From 5529aa7e4d023049eb835dda3439dc853c46fefc Mon Sep 17 00:00:00 2001 From: aadhar-agarwal <108542189+aadhar-agarwal@users.noreply.github.com> Date: Tue, 20 Oct 2026 17:50:00 -0700 Subject: [PATCH 1/3] feat: add Azure Container Linux CVM FIPS image Register the dedicated ACL CVM FIPS distro and SIG definition, and add a release job that builds the CVM image with FIPS enabled. Co-authored-by: Ankita Pareek <56152556+Ankita13-code@users.noreply.github.com> Signed-off-by: Aadhar Agarwal --- .pipelines/.vsts-vhd-builder-release.yaml | 29 +++++++++++++++++++++++ pkg/agent/bakerapi_test.go | 1 + pkg/agent/datamodel/sig_config.go | 13 +++++++++- pkg/agent/datamodel/sig_config_test.go | 10 +++++++- pkg/agent/datamodel/types.go | 2 ++ pkg/agent/datamodel/types_test.go | 7 ++++++ 6 files changed, 60 insertions(+), 2 deletions(-) diff --git a/.pipelines/.vsts-vhd-builder-release.yaml b/.pipelines/.vsts-vhd-builder-release.yaml index a9a5368938a..4dbbb1e9ea3 100644 --- a/.pipelines/.vsts-vhd-builder-release.yaml +++ b/.pipelines/.vsts-vhd-builder-release.yaml @@ -141,6 +141,10 @@ parameters: displayName: Build Azure Container Linux CVM Gen2 type: boolean default: true + - name: buildaclcvmfipstlgen2 + displayName: Build Azure Container Linux CVM FIPS Gen2 + type: boolean + default: false - name: buildaclarm64tlgen2 displayName: Build Azure Container Linux ARM64 TL Gen2 type: boolean @@ -945,6 +949,31 @@ stages: useOverrides: ${{ parameters.useOverrides }} overrideBranch: ${{ parameters.overrideBranch }} artifactName: acl-cvm-gen2 + - job: buildaclcvmfipstlgen2 + condition: eq('${{ parameters.buildaclcvmfipstlgen2 }}', true) + dependsOn: [ ] + timeoutInMinutes: 360 + steps: + - bash: | + echo '##vso[task.setvariable variable=OS_SKU]AzureContainerLinux' + echo '##vso[task.setvariable variable=OS_VERSION]acl' + echo '##vso[task.setvariable variable=SIG_SOURCE_GALLERY_UNIQUE_NAME]ae6ab47f-1fc9-4b67-8f82-4636119119c9-ACL' + echo '##vso[task.setvariable variable=SIG_SOURCE_IMAGE_NAME]acl-3.0-amd64' + echo '##vso[task.setvariable variable=SIG_SOURCE_IMAGE_VERSION]20261006.1217966.0' + echo '##vso[task.setvariable variable=HYPERV_GENERATION]V2' + echo '##vso[task.setvariable variable=AZURE_VM_SIZE]Standard_D4ads_v5' + echo '##vso[task.setvariable variable=CVM_TEST_VM_SIZE]Standard_DC8ads_v5' + echo '##vso[task.setvariable variable=FEATURE_FLAGS]cvm' + echo '##vso[task.setvariable variable=ARCHITECTURE]X86_64' + echo '##vso[task.setvariable variable=ENABLE_FIPS]True' + echo '##vso[task.setvariable variable=ENABLE_TRUSTED_LAUNCH]False' + echo '##vso[task.setvariable variable=ENABLE_CGROUPV2]True' + displayName: Setup Build Variables + - template: ./templates/.builder-release-template.yaml + parameters: + useOverrides: ${{ parameters.useOverrides }} + overrideBranch: ${{ parameters.overrideBranch }} + artifactName: acl-cvm-fips-gen2 - job: buildaclarm64tlgen2 condition: eq('${{ parameters.buildaclarm64tlgen2 }}', true) dependsOn: [ ] diff --git a/pkg/agent/bakerapi_test.go b/pkg/agent/bakerapi_test.go index d1bd44ff392..f1fbaceef1b 100644 --- a/pkg/agent/bakerapi_test.go +++ b/pkg/agent/bakerapi_test.go @@ -483,6 +483,7 @@ var _ = Describe("AgentBaker API implementation tests", func() { datamodel.AKSACLArm64Gen2FIPSTL, datamodel.AKSACLCVMGen2, datamodel.AKSACLKataGen2TL, + datamodel.AKSACLCVMGen2FIPS, } ubuntuEdgeZoneDistros = []datamodel.Distro{ diff --git a/pkg/agent/datamodel/sig_config.go b/pkg/agent/datamodel/sig_config.go index 6b48de06f09..f588ed2ffae 100644 --- a/pkg/agent/datamodel/sig_config.go +++ b/pkg/agent/datamodel/sig_config.go @@ -142,6 +142,7 @@ var AvailableContainerdDistros = []Distro{ AKSACLArm64Gen2FIPSTL, AKSACLCVMGen2, AKSACLKataGen2TL, + AKSACLCVMGen2FIPS, AKSCBLMarinerV1, AKSCBLMarinerV2, AKSAzureLinuxV2, @@ -219,6 +220,7 @@ var AvailableGen2Distros = []Distro{ AKSACLArm64Gen2FIPSTL, AKSACLCVMGen2, AKSACLKataGen2TL, + AKSACLCVMGen2FIPS, AKSCBLMarinerV2Gen2, AKSAzureLinuxV2Gen2, AKSAzureLinuxV3Gen2, @@ -335,6 +337,7 @@ var AvailableACLDistros = []Distro{ AKSACLArm64Gen2FIPSTL, AKSACLCVMGen2, AKSACLKataGen2TL, + AKSACLCVMGen2FIPS, } // IsContainerdSKU returns true if distro type is containerd-enabled. @@ -880,6 +883,13 @@ var ( Version: LinuxSIGImageVersion, } + SIGACLCVMGen2FIPSImageConfigTemplate = SigImageConfigTemplate{ + ResourceGroup: AKSAzureLinuxResourceGroup, + Gallery: AKSAzureLinuxGalleryName, + Definition: "aclgen2CVMFips", + Version: LinuxSIGImageVersion, + } + SIGWindows2019ImageConfigTemplate = SigImageConfigTemplate{ ResourceGroup: AKSWindowsResourceGroup, Gallery: AKSWindowsGalleryName, @@ -974,7 +984,7 @@ func GetMaintainedLinuxSIGImageConfigMap() map[Distro]SigImageConfig { // to ensure that missing image versions under a new image definition does not block AgentBaker rollout. // Definitions only need to be added to this list that have not yet been built and released at least once by // the time it's corresponding SIGImageConfigTemplate is added to AgentBaker. - definitionsToSkip := []string{"aclgen2CVM", "aclkatagen2TL"} + definitionsToSkip := []string{"aclgen2CVM", "aclkatagen2TL", "aclgen2CVMFips"} maintained := map[Distro]SigImageConfig{} for _, m := range imageConfigMaps { @@ -1056,6 +1066,7 @@ func getSigAzureLinuxImageConfigMapWithOpts(opts ...SigImageConfigOpt) map[Distr AKSACLArm64Gen2FIPSTL: SIGACLArm64Gen2FIPSTLImageConfigTemplate.WithOptions(opts...), AKSACLCVMGen2: SIGACLCVMGen2ImageConfigTemplate.WithOptions(opts...), AKSACLKataGen2TL: SIGACLKataGen2TLImageConfigTemplate.WithOptions(opts...), + AKSACLCVMGen2FIPS: SIGACLCVMGen2FIPSImageConfigTemplate.WithOptions(opts...), } } diff --git a/pkg/agent/datamodel/sig_config_test.go b/pkg/agent/datamodel/sig_config_test.go index c614cc0e7bd..e9a96bddb1f 100644 --- a/pkg/agent/datamodel/sig_config_test.go +++ b/pkg/agent/datamodel/sig_config_test.go @@ -44,6 +44,8 @@ var _ = Describe("GetMaintainedLinuxSIGImageConfigMap", func() { // AKSACLCVMGen2: SIGACLCVMGen2ImageConfigTemplate.WithOptions(), // TODO: add back once "aclkatagen2TL" has at least one valid image version. // AKSACLKataGen2TL: SIGACLKataGen2TLImageConfigTemplate.WithOptions(), + // TODO: add once "aclgen2CVMFips" has at least one valid image version. + // AKSACLCVMGen2FIPS: SIGACLCVMGen2FIPSImageConfigTemplate.WithOptions(), } actual := GetMaintainedLinuxSIGImageConfigMap() for distro, config := range expected { @@ -111,7 +113,7 @@ var _ = Describe("GetSIGAzureCloudSpecConfig", func() { Expect(mariner.Definition).To(Equal("V1")) Expect(mariner.Version).To(Equal(FrozenCBLMarinerV1SIGImageVersionForDeprecation)) - Expect(len(sigConfig.SigAzureLinuxImageConfig)).To(Equal(24)) + Expect(len(sigConfig.SigAzureLinuxImageConfig)).To(Equal(25)) azurelinuxV2 := sigConfig.SigAzureLinuxImageConfig[AKSAzureLinuxV2] Expect(azurelinuxV2.ResourceGroup).To(Equal("resourcegroup")) @@ -454,5 +456,11 @@ var _ = Describe("GetSIGAzureCloudSpecConfig", func() { Expect(aclKataGen2TL.Gallery).To(Equal("aksazurelinux")) Expect(aclKataGen2TL.Definition).To(Equal("aclkatagen2TL")) Expect(aclKataGen2TL.Version).To(Equal(LinuxSIGImageVersion)) + + aclCVMGen2FIPS := sigConfig.SigAzureLinuxImageConfig[AKSACLCVMGen2FIPS] + Expect(aclCVMGen2FIPS.ResourceGroup).To(Equal("resourcegroup")) + Expect(aclCVMGen2FIPS.Gallery).To(Equal("aksazurelinux")) + Expect(aclCVMGen2FIPS.Definition).To(Equal("aclgen2CVMFips")) + Expect(aclCVMGen2FIPS.Version).To(Equal(LinuxSIGImageVersion)) }) }) diff --git a/pkg/agent/datamodel/types.go b/pkg/agent/datamodel/types.go index 172fc5db63c..64f3457f4a5 100644 --- a/pkg/agent/datamodel/types.go +++ b/pkg/agent/datamodel/types.go @@ -205,6 +205,7 @@ const ( AKSACLArm64Gen2FIPSTL Distro = "aks-acl-arm64-gen2-fips-tl" AKSACLCVMGen2 Distro = "aks-acl-cvm-gen2" AKSACLKataGen2TL Distro = "aks-acl-kata-gen2-tl" + AKSACLCVMGen2FIPS Distro = "aks-acl-cvm-gen2-fips" // Windows string const. // AKSWindows2019 stands for distro of windows server 2019 SIG image with docker. @@ -300,6 +301,7 @@ var AKSDistrosAvailableOnVHD = []Distro{ AKSACLArm64Gen2FIPSTL, AKSACLCVMGen2, AKSACLKataGen2TL, + AKSACLCVMGen2FIPS, } type CustomConfigurationComponent string diff --git a/pkg/agent/datamodel/types_test.go b/pkg/agent/datamodel/types_test.go index abc3e9bffd4..9a631049b34 100644 --- a/pkg/agent/datamodel/types_test.go +++ b/pkg/agent/datamodel/types_test.go @@ -1373,6 +1373,13 @@ func TestAgentPoolProfileIsACL(t *testing.T) { }, expected: true, }, + { + name: "ACL CVM FIPS distro", + ap: AgentPoolProfile{ + Distro: AKSACLCVMGen2FIPS, + }, + expected: true, + }, { name: "Flatcar distro is not ACL", ap: AgentPoolProfile{ From 6d0785ac3bb05980be9731fbb5728cd702b1fb25 Mon Sep 17 00:00:00 2001 From: aadhar-agarwal <108542189+aadhar-agarwal@users.noreply.github.com> Date: Tue, 20 Oct 2026 17:50:03 -0700 Subject: [PATCH 2/3] fix: align ACL CVM FIPS image definition with builder Signed-off-by: Aadhar Agarwal --- pkg/agent/datamodel/sig_config.go | 4 ++-- pkg/agent/datamodel/sig_config_test.go | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/pkg/agent/datamodel/sig_config.go b/pkg/agent/datamodel/sig_config.go index f588ed2ffae..072f004cd05 100644 --- a/pkg/agent/datamodel/sig_config.go +++ b/pkg/agent/datamodel/sig_config.go @@ -886,7 +886,7 @@ var ( SIGACLCVMGen2FIPSImageConfigTemplate = SigImageConfigTemplate{ ResourceGroup: AKSAzureLinuxResourceGroup, Gallery: AKSAzureLinuxGalleryName, - Definition: "aclgen2CVMFips", + Definition: "aclgen2fipsCVM", Version: LinuxSIGImageVersion, } @@ -984,7 +984,7 @@ func GetMaintainedLinuxSIGImageConfigMap() map[Distro]SigImageConfig { // to ensure that missing image versions under a new image definition does not block AgentBaker rollout. // Definitions only need to be added to this list that have not yet been built and released at least once by // the time it's corresponding SIGImageConfigTemplate is added to AgentBaker. - definitionsToSkip := []string{"aclgen2CVM", "aclkatagen2TL", "aclgen2CVMFips"} + definitionsToSkip := []string{"aclgen2CVM", "aclkatagen2TL", "aclgen2fipsCVM"} maintained := map[Distro]SigImageConfig{} for _, m := range imageConfigMaps { diff --git a/pkg/agent/datamodel/sig_config_test.go b/pkg/agent/datamodel/sig_config_test.go index e9a96bddb1f..eed21845dd5 100644 --- a/pkg/agent/datamodel/sig_config_test.go +++ b/pkg/agent/datamodel/sig_config_test.go @@ -44,7 +44,7 @@ var _ = Describe("GetMaintainedLinuxSIGImageConfigMap", func() { // AKSACLCVMGen2: SIGACLCVMGen2ImageConfigTemplate.WithOptions(), // TODO: add back once "aclkatagen2TL" has at least one valid image version. // AKSACLKataGen2TL: SIGACLKataGen2TLImageConfigTemplate.WithOptions(), - // TODO: add once "aclgen2CVMFips" has at least one valid image version. + // TODO: add once "aclgen2fipsCVM" has at least one valid image version. // AKSACLCVMGen2FIPS: SIGACLCVMGen2FIPSImageConfigTemplate.WithOptions(), } actual := GetMaintainedLinuxSIGImageConfigMap() @@ -460,7 +460,7 @@ var _ = Describe("GetSIGAzureCloudSpecConfig", func() { aclCVMGen2FIPS := sigConfig.SigAzureLinuxImageConfig[AKSACLCVMGen2FIPS] Expect(aclCVMGen2FIPS.ResourceGroup).To(Equal("resourcegroup")) Expect(aclCVMGen2FIPS.Gallery).To(Equal("aksazurelinux")) - Expect(aclCVMGen2FIPS.Definition).To(Equal("aclgen2CVMFips")) + Expect(aclCVMGen2FIPS.Definition).To(Equal("aclgen2fipsCVM")) Expect(aclCVMGen2FIPS.Version).To(Equal(LinuxSIGImageVersion)) }) }) From f7d9dae4733031b38bcf77dd7a347ab22446cc54 Mon Sep 17 00:00:00 2001 From: Ankita Pareek <56152556+Ankita13-code@users.noreply.github.com> Date: Fri, 23 Oct 2026 13:49:37 +0530 Subject: [PATCH 3/3] fix: use resolved ACL source for CVM FIPS Parameterize the CVM FIPS job source gallery, image definition, and version so ACL validation runs use the selected release instead of a stale hardcoded image. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .pipelines/.vsts-vhd-builder-release.yaml | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/.pipelines/.vsts-vhd-builder-release.yaml b/.pipelines/.vsts-vhd-builder-release.yaml index 4dbbb1e9ea3..8f4fd60cc09 100644 --- a/.pipelines/.vsts-vhd-builder-release.yaml +++ b/.pipelines/.vsts-vhd-builder-release.yaml @@ -157,6 +157,18 @@ parameters: displayName: Build Azure Container Linux ARM64 FIPS TL Gen2 type: boolean default: true + - name: aclSigSourceGallery + displayName: ACL SIG source gallery unique name + type: string + default: 'ae6ab47f-1fc9-4b67-8f82-4636119119c9-ACL' + - name: aclSigSourceImageName + displayName: ACL SIG source image definition (amd64) + type: string + default: 'acl-3.0-amd64' + - name: aclImageVersion + displayName: ACL SIG source image version + type: string + default: '20261016.1226753.0' variables: - name: MODE @@ -957,9 +969,9 @@ stages: - bash: | echo '##vso[task.setvariable variable=OS_SKU]AzureContainerLinux' echo '##vso[task.setvariable variable=OS_VERSION]acl' - echo '##vso[task.setvariable variable=SIG_SOURCE_GALLERY_UNIQUE_NAME]ae6ab47f-1fc9-4b67-8f82-4636119119c9-ACL' - echo '##vso[task.setvariable variable=SIG_SOURCE_IMAGE_NAME]acl-3.0-amd64' - echo '##vso[task.setvariable variable=SIG_SOURCE_IMAGE_VERSION]20261006.1217966.0' + echo '##vso[task.setvariable variable=SIG_SOURCE_GALLERY_UNIQUE_NAME]${{ parameters.aclSigSourceGallery }}' + echo '##vso[task.setvariable variable=SIG_SOURCE_IMAGE_NAME]${{ parameters.aclSigSourceImageName }}' + echo '##vso[task.setvariable variable=SIG_SOURCE_IMAGE_VERSION]${{ parameters.aclImageVersion }}' echo '##vso[task.setvariable variable=HYPERV_GENERATION]V2' echo '##vso[task.setvariable variable=AZURE_VM_SIZE]Standard_D4ads_v5' echo '##vso[task.setvariable variable=CVM_TEST_VM_SIZE]Standard_DC8ads_v5'