Skip to content

Commit 65af0d1

Browse files
efaureefaure
committed
[ci] add FIPS image build
1 parent 98db124 commit 65af0d1

File tree

7 files changed

+75
-48
lines changed

7 files changed

+75
-48
lines changed

‎.github/workflows/cd-publish-and-deploy.yml‎

Lines changed: 13 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,12 +8,22 @@ on:
88
jobs:
99

1010
wf-build-image:
11-
name: Build and push image
11+
name: Build and push alpine image
1212
uses: ./.github/workflows/ci-docker-build.yml
1313
with:
1414
image_tag: ${{ github.ref_name == 'master' && 'rolling' || github.ref_name == 'release/current' && 'prerelease' || github.ref_name == 'issue/13571-build-images' && 'test-13571' }}
15-
client_python_local: true
16-
publish_to_registry: true
15+
is_client_python_local: true
16+
is_publish_to_registry: true
17+
secrets: inherit
18+
19+
wf-build-fips-image:
20+
name: Build and push FIPS image
21+
uses: ./.github/workflows/ci-docker-build.yml
22+
with:
23+
image_tag: ${{ github.ref_name == 'master' && 'rolling' || github.ref_name == 'release/current' && 'prerelease' || github.ref_name == 'issue/13571-build-images' && 'test-13571' }}
24+
is_client_python_local: true
25+
is_publish_to_registry: true
26+
is_fips: true
1727
secrets: inherit
1828

1929
wf-publish-package:

‎.github/workflows/ci-docker-build.yml‎

Lines changed: 27 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -11,17 +11,22 @@ on:
1111
description: "Reference of the branch or commit sha"
1212
type: string
1313
default: ${{ github.sha }}
14-
client_python_local:
14+
dockerfile_target:
15+
description: "Target to build in the multi stage docker file - testing or app"
16+
type: string
17+
required: false
18+
default: app
19+
is_client_python_local:
1520
description: "Use client python from the same commit"
1621
type: boolean
1722
required: false
1823
default: false
19-
dockerfile_target:
20-
description: "Target to build in the multi stage docker file - testing or app"
24+
is_fips:
25+
description: "Registry used to publish the image"
2126
type: string
2227
required: false
23-
default: app
24-
publish_to_registry:
28+
default: false
29+
is_publish_to_registry:
2530
description: "Publish image to registry. If false, will save the image as github artifact"
2631
type: string
2732
required: false
@@ -53,7 +58,7 @@ jobs:
5358
ref: ${{ inputs.checkout_ref }}
5459

5560
- name: Use client-python in OpenCTI from same branch
56-
if: ${{ inputs.client_python_local == true }}
61+
if: ${{ inputs.is_client_python_local == true }}
5762
run: sed -i 's|^pycti==.*$|pycti @ git+https://github.com/OpenCTI-Platform/opencti@${{ inputs.checkout_ref }}#subdirectory=client-python|' -i ./opencti-platform/opencti-graphql/src/python/requirements.txt
5863

5964
- name: Set up Docker Buildx
@@ -62,7 +67,7 @@ jobs:
6267
name: gha-builder-platform
6368

6469
- name: Login to DockerHub
65-
if: inputs.publish_to_registry == 'true'
70+
if: inputs.is_publish_to_registry == 'true'
6671
uses: docker/login-action@v3
6772
with:
6873
username: ${{ secrets.DOCKERHUB_USERNAME }}
@@ -73,21 +78,23 @@ jobs:
7378
uses: docker/metadata-action@v5
7479
with:
7580
images: ${{ inputs.registry }}/platform
76-
tags: type=raw,value=${{ inputs.image_tag }}
81+
tags: type=raw,value=${{ inputs.image_tag }}${{ inputs.fips && '-fips' }}
7782

78-
- name: Build and ${{ inputs.publish_to_registry && 'push' || 'export as tar' }}
83+
- name: Build and ${{ inputs.is_publish_to_registry && 'push' || 'export as tar' }}
7984
uses: docker/build-push-action@v6
8085
with:
8186
context: opencti-platform
8287
file: opencti-platform/Dockerfile_featurebranch
8388
target: ${{ inputs.dockerfile_target }}
84-
push: ${{ inputs.publish_to_registry == 'true' }}
85-
outputs: ${{ inputs.publish_to_registry == 'false' && 'type=docker,dest=/tmp/opencti-platform.tar' }}
89+
build-args: |
90+
"BASE_TYPE= ${{ inputs.fips && 'fips' || 'alpine' }}"
91+
push: ${{ inputs.is_publish_to_registry == 'true' }}
92+
outputs: ${{ inputs.is_publish_to_registry == 'false' && 'type=docker,dest=/tmp/opencti-platform.tar' }}
8693
tags: ${{ steps.meta.outputs.tags }}
8794
labels: ${{ steps.meta.outputs.labels }}
8895

8996
- name: Upload opencti docker image artifact
90-
if: ${{ inputs.publish_to_registry == 'false' }}
97+
if: ${{ inputs.is_publish_to_registry == 'false' }}
9198
uses: actions/upload-artifact@v4
9299
with:
93100
name: docker-image-opencti-platform
@@ -107,7 +114,7 @@ jobs:
107114
ref: ${{ inputs.checkout_ref }}
108115

109116
- name: Use client-python in worker from same branch
110-
if: ${{ inputs.client_python_local == true }}
117+
if: ${{ inputs.is_client_python_local == true }}
111118
run: sed -i 's|^pycti==.*$|pycti @ git+https://github.com/OpenCTI-Platform/opencti@${{ inputs.checkout_ref }}#subdirectory=client-python|' -i ./opencti-worker/src/requirements.txt
112119

113120
- name: Set up Docker Buildx
@@ -116,7 +123,7 @@ jobs:
116123
name: gha-builder-worker
117124

118125
- name: Login to DockerHub
119-
if: inputs.publish_to_registry == 'true'
126+
if: inputs.is_publish_to_registry == 'true'
120127
uses: docker/login-action@v3
121128
with:
122129
username: ${{ secrets.DOCKERHUB_USERNAME }}
@@ -127,15 +134,17 @@ jobs:
127134
uses: docker/metadata-action@v5
128135
with:
129136
images: ${{ inputs.registry }}/worker
130-
tags: type=raw,value=${{ inputs.image_tag }}
137+
tags: type=raw,value=${{ inputs.image_tag }}${{ inputs.fips && '-fips' }}
131138

132-
- name: Build and ${{ inputs.publish_to_registry && 'push' || 'export as tar' }}
139+
- name: Build and ${{ inputs.is_publish_to_registry && 'push' || 'export as tar' }}
133140
uses: docker/build-push-action@v6
134141
with:
135142
context: opencti-worker
136143
file: opencti-worker/Dockerfile
137-
push: ${{ inputs.publish_to_registry == 'true' }}
138-
outputs: ${{ inputs.publish_to_registry == 'false' && 'type=docker,dest=/tmp/opencti-worker.tar' }}
144+
build-args: |
145+
"BASE_TYPE= ${{ inputs.fips && 'fips' || 'alpine' }}"
146+
push: ${{ inputs.is_publish_to_registry == 'true' }}
147+
outputs: ${{ inputs.is_publish_to_registry == 'false' && 'type=docker,dest=/tmp/opencti-worker.tar' }}
139148
tags: ${{ steps.meta.outputs.tags }}
140149
labels: ${{ steps.meta.outputs.labels }}
141150

‎.github/workflows/ci-main.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ jobs:
1212
with:
1313
checkout_ref: ${{ github.event_name == 'pull_request' && format('refs/pull/{0}/merge', github.event.pull_request.number) || github.sha }}
1414
dockerfile_target: testing
15-
client_python_local: true
15+
is_client_python_local: true
1616
secrets: inherit
1717

1818
## Commenting test step for quicker testing of cd-publish-and-deploy.yml

‎.github/workflows/test-feature-branch.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ jobs:
2424
uses: ./.github/workflows/ci-docker-build.yml
2525
with:
2626
image_tag: ${{ github.ref_name }}
27-
publish_to_registry: true
27+
is_publish_to_registry: true
2828
secrets: inherit
2929

3030
deploy:

‎opencti-platform/Dockerfile_featurebranch‎

Lines changed: 20 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,20 @@
1-
FROM node:22-alpine AS base
1+
##############################
2+
### Create base image fips or alpine
3+
##############################
4+
5+
ARG BASE_TYPE=alpine
6+
ARG BASE_IMAGE_ALPINE=node:22-alpine
7+
ARG BASE_IMAGE_FIPS=filigran/python-nodejs-fips:latest
8+
9+
FROM ${BASE_IMAGE_ALPINE} AS base-alpine
10+
ENV EXTRA_NODE_OPTIONS=""
11+
ENV EXTRA_PACKAGES="python3 python3-dev g++"
212

13+
FROM ${BASE_IMAGE_FIPS} AS base-fips
14+
ENV EXTRA_NODE_OPTIONS="--force-fips "
15+
ENV EXTRA_PACKAGES="gettext-dev"
16+
17+
FROM base-${BASE_TYPE} AS base
318

419
##############################
520
### Build builder
@@ -9,7 +24,7 @@ FROM base AS builder
924

1025
# For layer optimisation, start by installing resources not dependant from source code
1126
RUN set -eux; \
12-
apk add --no-cache g++ make python3 python3-dev; \
27+
apk add --no-cache g++ make ${EXTRA_PACKAGES} ; \
1328
npm install -g node-gyp; \
1429
npm install -g corepack
1530

@@ -103,12 +118,12 @@ FROM base AS app
103118

104119
COPY opencti-graphql/src/python/requirements.txt /opt/opencti/src/python/requirements.txt
105120

106-
RUN apk add --no-cache tini python3 python3-dev
121+
RUN apk add --no-cache tini ${EXTRA_PACKAGES}
107122
RUN set -eux; \
108123
apk add --no-cache gcc git; \
109124
rm -f /usr/lib/python3.12/EXTERNALLY-MANAGED; \
110125
python3 -m ensurepip; \
111-
rm -rv /usr/lib/python*/ensurepip; \
126+
rm -rfv /usr/lib/python*/ensurepip; \
112127
pip3 install --no-cache-dir --upgrade pip setuptools wheel; \
113128
ln -sf python3 /usr/bin/python; \
114129
pip3 install --no-cache-dir --requirement /opt/opencti/src/python/requirements.txt ; \
@@ -123,7 +138,7 @@ COPY opencti-graphql/src/python/ ./src/python/
123138
COPY opencti-graphql/config/ ./config/
124139

125140
ENV PYTHONUNBUFFERED="1"
126-
ENV NODE_OPTIONS="--max_old_space_size=12288"
141+
ENV NODE_OPTIONS="${EXTRA_NODE_OPTIONS}--max_old_space_size=12288"
127142
ENV NODE_ENV="production"
128143

129144
RUN set -eux; \

‎opencti-worker/Dockerfile‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,16 @@
1-
FROM python:3-alpine
1+
##############################
2+
### Create base image fips or alpine
3+
##############################
4+
5+
ARG BASE_TYPE=alpine
6+
ARG BASE_IMAGE_ALPINE=python:3-alpine
7+
ARG BASE_IMAGE_FIPS=filigran/python-nodejs-fips:latest
8+
9+
FROM ${BASE_IMAGE_ALPINE} AS base-alpine
10+
11+
FROM ${BASE_IMAGE_FIPS} AS base-fips
12+
13+
FROM base-${BASE_TYPE}
214

315
COPY src /opt/opencti-worker
416

‎opencti-worker/Dockerfile.testing‎

Lines changed: 0 additions & 19 deletions
This file was deleted.

0 commit comments

Comments
 (0)