diff --git a/.pipelines/.vsts-vhd-builder-release.yaml b/.pipelines/.vsts-vhd-builder-release.yaml index a9a5368938a..8f4fd60cc09 100644 --- a/.pipelines/.vsts-vhd-builder-release.yaml +++ b/.pipelines/.vsts-vhd-builder-release.yaml @@ -141,6 +141,10 @@ parameters: displayName: Build Azure Container Linux CVM Gen2 type: boolean default: true + - name: buildaclcvmfipstlgen2 + displayName: Build Azure Container Linux CVM FIPS Gen2 + type: boolean + default: false - name: buildaclarm64tlgen2 displayName: Build Azure Container Linux ARM64 TL Gen2 type: boolean @@ -153,6 +157,18 @@ parameters: displayName: Build Azure Container Linux ARM64 FIPS TL Gen2 type: boolean default: true + - name: aclSigSourceGallery + displayName: ACL SIG source gallery unique name + type: string + default: 'ae6ab47f-1fc9-4b67-8f82-4636119119c9-ACL' + - name: aclSigSourceImageName + displayName: ACL SIG source image definition (amd64) + type: string + default: 'acl-3.0-amd64' + - name: aclImageVersion + displayName: ACL SIG source image version + type: string + default: '20261016.1226753.0' variables: - name: MODE @@ -945,6 +961,31 @@ stages: useOverrides: ${{ parameters.useOverrides }} overrideBranch: ${{ parameters.overrideBranch }} artifactName: acl-cvm-gen2 + - job: buildaclcvmfipstlgen2 + condition: eq('${{ parameters.buildaclcvmfipstlgen2 }}', true) + dependsOn: [ ] + timeoutInMinutes: 360 + steps: + - bash: | + echo '##vso[task.setvariable variable=OS_SKU]AzureContainerLinux' + echo '##vso[task.setvariable variable=OS_VERSION]acl' + echo '##vso[task.setvariable variable=SIG_SOURCE_GALLERY_UNIQUE_NAME]${{ parameters.aclSigSourceGallery }}' + echo '##vso[task.setvariable variable=SIG_SOURCE_IMAGE_NAME]${{ parameters.aclSigSourceImageName }}' + echo '##vso[task.setvariable variable=SIG_SOURCE_IMAGE_VERSION]${{ parameters.aclImageVersion }}' + echo '##vso[task.setvariable variable=HYPERV_GENERATION]V2' + echo '##vso[task.setvariable variable=AZURE_VM_SIZE]Standard_D4ads_v5' + echo '##vso[task.setvariable variable=CVM_TEST_VM_SIZE]Standard_DC8ads_v5' + echo '##vso[task.setvariable variable=FEATURE_FLAGS]cvm' + echo '##vso[task.setvariable variable=ARCHITECTURE]X86_64' + echo '##vso[task.setvariable variable=ENABLE_FIPS]True' + echo '##vso[task.setvariable variable=ENABLE_TRUSTED_LAUNCH]False' + echo '##vso[task.setvariable variable=ENABLE_CGROUPV2]True' + displayName: Setup Build Variables + - template: ./templates/.builder-release-template.yaml + parameters: + useOverrides: ${{ parameters.useOverrides }} + overrideBranch: ${{ parameters.overrideBranch }} + artifactName: acl-cvm-fips-gen2 - job: buildaclarm64tlgen2 condition: eq('${{ parameters.buildaclarm64tlgen2 }}', true) dependsOn: [ ] diff --git a/pkg/agent/bakerapi_test.go b/pkg/agent/bakerapi_test.go index d1bd44ff392..f1fbaceef1b 100644 --- a/pkg/agent/bakerapi_test.go +++ b/pkg/agent/bakerapi_test.go @@ -483,6 +483,7 @@ var _ = Describe("AgentBaker API implementation tests", func() { datamodel.AKSACLArm64Gen2FIPSTL, datamodel.AKSACLCVMGen2, datamodel.AKSACLKataGen2TL, + datamodel.AKSACLCVMGen2FIPS, } ubuntuEdgeZoneDistros = []datamodel.Distro{ diff --git a/pkg/agent/datamodel/sig_config.go b/pkg/agent/datamodel/sig_config.go index 072a46da419..51058441fa1 100644 --- a/pkg/agent/datamodel/sig_config.go +++ b/pkg/agent/datamodel/sig_config.go @@ -142,6 +142,7 @@ var AvailableContainerdDistros = []Distro{ AKSACLArm64Gen2FIPSTL, AKSACLCVMGen2, AKSACLKataGen2TL, + AKSACLCVMGen2FIPS, AKSCBLMarinerV1, AKSCBLMarinerV2, AKSAzureLinuxV2, @@ -219,6 +220,7 @@ var AvailableGen2Distros = []Distro{ AKSACLArm64Gen2FIPSTL, AKSACLCVMGen2, AKSACLKataGen2TL, + AKSACLCVMGen2FIPS, AKSCBLMarinerV2Gen2, AKSAzureLinuxV2Gen2, AKSAzureLinuxV3Gen2, @@ -335,6 +337,7 @@ var AvailableACLDistros = []Distro{ AKSACLArm64Gen2FIPSTL, AKSACLCVMGen2, AKSACLKataGen2TL, + AKSACLCVMGen2FIPS, } // IsContainerdSKU returns true if distro type is containerd-enabled. @@ -880,6 +883,13 @@ var ( Version: LinuxSIGImageVersion, } + SIGACLCVMGen2FIPSImageConfigTemplate = SigImageConfigTemplate{ + ResourceGroup: AKSAzureLinuxResourceGroup, + Gallery: AKSAzureLinuxGalleryName, + Definition: "aclgen2fipsCVM", + Version: LinuxSIGImageVersion, + } + SIGWindows2019ImageConfigTemplate = SigImageConfigTemplate{ ResourceGroup: AKSWindowsResourceGroup, Gallery: AKSWindowsGalleryName, @@ -974,7 +984,7 @@ func GetMaintainedLinuxSIGImageConfigMap() map[Distro]SigImageConfig { // to ensure that missing image versions under a new image definition does not block AgentBaker rollout. // Definitions only need to be added to this list that have not yet been built and released at least once by // the time it's corresponding SIGImageConfigTemplate is added to AgentBaker. - definitionsToSkip := []string{"aclkatagen2TL"} + definitionsToSkip := []string{"aclkatagen2TL", "aclgen2fipsCVM"} maintained := map[Distro]SigImageConfig{} for _, m := range imageConfigMaps { @@ -1056,6 +1066,7 @@ func getSigAzureLinuxImageConfigMapWithOpts(opts ...SigImageConfigOpt) map[Distr AKSACLArm64Gen2FIPSTL: SIGACLArm64Gen2FIPSTLImageConfigTemplate.WithOptions(opts...), AKSACLCVMGen2: SIGACLCVMGen2ImageConfigTemplate.WithOptions(opts...), AKSACLKataGen2TL: SIGACLKataGen2TLImageConfigTemplate.WithOptions(opts...), + AKSACLCVMGen2FIPS: SIGACLCVMGen2FIPSImageConfigTemplate.WithOptions(opts...), } } diff --git a/pkg/agent/datamodel/sig_config_test.go b/pkg/agent/datamodel/sig_config_test.go index a58b06840dd..f580dff5a46 100644 --- a/pkg/agent/datamodel/sig_config_test.go +++ b/pkg/agent/datamodel/sig_config_test.go @@ -43,6 +43,8 @@ var _ = Describe("GetMaintainedLinuxSIGImageConfigMap", func() { AKSACLCVMGen2: SIGACLCVMGen2ImageConfigTemplate.WithOptions(), // TODO: add back once "aclkatagen2TL" has at least one valid image version. // AKSACLKataGen2TL: SIGACLKataGen2TLImageConfigTemplate.WithOptions(), + // TODO: add once "aclgen2fipsCVM" has at least one valid image version. + // AKSACLCVMGen2FIPS: SIGACLCVMGen2FIPSImageConfigTemplate.WithOptions(), } actual := GetMaintainedLinuxSIGImageConfigMap() for distro, config := range expected { @@ -110,7 +112,7 @@ var _ = Describe("GetSIGAzureCloudSpecConfig", func() { Expect(mariner.Definition).To(Equal("V1")) Expect(mariner.Version).To(Equal(FrozenCBLMarinerV1SIGImageVersionForDeprecation)) - Expect(len(sigConfig.SigAzureLinuxImageConfig)).To(Equal(24)) + Expect(len(sigConfig.SigAzureLinuxImageConfig)).To(Equal(25)) azurelinuxV2 := sigConfig.SigAzureLinuxImageConfig[AKSAzureLinuxV2] Expect(azurelinuxV2.ResourceGroup).To(Equal("resourcegroup")) @@ -453,5 +455,11 @@ var _ = Describe("GetSIGAzureCloudSpecConfig", func() { Expect(aclKataGen2TL.Gallery).To(Equal("aksazurelinux")) Expect(aclKataGen2TL.Definition).To(Equal("aclkatagen2TL")) Expect(aclKataGen2TL.Version).To(Equal(LinuxSIGImageVersion)) + + aclCVMGen2FIPS := sigConfig.SigAzureLinuxImageConfig[AKSACLCVMGen2FIPS] + Expect(aclCVMGen2FIPS.ResourceGroup).To(Equal("resourcegroup")) + Expect(aclCVMGen2FIPS.Gallery).To(Equal("aksazurelinux")) + Expect(aclCVMGen2FIPS.Definition).To(Equal("aclgen2fipsCVM")) + Expect(aclCVMGen2FIPS.Version).To(Equal(LinuxSIGImageVersion)) }) }) diff --git a/pkg/agent/datamodel/types.go b/pkg/agent/datamodel/types.go index d573af31402..d5a88c364de 100644 --- a/pkg/agent/datamodel/types.go +++ b/pkg/agent/datamodel/types.go @@ -205,6 +205,7 @@ const ( AKSACLArm64Gen2FIPSTL Distro = "aks-acl-arm64-gen2-fips-tl" AKSACLCVMGen2 Distro = "aks-acl-cvm-gen2" AKSACLKataGen2TL Distro = "aks-acl-kata-gen2-tl" + AKSACLCVMGen2FIPS Distro = "aks-acl-cvm-gen2-fips" // Windows string const. // AKSWindows2019 stands for distro of windows server 2019 SIG image with docker. @@ -300,6 +301,7 @@ var AKSDistrosAvailableOnVHD = []Distro{ AKSACLArm64Gen2FIPSTL, AKSACLCVMGen2, AKSACLKataGen2TL, + AKSACLCVMGen2FIPS, } type CustomConfigurationComponent string diff --git a/pkg/agent/datamodel/types_test.go b/pkg/agent/datamodel/types_test.go index abc3e9bffd4..9a631049b34 100644 --- a/pkg/agent/datamodel/types_test.go +++ b/pkg/agent/datamodel/types_test.go @@ -1373,6 +1373,13 @@ func TestAgentPoolProfileIsACL(t *testing.T) { }, expected: true, }, + { + name: "ACL CVM FIPS distro", + ap: AgentPoolProfile{ + Distro: AKSACLCVMGen2FIPS, + }, + expected: true, + }, { name: "Flatcar distro is not ACL", ap: AgentPoolProfile{