WIP: Configure fips on the bastion node of openshift cluster #276

gauravpbankar · 2023-10-17T14:21:23Z

To configure the bastion node of openshfit cluster with FIPS enablement on PowerVM.

As a part of fips enablement we have already enabled fips on master nodes and worker nodes, In this PR we are going to enable fips on the bastion node.

ppc64le-cloud-bot · 2023-10-17T14:21:28Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: gauravpbankar
Once this PR has been reviewed and has the lgtm label, please assign cs-zhang for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

ppc64le-cloud-bot · 2023-10-17T14:21:32Z

@gauravpbankar: PR is not mergeable.

The PR state is: BLOCKED

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

ppc64le-cloud-bot · 2023-10-17T14:21:35Z

Hi @gauravpbankar. Thanks for your PR.

I'm waiting for a ocp-power-automation member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

modules/1_bastion/bastion.tf

prb112 · 2023-10-17T15:40:49Z

modules/1_bastion/bastion.tf

@@ -345,3 +345,32 @@ resource "null_resource" "setup_nfs_disk" {
    ]
  }
 }
+
+
+resource "null_resource" "bastion_nop" {


Suggested change

resource "null_resource" "bastion_nop" {

resource "null_resource" "fips_enablement" {

prb112

needs changes

prb112 · 2023-10-18T17:25:01Z

modules/1_bastion/bastion.tf

+
+

Suggested change

Added changes.

modules/1_bastion/bastion.tf

prb112 · 2023-10-25T09:46:52Z

modules/1_bastion/versions.tf

+    time = {
+      source = "hashicorp/time"
+      version = "0.9.1"


This is a new dependency to facilitate synchronization between null_resource providers

prb112 · 2023-10-25T09:48:12Z

ocp.tf

@@ -83,6 +84,7 @@ module "network" {
 }

 module "helpernode" {
+  depends_on = [module.bastion]


Added due to module level synchronization problems when FIPS is enabled.

There is an option to use a small dummy step that uses fips_compliant as the synchronization point only when fips is enabled. We opted for this cleaner approach.

prb112

Please make the few style changes, and change from work in progress to ready for review.

prb112

comments are inline

Signed-off-by: Gaurav Bankar <Gaurav.Bankar@ibm.com>

gauravpbankar · 2023-10-25T12:41:24Z

@yussufsh :
Can you please review the PR.

yussufsh · 2023-10-25T12:56:50Z

/ok-to-test

ppc64le-cloud-bot · 2023-10-25T12:57:08Z

@gauravpbankar: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
pull-ocp4-upi-powervm-terraform-lint	`1bce9c9`	link	true	`/test pull-ocp4-upi-powervm-terraform-lint`
pull-ocp4-upi-powervm-terraform-fmt	`1bce9c9`	link	true	`/test pull-ocp4-upi-powervm-terraform-fmt`
pull-ocp4-upi-powervm-terraform-validate	`1bce9c9`	link	true	`/test pull-ocp4-upi-powervm-terraform-validate`

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

yussufsh · 2023-10-25T13:07:51Z

@yussufsh : Can you please review the PR.

@gauravpbankar There are syntax errors in the code. When you are making any further changes I want to see a full run log with the required variables.
Please assign PRs only when you have a working code otherwise it is a waste of time for reviewers.
@prb112

prb112 · 2023-10-25T13:46:38Z

Hey @gaurav / @yussufsh yes - I totally agree. please ping the log to Yussuf and I

ppc64le-cloud-bot added the do-not-merge/work-in-progress label Oct 17, 2023

ppc64le-cloud-bot requested review from aishwaryabk and yussufsh October 17, 2023 14:21

ppc64le-cloud-bot added do-not-merge/non-mergeable size/M needs-ok-to-test labels Oct 17, 2023

prb112 reviewed Oct 17, 2023

View reviewed changes

modules/1_bastion/bastion.tf Show resolved Hide resolved

prb112 reviewed Oct 17, 2023

View reviewed changes

prb112 suggested changes Oct 17, 2023

View reviewed changes

gauravpbankar changed the title -s {WIP} Oct 18, 2023

gauravpbankar changed the title ~~{WIP}~~ [WIP] Oct 18, 2023

gauravpbankar changed the title ~~[WIP]~~ [WIP] configure fips on the bastion to set the certificates properly on the openshift cluster Oct 18, 2023

gauravpbankar changed the title ~~[WIP] configure fips on the bastion to set the certificates properly on the openshift cluster~~ [WIP] configure fips on the bastion node of openshift cluster. Oct 18, 2023

gauravpbankar force-pushed the fips branch from 051c0c3 to 78dc183 Compare October 18, 2023 12:35

gauravpbankar changed the title ~~[WIP] configure fips on the bastion node of openshift cluster.~~ WIP: Configure fips on the bastion node of openshift cluster Oct 18, 2023

prb112 reviewed Oct 18, 2023

View reviewed changes

modules/1_bastion/bastion.tf Outdated Show resolved Hide resolved

prb112 reviewed Oct 18, 2023

View reviewed changes

modules/1_bastion/bastion.tf Outdated Show resolved Hide resolved

gauravpbankar force-pushed the fips branch from 78dc183 to ebea1a5 Compare October 25, 2023 09:29

prb112 reviewed Oct 25, 2023

View reviewed changes

modules/1_bastion/bastion.tf Outdated Show resolved Hide resolved

prb112 reviewed Oct 25, 2023

View reviewed changes

modules/1_bastion/bastion.tf Outdated Show resolved Hide resolved

prb112 reviewed Oct 25, 2023

View reviewed changes

modules/1_bastion/bastion.tf Show resolved Hide resolved

prb112 reviewed Oct 25, 2023

View reviewed changes

prb112 suggested changes Oct 25, 2023

View reviewed changes

Added required changes related of FIPS on bastion node of OCP

1bce9c9

Signed-off-by: Gaurav Bankar <Gaurav.Bankar@ibm.com>

gauravpbankar force-pushed the fips branch from ebea1a5 to 1bce9c9 Compare October 25, 2023 12:39

gauravpbankar marked this pull request as ready for review October 25, 2023 12:40

ppc64le-cloud-bot requested a review from pravin-dsilva October 25, 2023 12:40

gauravpbankar changed the title ~~WIP: Configure fips on the bastion node of openshift cluster~~ Configure fips on the bastion node of openshift cluster Oct 25, 2023

ppc64le-cloud-bot removed the do-not-merge/work-in-progress label Oct 25, 2023

ppc64le-cloud-bot added ok-to-test and removed needs-ok-to-test labels Oct 25, 2023

gauravpbankar changed the title ~~Configure fips on the bastion node of openshift cluster~~ WIP: Configure fips on the bastion node of openshift cluster Oct 26, 2023

ppc64le-cloud-bot added the do-not-merge/work-in-progress label Oct 26, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

WIP: Configure fips on the bastion node of openshift cluster #276

WIP: Configure fips on the bastion node of openshift cluster #276

gauravpbankar commented Oct 17, 2023 •

edited

ppc64le-cloud-bot commented Oct 17, 2023

ppc64le-cloud-bot commented Oct 17, 2023 •

edited

ppc64le-cloud-bot commented Oct 17, 2023

prb112 Oct 17, 2023

prb112 left a comment

prb112 Oct 18, 2023

gauravpbankar Oct 25, 2023

prb112 Oct 25, 2023

prb112 Oct 25, 2023

prb112 left a comment

prb112 left a comment

gauravpbankar commented Oct 25, 2023 •

edited

yussufsh commented Oct 25, 2023

ppc64le-cloud-bot commented Oct 25, 2023

yussufsh commented Oct 25, 2023

prb112 commented Oct 25, 2023

	resource "null_resource" "bastion_nop" {
	resource "null_resource" "fips_enablement" {

WIP: Configure fips on the bastion node of openshift cluster #276

Are you sure you want to change the base?

WIP: Configure fips on the bastion node of openshift cluster #276

Conversation

gauravpbankar commented Oct 17, 2023 • edited

ppc64le-cloud-bot commented Oct 17, 2023

ppc64le-cloud-bot commented Oct 17, 2023 • edited

ppc64le-cloud-bot commented Oct 17, 2023

prb112 Oct 17, 2023

Choose a reason for hiding this comment

prb112 left a comment

Choose a reason for hiding this comment

prb112 Oct 18, 2023

Choose a reason for hiding this comment

gauravpbankar Oct 25, 2023

Choose a reason for hiding this comment

prb112 Oct 25, 2023

Choose a reason for hiding this comment

prb112 Oct 25, 2023

Choose a reason for hiding this comment

prb112 left a comment

Choose a reason for hiding this comment

prb112 left a comment

Choose a reason for hiding this comment

gauravpbankar commented Oct 25, 2023 • edited

yussufsh commented Oct 25, 2023

ppc64le-cloud-bot commented Oct 25, 2023

yussufsh commented Oct 25, 2023

prb112 commented Oct 25, 2023

gauravpbankar commented Oct 17, 2023 •

edited

ppc64le-cloud-bot commented Oct 17, 2023 •

edited

gauravpbankar commented Oct 25, 2023 •

edited