Add base openstack FIPS job

A new job openstack-fips is created.  This job is expected to be
a base job for most OpenStack jobs, so that FIPS testing can be
easily enabled throughout OpenStack CI.

A base job is required here because, for Ubuntu nodes, we need
to enable an Ubuntu Advantage subscription, as Ubuntu considers
FIPS to be a UA feature.  The subscription key is stored here in

Depends-On: I47a31f680172b47584510adb672b68498a85bd32
Change-Id: I8a88d6a9bcf5725986b00b063e03686d3225b48e
This commit is contained in:
Ade Lee 2023-01-27 17:10:39 +01:00
parent b913509ef4
commit d322181322
3 changed files with 35 additions and 6 deletions

View File

@ -0,0 +1,22 @@
This pre.yaml playbook is called as part of the openstack-fips job.
Its primary purpose is enable an Ubuntu Advantage subscription using
a subscription key that is stored in project-config.
Enabling FIPS requires a reboot, and so we need the FIPS playbook to
run very early in the node setup, so that resources set up by
subsequent pre-scripts are not affected by the reboot.
Therefore, the openstack-fips job must be definied as a base job for
most OpenStack jobs. As most jobs will not require fips, a playbook
variable enable_fips - which defaults to False - is provided.
To enable FIPS mode, a job will simply need to set enable_fips to
True as a job variable.
**Job Variables**
.. zuul:jobvar:: enable_fips
:default: False
Whether to run the playbook and enable fips. Defaults to False.

View File

@ -0,0 +1,7 @@
- name: enable ua subscription
hosts: all
- name: enable ua subscription for fips
name: enable-ua-subscription
when: enable_fips | default(false)

View File

@ -1265,12 +1265,12 @@
nodeset: ubuntu-xenial
- job:
name: openstack-multinode-fips
parent: multinode-fips
name: openstack-fips
abstract: true
description: |
Multinode job with fips enabled and passing
the ubuntu_fips_token needed for UA subscription.
Base job for OpenStack jobs that enables an
Ubuntu Advantage subscription if FIPS is enabled.
- secret: openstack_ubuntu_fips
name: ubuntu_fips_token
pass-to-parent: true
name: ubuntu_ua_token
pre-run: playbooks/openstack-fips/pre.yaml