=${{ matrix.image }} \
93+
architecture=${{ matrix.architecture }}
94+
echo ::endgroup::
95+
96+
echo ::group::info:request
97+
cat request.json || true; echo
98+
echo ::endgroup::
99+
100+
echo ::group::info:inventory
101+
sed -e 's/password: .*/password: "[redacted]"/' < spec/fixtures/litmus_inventory.yaml || true
102+
echo ::endgroup::
103+
104+
- name: "Honeycomb: Record provision time"
105+
if: ${{ always() }}
106+
run: |
107+
echo ::group::honeycomb
108+
buildevents step $TRACE_ID $STEP_ID $STEP_START 'Provision test cluster'
109+
echo STEP_ID=${{ matrix.architecture }}-${{ matrix.image }}-fips_${{ matrix.fips }}-install >> $GITHUB_ENV
110+
echo STEP_START=$(date +%s) >> $GITHUB_ENV
111+
echo ::endgroup::
112+
113+
- name: 'Install PE on test cluster'
114+
timeout-minutes: 120
115+
run: |
116+
buildevents cmd $TRACE_ID $STEP_ID 'bolt plan run peadm_spec::install_test_cluster' -- \
117+
bundle exec bolt plan run peadm_spec::install_test_cluster \
118+
--inventoryfile spec/fixtures/litmus_inventory.yaml \
119+
--modulepath spec/fixtures/modules \
120+
architecture=${{ matrix.architecture }} \
121+
version=${{ matrix.version }} \
122+
fips=${{ matrix.fips }}
123+
124+
- name: "Honeycomb: Record install time"
125+
if: ${{ always() }}
126+
run: |
127+
echo ::group::honeycomb
128+
buildevents step $TRACE_ID $STEP_ID $STEP_START 'Install PE on test cluster'
129+
echo STEP_ID=${{ matrix.architecture }}-${{ matrix.image }}-fips_${{ matrix.fips }}-tear_down >> $GITHUB_ENV
130+
echo STEP_START=$(date +%s) >> $GITHUB_ENV
131+
echo ::endgroup::
132+
133+
- name: 'Tear down test cluster'
134+
if: ${{ always() }}
135+
continue-on-error: true
136+
run: |
137+
if [ -f spec/fixtures/litmus_inventory.yaml ]; then
138+
echo ::group::tear_down
139+
buildevents cmd $TRACE_ID $STEP_ID 'rake litmus:tear_down' -- bundle exec rake 'litmus:tear_down'
140+
echo ::endgroup::
141+
142+
echo ::group::info:request
143+
cat request.json || true; echo
144+
echo ::endgroup::
145+
fi
146+
147+
- name: "Honeycomb: Record tear down time"
148+
if: ${{ always() }}
149+
run: |
150+
echo ::group::honeycomb
151+
buildevents step $TRACE_ID $STEP_ID $STEP_START 'Tear down test cluster'
152+
echo ::endgroup::

Diff for: ‎spec/acceptance/peadm_spec/plans/install_test_cluster.pp

+12-2
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
plan peadm_spec::install_test_cluster (
2-
$architecture,
3-
$version,
2+
String[1] $architecture,
3+
String[1] $version,
4+
Enum['enable', 'disable'] $fips = 'disable'
45
) {
56

67
$t = get_targets('*')
@@ -11,6 +12,15 @@
1112
$target.set_var('certname', $fqdn.first['stdout'].chomp)
1213
}
1314

15+
if $fips == 'enable' {
16+
run_command('/bin/fips-mode-setup --enable', $t)
17+
run_plan('reboot', $t)
18+
$fips_status = run_command('/bin/fips-mode-setup --check', $t)
19+
$fips_status.each |$status| {
20+
out::message("${status.target.name}: ${status.value['stdout']}")
21+
}
22+
}
23+
1424
$common_params = {
1525
console_password => 'puppetlabs',
1626
download_mode => 'direct',

Diff for: ‎tasks/precheck.sh

+4-2
Original file line numberDiff line numberDiff line change
@@ -7,18 +7,20 @@ if grep -qi ubuntu /etc/os-release; then
77
osfamily="ubuntu"
88
elif grep -qi sles /etc/os-release; then
99
osfamily="sles"
10+
elif grep -qi redhat /etc/os-release && fips-mode-setup --is-enabled; then
11+
osfamily="redhatfips"
1012
else
1113
osfamily="el"
1214
fi
1315

1416
# OS-specific modifications
1517
[ "$osfamily" = "ubuntu" -a "$arch" = "x86_64" ] && arch="amd64"
16-
[ "$osfamily" = "el" ] || [ "$osfamily" = "sles" ] && version=$(echo "$version" | cut -d . -f 1)
18+
[ "$osfamily" = "el" ] || [ "$osfamily" = "sles" ] || [ "$osfamily" = "redhatfips" ] && version=$(echo "$version" | cut -d . -f 1)
1719

1820
# Output a JSON result for ease of Task usage in Puppet Task Plans
1921
cat <<EOS
2022
{
2123
"hostname": "${hostname}",
2224
"platform": "${osfamily}-${version}-${arch}"
2325
}
24-
EOS
26+
EOS

0 commit comments

Comments
 (0)