feat: add Azure Container Linux CVM FIPS image

.pipelines/.vsts-vhd-builder-release.yaml

@@ -141,6 +141,10 @@ parameters:
     displayName: Build Azure Container Linux CVM Gen2
     type: boolean
     default: true
+  - name: buildaclcvmfipstlgen2
+    displayName: Build Azure Container Linux CVM FIPS Gen2
+    type: boolean
+    default: false
   - name: buildaclarm64tlgen2
     displayName: Build Azure Container Linux ARM64 TL Gen2
     type: boolean
@@ -153,6 +157,18 @@ parameters:
     displayName: Build Azure Container Linux ARM64 FIPS TL Gen2
     type: boolean
     default: true
+  - name: aclSigSourceGallery
+    displayName: ACL SIG source gallery unique name
+    type: string
+    default: 'ae6ab47f-1fc9-4b67-8f82-4636119119c9-ACL'
+  - name: aclSigSourceImageName
+    displayName: ACL SIG source image definition (amd64)
+    type: string
+    default: 'acl-3.0-amd64'
+  - name: aclImageVersion
+    displayName: ACL SIG source image version
+    type: string
+    default: '20261016.1226753.0'
 
 variables:
   - name: MODE
@@ -945,6 +961,31 @@ stages:
               useOverrides: ${{ parameters.useOverrides }}
               overrideBranch: ${{ parameters.overrideBranch }}
               artifactName: acl-cvm-gen2
+      - job: buildaclcvmfipstlgen2
+        condition: eq('${{ parameters.buildaclcvmfipstlgen2 }}', true)
+        dependsOn: [ ]
+        timeoutInMinutes: 360
+        steps:
+          - bash: |
+              echo '##vso[task.setvariable variable=OS_SKU]AzureContainerLinux'
+              echo '##vso[task.setvariable variable=OS_VERSION]acl'
+              echo '##vso[task.setvariable variable=SIG_SOURCE_GALLERY_UNIQUE_NAME]${{ parameters.aclSigSourceGallery }}'
+              echo '##vso[task.setvariable variable=SIG_SOURCE_IMAGE_NAME]${{ parameters.aclSigSourceImageName }}'
+              echo '##vso[task.setvariable variable=SIG_SOURCE_IMAGE_VERSION]${{ parameters.aclImageVersion }}'
+              echo '##vso[task.setvariable variable=HYPERV_GENERATION]V2'
+              echo '##vso[task.setvariable variable=AZURE_VM_SIZE]Standard_D4ads_v5'
+              echo '##vso[task.setvariable variable=CVM_TEST_VM_SIZE]Standard_DC8ads_v5'
+              echo '##vso[task.setvariable variable=FEATURE_FLAGS]cvm'
+              echo '##vso[task.setvariable variable=ARCHITECTURE]X86_64'
+              echo '##vso[task.setvariable variable=ENABLE_FIPS]True'
+              echo '##vso[task.setvariable variable=ENABLE_TRUSTED_LAUNCH]False'
+              echo '##vso[task.setvariable variable=ENABLE_CGROUPV2]True'
+            displayName: Setup Build Variables
+          - template: ./templates/.builder-release-template.yaml
+            parameters:
+              useOverrides: ${{ parameters.useOverrides }}
+              overrideBranch: ${{ parameters.overrideBranch }}
+              artifactName: acl-cvm-fips-gen2
       - job: buildaclarm64tlgen2
         condition: eq('${{ parameters.buildaclarm64tlgen2 }}', true)
         dependsOn: [ ]

pkg/agent/bakerapi_test.go

@@ -483,6 +483,7 @@ var _ = Describe("AgentBaker API implementation tests", func() {
 				datamodel.AKSACLArm64Gen2FIPSTL,
 				datamodel.AKSACLCVMGen2,
 				datamodel.AKSACLKataGen2TL,
+				datamodel.AKSACLCVMGen2FIPS,
 			}
 
 			ubuntuEdgeZoneDistros = []datamodel.Distro{

pkg/agent/datamodel/sig_config.go

@@ -142,6 +142,7 @@ var AvailableContainerdDistros = []Distro{
 	AKSACLArm64Gen2FIPSTL,
 	AKSACLCVMGen2,
 	AKSACLKataGen2TL,
+	AKSACLCVMGen2FIPS,
 	AKSCBLMarinerV1,
 	AKSCBLMarinerV2,
 	AKSAzureLinuxV2,
@@ -219,6 +220,7 @@ var AvailableGen2Distros = []Distro{
 	AKSACLArm64Gen2FIPSTL,
 	AKSACLCVMGen2,
 	AKSACLKataGen2TL,
+	AKSACLCVMGen2FIPS,
 	AKSCBLMarinerV2Gen2,
 	AKSAzureLinuxV2Gen2,
 	AKSAzureLinuxV3Gen2,
@@ -335,6 +337,7 @@ var AvailableACLDistros = []Distro{
 	AKSACLArm64Gen2FIPSTL,
 	AKSACLCVMGen2,
 	AKSACLKataGen2TL,
+	AKSACLCVMGen2FIPS,
 }
 
 // IsContainerdSKU returns true if distro type is containerd-enabled.
@@ -880,6 +883,13 @@ var (
 		Version:       LinuxSIGImageVersion,
 	}
 
+	SIGACLCVMGen2FIPSImageConfigTemplate = SigImageConfigTemplate{
+		ResourceGroup: AKSAzureLinuxResourceGroup,
+		Gallery:       AKSAzureLinuxGalleryName,
+		Definition:    "aclgen2fipsCVM",
+		Version:       LinuxSIGImageVersion,
+	}
+
 	SIGWindows2019ImageConfigTemplate = SigImageConfigTemplate{
 		ResourceGroup: AKSWindowsResourceGroup,
 		Gallery:       AKSWindowsGalleryName,
@@ -974,7 +984,7 @@ func GetMaintainedLinuxSIGImageConfigMap() map[Distro]SigImageConfig {
 	// to ensure that missing image versions under a new image definition does not block AgentBaker rollout.
 	// Definitions only need to be added to this list that have not yet been built and released at least once by
 	// the time it's corresponding SIGImageConfigTemplate is added to AgentBaker.
-	definitionsToSkip := []string{"aclkatagen2TL"}
+	definitionsToSkip := []string{"aclkatagen2TL", "aclgen2fipsCVM"}
 
 	maintained := map[Distro]SigImageConfig{}
 	for _, m := range imageConfigMaps {
@@ -1056,6 +1066,7 @@ func getSigAzureLinuxImageConfigMapWithOpts(opts ...SigImageConfigOpt) map[Distr
 		AKSACLArm64Gen2FIPSTL:            SIGACLArm64Gen2FIPSTLImageConfigTemplate.WithOptions(opts...),
 		AKSACLCVMGen2:                    SIGACLCVMGen2ImageConfigTemplate.WithOptions(opts...),
 		AKSACLKataGen2TL:                 SIGACLKataGen2TLImageConfigTemplate.WithOptions(opts...),
+		AKSACLCVMGen2FIPS:                SIGACLCVMGen2FIPSImageConfigTemplate.WithOptions(opts...),
 	}
 }
 

pkg/agent/datamodel/sig_config_test.go

@@ -43,6 +43,8 @@ var _ = Describe("GetMaintainedLinuxSIGImageConfigMap", func() {
 			AKSACLCVMGen2:                           SIGACLCVMGen2ImageConfigTemplate.WithOptions(),
 			// TODO: add back once "aclkatagen2TL" has at least one valid image version.
 			// AKSACLKataGen2TL: SIGACLKataGen2TLImageConfigTemplate.WithOptions(),
+			// TODO: add once "aclgen2fipsCVM" has at least one valid image version.
+			// AKSACLCVMGen2FIPS: SIGACLCVMGen2FIPSImageConfigTemplate.WithOptions(),
 		}
 		actual := GetMaintainedLinuxSIGImageConfigMap()
 		for distro, config := range expected {
@@ -110,7 +112,7 @@ var _ = Describe("GetSIGAzureCloudSpecConfig", func() {
 		Expect(mariner.Definition).To(Equal("V1"))
 		Expect(mariner.Version).To(Equal(FrozenCBLMarinerV1SIGImageVersionForDeprecation))
 
-		Expect(len(sigConfig.SigAzureLinuxImageConfig)).To(Equal(24))
+		Expect(len(sigConfig.SigAzureLinuxImageConfig)).To(Equal(25))
 
 		azurelinuxV2 := sigConfig.SigAzureLinuxImageConfig[AKSAzureLinuxV2]
 		Expect(azurelinuxV2.ResourceGroup).To(Equal("resourcegroup"))
@@ -453,5 +455,11 @@ var _ = Describe("GetSIGAzureCloudSpecConfig", func() {
 		Expect(aclKataGen2TL.Gallery).To(Equal("aksazurelinux"))
 		Expect(aclKataGen2TL.Definition).To(Equal("aclkatagen2TL"))
 		Expect(aclKataGen2TL.Version).To(Equal(LinuxSIGImageVersion))
+
+		aclCVMGen2FIPS := sigConfig.SigAzureLinuxImageConfig[AKSACLCVMGen2FIPS]
+		Expect(aclCVMGen2FIPS.ResourceGroup).To(Equal("resourcegroup"))
+		Expect(aclCVMGen2FIPS.Gallery).To(Equal("aksazurelinux"))
+		Expect(aclCVMGen2FIPS.Definition).To(Equal("aclgen2fipsCVM"))
+		Expect(aclCVMGen2FIPS.Version).To(Equal(LinuxSIGImageVersion))
 	})
 })

pkg/agent/datamodel/types.go

@@ -205,6 +205,7 @@ const (
 	AKSACLArm64Gen2FIPSTL                   Distro = "aks-acl-arm64-gen2-fips-tl"
 	AKSACLCVMGen2                           Distro = "aks-acl-cvm-gen2"
 	AKSACLKataGen2TL                        Distro = "aks-acl-kata-gen2-tl"
+	AKSACLCVMGen2FIPS                       Distro = "aks-acl-cvm-gen2-fips"
 
 	// Windows string const.
 	// AKSWindows2019 stands for distro of windows server 2019 SIG image with docker.
@@ -300,6 +301,7 @@ var AKSDistrosAvailableOnVHD = []Distro{
 	AKSACLArm64Gen2FIPSTL,
 	AKSACLCVMGen2,
 	AKSACLKataGen2TL,
+	AKSACLCVMGen2FIPS,
 }
 
 type CustomConfigurationComponent string

pkg/agent/datamodel/types_test.go

@@ -1373,6 +1373,13 @@ func TestAgentPoolProfileIsACL(t *testing.T) {
 			},
 			expected: true,
 		},
+		{
+			name: "ACL CVM FIPS distro",
+			ap: AgentPoolProfile{
+				Distro: AKSACLCVMGen2FIPS,
+			},
+			expected: true,
+		},
 		{
 			name: "Flatcar distro is not ACL",
 			ap: AgentPoolProfile{