DDOT FIPS with an incompatible version: fail instead of falling back to non-FIPS#2527
DDOT FIPS with an incompatible version: fail instead of falling back to non-FIPS#2527
Conversation
…th a clear error when an fips variant of ddot-collector or agent -full is requested
agagniere
added
the
chart/datadog
- bump version for datadog to 3.198.1 (patch-version) - update changelog for datadog with version 3.198.1 - update readme for datadog
- bump version for datadog to 3.198.1 (patch-version)
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6cc3ec1d5b
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| {{/* Guard: -fips-full images are only available from 7.78.0 */}} | ||
| {{- if and (eq $tagSuffix "-fips-full") (not .root.agents.image.doNotCheckTag) (semverCompare "<7.78.0" (include "get-agent-version" (dict "Values" .root))) -}} | ||
| {{- $tagSuffix = "-full" -}} | ||
| {{- fail "The FIPS variant of the -full agent image is not available before 7.78.0. Upgrade agents.image.tag to 7.78.0+ or set useFIPSAgent to false." -}} |
There was a problem hiding this comment.
nit: Update error message to mention agents.image.doNotCheckTag=true as the escape hatch
| {{- $image := merge (dict "tag" $imageTag) .Values.otelAgentGateway.image -}} | ||
| {{- if and (eq (include "use-fips-images" .Values) "true") (not .Values.otelAgentGateway.image.doNotCheckTag) (semverCompare "<7.78.0" $imageTag) -}} | ||
| {{ include "registry" .Values }}/ddot-collector:{{ $imageTag }} | ||
| {{- fail "The standalone FIPS ddot-collector gateway image is not available before 7.78.0. Upgrade agents.image.tag (or otelAgentGateway.image.tag) to 7.78.0+ or set useFIPSAgent to false." -}} |
There was a problem hiding this comment.
similar as above but with otelAgentGateway.image.doNotCheckTag=true
swang392
left a comment
swang392
left a comment
There was a problem hiding this comment.
Could you also add tests testing this out (ex, in test/datadog/fips_mode_test.go and test/datadog/otel_agent_test.go) to confirm functionality that the image is not available before 7.78.0?
2 participants
Instead of falling back to a non-fips version with a warning, fail with a clear error when an fips variant of ddot-collector or agent -full is requested
What this PR does / why we need it:
This is a simplification of #2366
that is already merged but after talking to stakeholders I realized that in the case of FIPS,
a hard fail is preferable to a warning + fallback on non-FIPS images
Special notes for your reviewer:
Checklist
[Place an '[x]' (no spaces) in all applicable fields. Please remove unrelated fields.]
<chartName>/minor-version,<chartName>/patch-version, or<chartName>/no-version-bump)datadogordatadog-operatorchart or value changes, update the test baselines (run:make update-test-baselines)datadogchart changes, received ✅ from a member of your teamGitHub CI takes care of the below, but are still required:
.github/helm-docs.sh)CHANGELOG.mdhas been updatedREADME.md