Add support for KYMA_FIPS_MODE_ENABLED environment variable

internal/images/env.go

@@ -2,11 +2,14 @@ package images
 
 import (
 	"fmt"
+	"os"
 	"strings"
 
 	"github.com/caarlos0/env/v11"
 )
 
+const kymaFipsModeEnabledEnv = "KYMA_FIPS_MODE_ENABLED"
+
 type Image string
 
 func (i Image) GetHub() (string, error) {
@@ -29,7 +32,23 @@ type Images struct {
 	Ztunnel    Image `env:"ztunnel,notEmpty"`
 }
 
+type ImagesFips struct {
+	Pilot      Image `env:"pilot-fips,notEmpty"`
+	InstallCNI Image `env:"install-cni-fips,notEmpty"`
+	ProxyV2    Image `env:"proxyv2-fips,notEmpty"`
+	Ztunnel    Image `env:"ztunnel-fips,notEmpty"`
+}
+
 func GetImages() (*Images, error) {
+	kymaFipsModeEnabled := os.Getenv(kymaFipsModeEnabledEnv)
+	if kymaFipsModeEnabled == "true" {
+		environments, err := env.ParseAs[ImagesFips]()
+		if err != nil {
+			return nil, fmt.Errorf("missing required environment variables %w", err)
+		}
+		return (*Images)(&environments), nil
+	}
+
 	environments, err := env.ParseAs[Images]()
 	if err != nil {
 		return nil, fmt.Errorf("missing required environment variables %w", err)

internal/images/env_test.go

@@ -2,6 +2,7 @@ package images_test
 
 import (
 	"fmt"
+	"os"
 	"testing"
 
 	. "github.com/onsi/ginkgo/v2"
@@ -74,5 +75,72 @@ var _ = Describe("Images.GetHub", func() {
 			true,
 			fmt.Errorf("image foo.bar/istio/proxyv2:1.10.0 is not from the same hub as docker.io/istio/pilot:1.10.0"),
 		),
+		Entry("empty image",
+			fields{
+				Pilot:      "",
+				InstallCNI: "docker.io/istio/cni:1.10.0",
+				ProxyV2:    "docker.io/istio/proxyv2:1.10.0",
+			},
+			"",
+			true,
+			fmt.Errorf("image can not be empty"),
+		),
 	)
 })
+
+var _ = Describe("Images.GetFipsImages", func() {
+	_ = os.Setenv("pilot", "docker.io/istio/pilot:1.10.0")
+	_ = os.Setenv("install-cni", "docker.io/istio/cni:1.10.0")
+	_ = os.Setenv("proxyv2", "docker.io/istio/proxyv2:1.10.0")
+	_ = os.Setenv("ztunnel", "docker.io/istio/ztunnel:1.10.0")
+
+	Context("when KYMA_FIPS_MODE_ENABLED is true", func() {
+		It("should set the FIPS images", func() {
+			_ = os.Setenv("KYMA_FIPS_MODE_ENABLED", "true")
+			_ = os.Setenv("pilot-fips", "docker.io/istio/pilot-fips:1.10.0")
+			_ = os.Setenv("install-cni-fips", "docker.io/istio/cni-fips:1.10.0")
+			_ = os.Setenv("proxyv2-fips", "docker.io/istio/proxyv2-fips:1.10.0")
+			_ = os.Setenv("ztunnel-fips", "docker.io/istio/ztunnel-fips:1.10.0")
+
+			e, err := images.GetImages()
+			Expect(err).NotTo(HaveOccurred())
+			Expect(e.Pilot).To(Equal(images.Image("docker.io/istio/pilot-fips:1.10.0")))
+			Expect(e.InstallCNI).To(Equal(images.Image("docker.io/istio/cni-fips:1.10.0")))
+			Expect(e.ProxyV2).To(Equal(images.Image("docker.io/istio/proxyv2-fips:1.10.0")))
+			Expect(e.Ztunnel).To(Equal(images.Image("docker.io/istio/ztunnel-fips:1.10.0")))
+		})
+
+		It("should return an error when FIPS image environment variables are missing", func() {
+			_ = os.Setenv("KYMA_FIPS_MODE_ENABLED", "true")
+			_ = os.Unsetenv("pilot-fips")
+			_ = os.Unsetenv("install-cni-fips")
+			_ = os.Unsetenv("proxyv2-fips")
+			_ = os.Unsetenv("ztunnel-fips")
+
+			_, err := images.GetImages()
+			Expect(err).To(HaveOccurred())
+			Expect(err.Error()).To(ContainSubstring("environment variable \"pilot-fips\" should not be empty"))
+			Expect(err.Error()).To(ContainSubstring("environment variable \"install-cni-fips\" should not be empty"))
+			Expect(err.Error()).To(ContainSubstring("environment variable \"proxyv2-fips\" should not be empty"))
+			Expect(err.Error()).To(ContainSubstring("environment variable \"ztunnel-fips\" should not be empty"))
+		})
+	})
+
+	Context("when KYMA_FIPS_MODE_ENABLED is false", func() {
+		It("should use standard images", func() {
+			_ = os.Setenv("KYMA_FIPS_MODE_ENABLED", "false")
+			_ = os.Setenv("pilot-fips", "docker.io/istio/pilot-fips:1.10.0")
+			_ = os.Setenv("install-cni-fips", "docker.io/istio/cni-fips:1.10.0")
+			_ = os.Setenv("proxyv2-fips", "docker.io/istio/proxyv2-fips:1.10.0")
+			_ = os.Setenv("ztunnel-fips", "docker.io/istio/ztunnel-fips:1.10.0")
+
+			e, err := images.GetImages()
+			Expect(err).NotTo(HaveOccurred())
+			Expect(e.Pilot).To(Equal(images.Image("docker.io/istio/pilot:1.10.0")))
+			Expect(e.InstallCNI).To(Equal(images.Image("docker.io/istio/cni:1.10.0")))
+			Expect(e.ProxyV2).To(Equal(images.Image("docker.io/istio/proxyv2:1.10.0")))
+			Expect(e.Ztunnel).To(Equal(images.Image("docker.io/istio/ztunnel:1.10.0")))
+
+		})
+	})
+})