Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Added HTTP Check for FIPS endpoint #1990

Open
wants to merge 2 commits into
base: main
Choose a base branch
from

Conversation

jeremymcgee73
Copy link

Issue #, if available:
#1984
Description of changes:

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

There is a bug when you have enabled FIPS on the image, in a region with FIPS endpoints, and have VPC endpoints enabled. The issue is that the check implemented in #1524 , checks to see if the FIPS endpoint resolves. In an isolated environment, the endpoint does resolve. But, there is not a FIPS enabled ECR VPC endpoint available. I switched the check from being a DNS request, to a HTTP call.

Testing Done
I used packer to build an Al2023 node with FIPS enabled to test. I also used the same code in a RHEL build downstream.

See this guide for recommended testing for PRs. Some tests may not apply. Completing tests and providing additional validation steps are not required, but it is recommended and may reduce review time and time to merge.

@jeremymcgee73
Copy link
Author

Yeah, that could be the case. I need to test to make sure its not throwing an error, and is always using the non FIPS endpoint.

@cartermckinnon
Copy link
Member

This is going to be obsolete after #2000, which removes the dependency on ECR entirely.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants