Repository navigation
feat: add Azure Container Linux CVM FIPS image - #9777
Conversation
Windows Unit Test Results 3 files 18 suites 1m 7s ⏱️ Results for commit f7d9dae. ♻️ This comment has been updated with latest results. |
Register the dedicated ACL CVM FIPS distro and SIG definition, and add a release job that builds the CVM image with FIPS enabled. Co-authored-by: Ankita Pareek <56152556+Ankita13-code@users.noreply.github.com> Signed-off-by: Aadhar Agarwal <aadagarwal@microsoft.com>
Signed-off-by: Aadhar Agarwal <aadagarwal@microsoft.com>
7aae2c9 to
6d0785a
Compare
|
There was a problem hiding this comment.
🔵 Needs a closer look
The security-sensitive CVM/FIPS combination needs human review of a successful image build, Confidential VM boot, and FIPS validation.
No open issues 🎉
What changed in this PR
Adds an Azure Container Linux Confidential VM (CVM) FIPS image option to AgentBaker’s distro catalog and VHD release pipeline.
Changes:
- Registers
aks-acl-cvm-gen2-fipsand itsaclgen2fipsCVMimage definition, excluding it from the maintained-image map until first publication. - Adds an opt-in x64 release job using the CVM build path with FIPS enabled.
- Extends distro classification, image configuration, and API tests.
| File | Description |
|---|---|
pkg/agent/datamodel/types.go |
Declares and registers the new distro. |
pkg/agent/datamodel/types_test.go |
Tests ACL classification for the new distro. |
pkg/agent/datamodel/sig_config.go |
Adds image mapping, capability lists, and publication skip. |
pkg/agent/datamodel/sig_config_test.go |
Updates image configuration expectations. |
pkg/agent/bakerapi_test.go |
Includes the distro in API test coverage. |
.pipelines/.vsts-vhd-builder-release.yaml |
Adds the optional x64 CVM FIPS build job. |
Review effort: Balanced
Parameterize the CVM FIPS job source gallery, image definition, and version so ACL validation runs use the selected release instead of a stale hardcoded image. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
|
|
|
P0 request: this image-path change needs to merge by October 26. @Azure/agentbakeradmin Sylvain Boily (@djsly) Cameron Meissner (@cameronmeissner), could you please review the ACL CVM + FIPS distro/SIG/pipeline wiring? The only failing required check is |
What type of PR is this?
/area agentbaker
/area vhd
/kind feature
What this PR does / why we need it
Adds the dedicated
aks-acl-cvm-gen2-fipsdistro andaclgen2fipsCVMSIG definition. Adds an x64 release job that builds through the ACL CVM path withFEATURE_FLAGS=cvmandENABLE_FIPS=True.The new definition remains excluded from
GetMaintainedLinuxSIGImageConfigMapuntil its first image version is published.Which issue(s) this PR fixes
Part of Azure Container Linux Confidential VM + FIPS enablement.
Requirements
go test ./pkg/agent/datamodel ./pkg/agent)aclgen2fipsCVMimage version published before removing the maintained-map skipThe commit was created through GitHub and has a valid GitHub-verified signature.