Context

• In order to address security requirements images for our products should comply with FIPS as described here: https://docs.google.com/presentation/d/1o3IowxHX6BsnxGkIInaQ0lBgnn_K5Ex8jxwCYCeNsqs/edit#slide=id.g2679cb578c3_0_10

Outcomes

• all dynamic plugins owned by our team are FIPS compliant
  • all dynamic plugins do not include Not compliant build options for Go
• Dynamic plugins list to be checked
  • Troubleshooting panel
  • Logging
  • Monitoring
  • Dashboards
  • Distributed tracing

Steps

1. Remove not compliant build options for Go
2. Sync with QE to test in a FIPS compliant OS using the FIPS or Die feature, check if this tests can be automated
3. Update COO midstream with the fix commit

Acceptance Criteria

1. All golang-based containers use the ENV GOEXPERIMENT=strictfipsruntime.
2. All golang-based containers use the ENV CGO_ENABLED=1.
3. All golang-based containers use the build tag strictfipsruntime.
4. All golang-based containers omit using static linking.
5. All golang-based container omit using the build tag no_openssl.
6. All containers use a runner base RHEL ELS image:  e.g. registry.redhat.io/rhel9-4-els/rhel:9.4
7. All images pass the check-payload checks successfully.