INSTA-37986: Add fedramp-pipeline.yaml to handle manual build & publish for fedramp cases by FredrikAtIBM · Pull Request #273 · instana/instana-agent-operator

FredrikAtIBM · 2025-06-16T14:42:22Z

Why

Needed to have a explicitly a version for fedramp-cases

What

Add fedramp-pipeline.yaml to handle manual build & publish for fedramp-cases.

References

Ticket

Milica-Cvrkota-IBM · 2025-06-24T10:09:47Z

ci/fedramp-pipeline.yaml

+    type: dummy
+    config:
+      vars: &prerelease-container-registry
+        repository: delivery.instana.io/int-docker-agent-fedramp-prerelease-local/instana-agent-operator/fedramp-v1.0.0/instana-agent-operator


We can't hard code v1.0.0 here as versions will change in subsequent releases, we need instead to use the bucket version instead, like here: https://github.ibm.com/instana/autotrace-mutating-webhook/pull/560/files#diff-6f63be971f649e60f9e0bf2ff76948e553f4616d50da84311800a89f5d77014bR127-R135. Then, since image_registry resource doesn't let us use variables, pushes to artifactory would need to be manual. The webhook pipeline has an example how to do this.

Milica-Cvrkota-IBM · 2025-06-24T10:10:02Z

ci/fedramp-pipeline.yaml

+    type: dummy
+    config:
+      vars:
+        repository: delivery.instana.io/int-docker-agent-fedramp-release-local/instana-agent-operator/fedramp-v1.0.0/instana-agent-operator


same here as above

Milica-Cvrkota-IBM · 2025-06-24T10:10:41Z

ci/fedramp-pipeline.yaml

+    type: dummy
+    config:
+      vars:
+        repository: https://delivery.instana.io/artifactory/int-generic-agent-fedramp-release-local/instana-agent-operator/fedramp-v1.0.0/instana-agent-operator


same here as above

Milica-Cvrkota-IBM · 2025-06-24T10:13:46Z

ci/fedramp-pipeline.yaml

+            - put: instana-agent-operator-fedramp-image-amd64
+              params:
+                image: image-amd64/image.tar
+                additional_tags: image-tags/amd64
+            - put: instana-agent-operator-fedramp-image-arm64
+              params:
+                image: image-arm64/image.tar
+                additional_tags: image-tags/arm64
+            - put: instana-agent-operator-fedramp-image-ppc64le
+              params:
+                image: image-ppc64le/image.tar
+                additional_tags: image-tags/ppc64le
+            - put: instana-agent-operator-fedramp-image-s390x
+              params:
+                image: image-s390x/image.tar
+                additional_tags: image-tags/s390x


Since fedramp version will be parametrized, we won't be able to use put with image_registry resource. Instead, you can use a similar script as we have for the webhook: ci/fedramp/deploy-image.yml

…sh for fedramp cases Signed-off-by: Fredrik Gundersen <fredrik.gundersen@ibm.com>

Signed-off-by: Fredrik Gundersen <fredrik.gundersen@ibm.com>

instana-agent-build · 2025-07-23T15:10:14Z

Checks Summary

Last run: 2025-07-23T15:20:23.401Z

Code Risk Analyzer vulnerability scan found 2 vulnerabilities:

Severity	Identifier	Package	Details	Fix
🔺High	CVE-2025-22868	golang.org/x/oauth2	golang.org/x/oauth2 Improper Validation of Syntactic Correctness of Input vulnerability GHSA-6v2p-p543-phr9	0.27.0
◻Unknown	CVE-2025-22868	golang.org/x/oauth2	Unexpected memory consumption during token parsing in golang.org/x/oauth2 GO-2025-3488	0.27.0

…ployments Signed-off-by: Fredrik Gundersen <fredrik.gundersen@ibm.com>

cvrkota

Looking at the artifactory, we don't push the images with the version tags, but just sha's and latest. We want to stay consistent with the old approach, where we don't just promote images with the same sha, but we push them with the real version in the release repository

ci/fedramp-pipeline.yaml

Co-authored-by: Milica Cvrkota <43457560+cvrkota@users.noreply.github.com>

Signed-off-by: Fredrik Gundersen <fredrik.gundersen@ibm.com>

cvrkota · 2025-07-30T08:14:10Z

ci/fedramp-pipeline.yaml

+                echo "${PRERELEASE_CONTAINER_REPO_URL}" > variables/prerelease-container-repo-url
+                echo "${RELEASE_CONTAINER_REPO_URL}" > variables/release-container-repo-url
+                echo "${RELEASE_GENERIC_REPO}" > variables/release-generic-repo-url
+                echo "fedramp-release-v${FEDRAMP_VERSION}" > variables/release-branch


The branch should actually come from fedramp-version-default instead of the bucket as the branch won't change for every e.g. patch release. The branch changes only once every 6 months (for each new minor release)

I don't understand this. The source of truth in what version we build is the bucket version like in the PRs that were provided to me. The default value is the initial value. Did I misunderstand something about this from previous ones?

Yes, but the release branch won't change every time the fedramp branch changes. The branch will get changes only for new minor releases, but we will keep using fedramp-release-v1.0.0 even when bumping patch releases. Probably the branch name should've been fedramp-release-v1.0.x, but this decision was done outside of our team. So we need here two inputs:

fedramp-version resource that should be used for artifactory paths

((local-variables:fedramp-version-default)) which should be used for the branch resource

cvrkota · 2025-07-30T08:17:00Z

ci/fedramp-pipeline.yaml

+        file: variables/release-branch
+        reveal: true
+      # Copy the source code as now we know which version to release with the right branch
+      - task: clone-source-code


Why is the clone manual? You can just define a resource with type: git with the branch name, and then to use get for fetching the resource

The clone is manual as it seemed that manipulating a git resource is not possible if I'm not mistaken. Dynamic branching from the bucket will pull source as get to the point of figuring out what we're pulling. That was the point of the bucket right?

It's possible to define the git resource with the release-branch pointing to fedramp branch. Pls take a look here: https://github.ibm.com/instana/autotrace-mutating-webhook/blob/main/ci/fedramp/pipeline.yml#L23-L38

cvrkota · 2025-07-30T08:17:36Z

ci/fedramp-pipeline.yaml

+          image_resource:
+            <<: *e2e-test-base-image
+          inputs:
+            - name: source-code


Suggested change

- name: source-code

- name: <source-code-git-resource>

and then you don't need the previous task

I don't exactly understand what this is. Can you elaborate?

This is in reference to using the git concourse resource instead of manually cloning the repo. Pls check previous comment with the example

cvrkota · 2025-07-30T08:28:17Z

ci/fedramp-pipeline.yaml

+                  docker://${PRERELEASE_CONTAINER_REPO_URL}@${DIGEST} \
+                  docker://${RELEASE_CONTAINER_REPO_URL}:latest


Here we are pushing now both images at the same time. We should keep the existing approach and keep the pipelines as similar to regular releases: push to prerelease, running e2e tests with the prerelease pipeline, pushing to release only images that pass the test.
Also in the release repository, we don't need to copy images with git tag, we can only push them with the v + latest

I'm don't understand what is exactly meant by these points. Can you elaborate?

The skopeo command pushes both to prerelease and release paths:

docker://${PRERELEASE_CONTAINER_REPO_URL}@${DIGEST} \ docker://${RELEASE_CONTAINER_REPO_URL}:latest

We don't want to do this. The approach we want is to:

push to prerelease

run e2e tests with prerelease image

promote the image to release repo

…ing scheme Signed-off-by: Fredrik Gundersen <fredrik.gundersen@ibm.com>

cvrkota · 2025-08-08T07:58:45Z

ci/fedramp-pipeline.yaml

+              - |
+                echo "Using FedRAMP version: ${FEDRAMP_VERSION}"
+                # Define the updated repository paths with the correct version
+                PRERELEASE_CONTAINER_REPO_URL="delivery.instana.io/int-docker-agent-fedramp-prerelease-local/instana-agent-operator/fedramp-v${FEDRAMP_VERSION}/instana-agent-operator"


Suggested change

PRERELEASE_CONTAINER_REPO_URL="delivery.instana.io/int-docker-agent-fedramp-prerelease-local/instana-agent-operator/fedramp-v${FEDRAMP_VERSION}/instana-agent-operator"

PRERELEASE_CONTAINER_REPO_URL="delivery.instana.io/int-docker-agent-fedramp-prerelease-local/instana-agent-operator/fedramp-${FEDRAMP_VERSION}/instana-agent-operator"

cvrkota · 2025-08-08T07:58:53Z

ci/fedramp-pipeline.yaml

+                echo "Using FedRAMP version: ${FEDRAMP_VERSION}"
+                # Define the updated repository paths with the correct version
+                PRERELEASE_CONTAINER_REPO_URL="delivery.instana.io/int-docker-agent-fedramp-prerelease-local/instana-agent-operator/fedramp-v${FEDRAMP_VERSION}/instana-agent-operator"
+                RELEASE_CONTAINER_REPO_URL="delivery.instana.io/int-docker-agent-fedramp-release-local/instana-agent-operator/fedramp-v${FEDRAMP_VERSION}/instana-agent-operator"


Suggested change

RELEASE_CONTAINER_REPO_URL="delivery.instana.io/int-docker-agent-fedramp-release-local/instana-agent-operator/fedramp-v${FEDRAMP_VERSION}/instana-agent-operator"

RELEASE_CONTAINER_REPO_URL="delivery.instana.io/int-docker-agent-fedramp-release-local/instana-agent-operator/fedramp-${FEDRAMP_VERSION}/instana-agent-operator"

cvrkota · 2025-08-08T07:59:01Z

ci/fedramp-pipeline.yaml

+                # Define the updated repository paths with the correct version
+                PRERELEASE_CONTAINER_REPO_URL="delivery.instana.io/int-docker-agent-fedramp-prerelease-local/instana-agent-operator/fedramp-v${FEDRAMP_VERSION}/instana-agent-operator"
+                RELEASE_CONTAINER_REPO_URL="delivery.instana.io/int-docker-agent-fedramp-release-local/instana-agent-operator/fedramp-v${FEDRAMP_VERSION}/instana-agent-operator"
+                RELEASE_GENERIC_REPO="https://delivery.instana.io/artifactory/int-generic-agent-fedramp-release-local/instana-agent-operator/fedramp-v${FEDRAMP_VERSION}/instana-agent-operator"


Suggested change

RELEASE_GENERIC_REPO="https://delivery.instana.io/artifactory/int-generic-agent-fedramp-release-local/instana-agent-operator/fedramp-v${FEDRAMP_VERSION}/instana-agent-operator"

RELEASE_GENERIC_REPO="https://delivery.instana.io/artifactory/int-generic-agent-fedramp-release-local/instana-agent-operator/fedramp-${FEDRAMP_VERSION}/instana-agent-operator"

cvrkota · 2025-08-08T08:02:11Z

ci/fedramp-pipeline.yaml

+                echo "${PRERELEASE_CONTAINER_REPO_URL}" > variables/prerelease-container-repo-url
+                echo "${RELEASE_CONTAINER_REPO_URL}" > variables/release-container-repo-url
+                echo "${RELEASE_GENERIC_REPO}" > variables/release-generic-repo-url
+                echo "fedramp-release-v${FEDRAMP_VERSION}" > variables/release-branch


Yes, but the release branch won't change every time the fedramp branch changes. The branch will get changes only for new minor releases, but we will keep using fedramp-release-v1.0.0 even when bumping patch releases. Probably the branch name should've been fedramp-release-v1.0.x, but this decision was done outside of our team. So we need here two inputs:

fedramp-version resource that should be used for artifactory paths

((local-variables:fedramp-version-default)) which should be used for the branch resource

cvrkota · 2025-08-08T08:04:28Z

ci/fedramp-pipeline.yaml

+        file: variables/release-branch
+        reveal: true
+      # Copy the source code as now we know which version to release with the right branch
+      - task: clone-source-code


It's possible to define the git resource with the release-branch pointing to fedramp branch. Pls take a look here: https://github.ibm.com/instana/autotrace-mutating-webhook/blob/main/ci/fedramp/pipeline.yml#L23-L38

cvrkota · 2025-08-08T08:06:25Z

ci/fedramp-pipeline.yaml

+          image_resource:
+            <<: *e2e-test-base-image
+          inputs:
+            - name: source-code


This is in reference to using the git concourse resource instead of manually cloning the repo. Pls check previous comment with the example

cvrkota · 2025-08-08T08:07:34Z

ci/fedramp-pipeline.yaml

+                  docker://${PRERELEASE_CONTAINER_REPO_URL}@${DIGEST} \
+                  docker://${RELEASE_CONTAINER_REPO_URL}:latest


The skopeo command pushes both to prerelease and release paths:

docker://${PRERELEASE_CONTAINER_REPO_URL}@${DIGEST} \ docker://${RELEASE_CONTAINER_REPO_URL}:latest

We don't want to do this. The approach we want is to:

push to prerelease

run e2e tests with prerelease image

promote the image to release repo

FredrikAtIBM force-pushed the INSTA-37986 branch 4 times, most recently from 14982ff to 6f88cbd Compare June 23, 2025 08:07

FredrikAtIBM changed the title ~~WIP~~ INSTA-37986: Add fedramp-pipeline.yaml to handle manual build & publish for fedramp cases Jun 23, 2025

FredrikAtIBM force-pushed the INSTA-37986 branch from 6f88cbd to a481ace Compare June 23, 2025 08:11

FredrikAtIBM marked this pull request as ready for review June 23, 2025 08:11

FredrikAtIBM requested a review from a team as a code owner June 23, 2025 08:11

Milica-Cvrkota-IBM suggested changes Jun 24, 2025

View reviewed changes

FredrikAtIBM force-pushed the INSTA-37986 branch from 74dc40b to d35e9ec Compare July 14, 2025 07:49

FredrikAtIBM force-pushed the INSTA-37986 branch from fa9bf65 to 6af040a Compare July 22, 2025 12:08

FredrikAtIBM added 2 commits July 22, 2025 14:08

INSTA-37986: Add fedramp-pipeline.yaml to handle manual build & publi…

a025561

…sh for fedramp cases Signed-off-by: Fredrik Gundersen <fredrik.gundersen@ibm.com>

Add fedramp-version gcs bucket source to the pipeline

343179f

Signed-off-by: Fredrik Gundersen <fredrik.gundersen@ibm.com>

FredrikAtIBM force-pushed the INSTA-37986 branch from 6af040a to 343179f Compare July 22, 2025 12:08

Restructure fedramp-pipline.yaml to manage its own variables to do de…

96ead64

…ployments Signed-off-by: Fredrik Gundersen <fredrik.gundersen@ibm.com>

FredrikAtIBM force-pushed the INSTA-37986 branch from d6b2d9d to 96ead64 Compare July 24, 2025 13:15

cvrkota requested changes Jul 25, 2025

View reviewed changes

ci/fedramp-pipeline.yaml Outdated Show resolved Hide resolved

ci/fedramp-pipeline.yaml Show resolved Hide resolved

FredrikAtIBM and others added 3 commits July 25, 2025 13:34

Update ci/fedramp-pipeline.yaml

037a2ed

Co-authored-by: Milica Cvrkota <43457560+cvrkota@users.noreply.github.com>

Add version from git-tag to the published images

162b417

Signed-off-by: Fredrik Gundersen <fredrik.gundersen@ibm.com>

Merge branch 'main' into INSTA-37986

6ebe6b5

cvrkota requested changes Jul 30, 2025

View reviewed changes

FredrikAtIBM added 2 commits July 31, 2025 17:32

remove bucket approach from the pipeline

9a1cb8d

remove version from the copy phase of the image

0823e14

FredrikAtIBM force-pushed the INSTA-37986 branch from f14ee89 to 0823e14 Compare July 31, 2025 15:33

Changes as per request to add version tag to the manifest release nam…

f8fa40d

…ing scheme Signed-off-by: Fredrik Gundersen <fredrik.gundersen@ibm.com>

FredrikAtIBM force-pushed the INSTA-37986 branch from b11d1f5 to f8fa40d Compare August 7, 2025 07:35

Merge branch 'main' into INSTA-37986

4a1f70d

cvrkota requested changes Aug 8, 2025

View reviewed changes

		docker://${PRERELEASE_CONTAINER_REPO_URL}@${DIGEST} \
		docker://${RELEASE_CONTAINER_REPO_URL}:latest

	PRERELEASE_CONTAINER_REPO_URL="delivery.instana.io/int-docker-agent-fedramp-prerelease-local/instana-agent-operator/fedramp-v${FEDRAMP_VERSION}/instana-agent-operator"
	PRERELEASE_CONTAINER_REPO_URL="delivery.instana.io/int-docker-agent-fedramp-prerelease-local/instana-agent-operator/fedramp-${FEDRAMP_VERSION}/instana-agent-operator"

	RELEASE_CONTAINER_REPO_URL="delivery.instana.io/int-docker-agent-fedramp-release-local/instana-agent-operator/fedramp-v${FEDRAMP_VERSION}/instana-agent-operator"
	RELEASE_CONTAINER_REPO_URL="delivery.instana.io/int-docker-agent-fedramp-release-local/instana-agent-operator/fedramp-${FEDRAMP_VERSION}/instana-agent-operator"

	RELEASE_GENERIC_REPO="https://delivery.instana.io/artifactory/int-generic-agent-fedramp-release-local/instana-agent-operator/fedramp-v${FEDRAMP_VERSION}/instana-agent-operator"
	RELEASE_GENERIC_REPO="https://delivery.instana.io/artifactory/int-generic-agent-fedramp-release-local/instana-agent-operator/fedramp-${FEDRAMP_VERSION}/instana-agent-operator"

Conversation

FredrikAtIBM commented Jun 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why

What

References

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

instana-agent-build commented Jul 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cvrkota left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

FredrikAtIBM commented Jun 16, 2025 •

edited

Loading

instana-agent-build commented Jul 23, 2025 •

edited

Loading