Details
-
Task
-
Resolution: Unresolved
-
Blocker
-
3.6.0.GA
-
False
-
None
-
False
-
-
Known Issue
-
Done
Description
Dev Spaces 3.7.1 is FIPS compliant, but there are a few known issues that need to be documented / explained.
The statically linked binaries listed below are not related to cryptography so are irrelevant for FIPS compliance.
- code-rhel8 container
- This container includes the ripgrep prebuilt binary `rg`, used for regex searching. As the executable is statically linked, the check-payload scanner will throw an error, but this can be safely ignored as long as you're not using ripgrep to do anything related to cryptography or SSL.
- idea-rhel8 container
- The container includes the `repair` binary, which appears to be used to troubleshoot issues with unresolved code or corrupted caches in your project, without invalidating the cache and restarting the IDE. As other processes exist for debugging, one could simply avoid using this command and therefore not need to worry about a statically linked binary in a FIPS environment. That said, this container is a Technology Preview and is therefore no FIPS-compliance statement is being made.
The Universal Developer Image has two caveats with respect to FIPS support:
- udi-rhel8 container
- This container includes the `helm` binary, which was not compiled with FIPS support. If you are in a FIPS environment do not use `helm`.
- This container includes a golang compiler, which was built without the `CGO_ENABLED=1` flag. The check-payload scanner will throw an error, but this can be safely ignored as long as anything you build with this compiler sets the correct `CGO_ENABLED=1`flag, and does NOT use `extldflags -static` or `-tags no_openssl`. Resulting binaries can be scanned and should pass without error.
Other updates required to enable FIPS include:
- devworkspace operator
- This operator also includes a FIPS-related fix, which is required to be updated in your cluster along with Dev Spaces.
- OCP installation itself
- Testing and support for FIPS is only available on OCP 4.10.z-4.12.z. You must update to the latest z-stream OCP update. Enabling FIPS is a "day 1" operation: to enable or disable FIPS you need to uninstall and reinstall the cluster. (ref: https://access.redhat.com/solutions/5594191)
