Uploaded image for project: 'OpenShift GitOps'
  1. OpenShift GitOps
  2. GITOPS-6365

FIPS enablement : Enable FIPS compliant build for GitOps Components

XMLWordPrintable

    • FIPS enablement : Enable FIPS compliant build for GitOps Components
    • 3
    • False
    • None
    • False
    • In Progress
    • SECFLOWOTL-108 - FIPS Support - GitOps
    • 6% To Do, 12% In Progress, 82% Done
    • Hide
      FIPS readiness
      Red Hat OpenShift GitOps is designed for FIPS. When running on Red Hat OpenShift Container Platform in FIPS mode, OpenShift Container Platform uses the Red Hat Enterprise Linux cryptographic libraries submitted to NIST for FIPS Validation on only the architectures that are supported by OpenShift Container Platform. For more information about the NIST validation program, see Cryptographic Module Validation Program. For the latest NIST status for the individual versions of the RHEL cryptographic libraries submitted for validation, see Compliance Activities and Government Standards.

      If you plan to manage clusters with FIPS enabled, you must install Red Hat OpenShift on an OpenShift Container Platform cluster configured to operate in FIPS mode.

      To enable FIPS mode on your managed clusters, set fips: true when you provision your OpenShift Container Platform managed cluster. You cannot enable FIPS after you provision your cluster. For more information, see OpenShift Container Platform documentation, https://access.redhat.com/documentation/en-us/openshift_container_platform/4.11/html-single/installing/index#installing-preparing-security
      Show
      FIPS readiness Red Hat OpenShift GitOps is designed for FIPS. When running on Red Hat OpenShift Container Platform in FIPS mode, OpenShift Container Platform uses the Red Hat Enterprise Linux cryptographic libraries submitted to NIST for FIPS Validation on only the architectures that are supported by OpenShift Container Platform. For more information about the NIST validation program, see Cryptographic Module Validation Program. For the latest NIST status for the individual versions of the RHEL cryptographic libraries submitted for validation, see Compliance Activities and Government Standards. If you plan to manage clusters with FIPS enabled, you must install Red Hat OpenShift on an OpenShift Container Platform cluster configured to operate in FIPS mode. To enable FIPS mode on your managed clusters, set fips: true when you provision your OpenShift Container Platform managed cluster. You cannot enable FIPS after you provision your cluster. For more information, see OpenShift Container Platform documentation, https://access.redhat.com/documentation/en-us/openshift_container_platform/4.11/html-single/installing/index#installing-preparing-security
    • Feature
    • Proposed

      Epic Goal

      Make the Argo CD container image for RHEL 8 and RHEL 9, from CPaaS and Konflux CI systems, FIPS compliant

       

      Technical Work

      • Build git-lfs from source instead of installing pre-build rpm binaries from Red Hat registries which are not FIPS compliant.
      • Enable CGO builds by setting environment variable CGO_ENABLED=1
      • Enable Strict FIPS compliance by setting environment variable GO_EXPERIMENT=strictfipsruntime.
      • Set build tags to include strictfipsruntime when building the binaries using go build
        • For eg:  go build -tags strictfipstruntime cmd/main.go
      • Ensure that the base image for go build phase use the latest golang 1.22 based images which has the required go-toolset for ensuring FIPS compliance.
      • Ensure that the flags for static linking is not present in the go build command (e.g. -ldflags '-extldflags "-static"')

      Binaries to build for FIPS compliance.

      • argocd
      • kustomize
      • helm
      • git-lfs

      NOTE: If some of the upstream projects does not the required overrides for enabling these compiler options, make the required changes upstream and use those overrides for building the binaries in the downstream Dockerfile.

      Acceptance Criteria

      • Use the new check tool to scan images
        https://github.com/openshift/check-payload : Checks CGO_ENABLED=1 , presence of openssl, strictfipsruntime tag, no_openssl tag, dynamic linking
      • All existing acceptance tests should pass when run against an OCP cluster with FIPS enabled.
      • All existing acceptance tests should pass when run against an OCP cluster with FIPS enabled.

              rh-ee-anjoseph Anand Francis Joseph
              rh-ee-anjoseph Anand Francis Joseph
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated:
                Resolved: