Skip to content

Add RHEL/UBI amd64 FIPS support

Georgi N. Georgiev requested to merge fips-iteration-1 into main

What does this MR do?

The first iteration of supporting FIPS for GitLab Runner

  • Builds a FIPS enabled Go compiler docker image
  • Runner and Helper binaries are built with fips enabled
  • Only amd64
  • Docker images use RedHat's UBI images as base
  • Binaries are also intended to be used in RHEL OSes only
  • Separate FIPS RPM packages are also build which only include the FIPS amd64 helper image
  • Users should be able to specify the flavour of the helper image with "FIPS", just like they do with "alpine3.13" for example
  • Docs to come

Why was this MR needed?

For initial support for FIPS in GitLab Runner

What's the best way to test this MR?

Compile the FIPS binaries locally with:

make go-fips-docker
make runner-bin-fips-docker
make out/binaries/gitlab-runner-helper/gitlab-runner-helper-fips-docker

Verify that the binaries are running in FIPS mode by checking for the BoringSSL enabled message in the logs and by running the nm tool for the binaries:

go tool nm out/binaries/gitlab-runner-helper/gitlab-runner-helper.x86_64-fips |grep goboringcrypto
go tool nm out/binaries/gitlab-runner-linux-amd64-fips|grep goboringcrypto

What are the relevant issue numbers?

Related to #27886 (closed)

Edited by Arran Walker

Merge request reports