Background
OSSM-12226 validated Envoy (C++/OpenSSL) crypto behavior on RHEL 10. Now we need to validate istiod (Go/crypto-tls) since Go has different system crypto policy interaction.
Investigation Questions
|
Question |
| Q1 |
Does istiod bypass system crypto policy, or respect it? |
| Q2 |
How does FIPS mode affect istiod behavior? |
| Q3 |
Is there a crypto/TLS config override in istiod? |
| Q4 |
What's the interaction with RHEL 10 DEFAULT policy? |
Success Criteria
- All 4 questions answered with evidence
- RHEL 9 vs RHEL 10 comparison table
- Clear PASS/FAIL verdict
Test Environment
| Aspect |
RHEL 9 |
RHEL 10 |
| OpenShift |
4.20.8 |
4.21.0-rc.2 |
| FIPS |
Enabled |
Enabled |
| OSSM |
3.2.1 |
3.2.1 |
Related
- OSSM-12226 - Envoy crypto investigation (completed)
Task
Undefined
OSSM-9100 RHEL 10 Readiness
