Our understanding:

• We need to ensure our downstream images are using UBI8
• We need to ensure we are using the openshift golang builders
• We need to audit our Operator, Velero, and Plugin images to check if any other crypto libraries are used which are not already covered by the UBI/FIPS crypto

See below for information on enabling FIPS compliance

• FIPS FAQ For Product Engineering
• Internal FAQ on OCP 4 & FIPS

arewm shared the below info for us to see another example
Gatekeeper's config [1] and midstream [2].
 
[1]: https://gitlab.cee.redhat.com/cpaas-products/gatekeeper/-/tree/release-2.3
[2]: https://code.engineering.redhat.com/gerrit/plugins/gitiles/gatekeeper/+/refs/heads/rhacm-2.3-rhel-8