We need to switch the vm to fips mode during build of the podvm, as part of the kubernetes job.
We need to add an environment variable [here|https://github.com/confidential-containers/cloud-api-adaptor/blob/main/aws/image/rhel/aws-rhel.pkr.hcl) and in the equivalent file for AWS, that defines if the VM is supposed to be in fips mode or not. Then we can use this env var value in https://github.com/confidential-containers/cloud-api-adaptor/blob/main/azure/image/misc-settings.sh and run the
fips-mode-setup --enable
command in this context. The next time the vm is booted (i.e. when the peer pod is started) it will come up in fips mode.
So we need upstream changes in cloud-api-adaptor in the provider specific packer files and in the misc-settings.sh shell script. Snir agreed to work on these changes this week so we can get it into this release.
- links to
-
RHBA-2023:117874 RHBA: sandboxed-containers bug fix and enhancement update