Uploaded image for project: 'Hybrid Cloud Console'
  1. Hybrid Cloud Console
  2. RHCLOUD-37818

Remove fips-detect from kessel dockerfiles

XMLWordPrintable

    • Icon: Story Story
    • Resolution: Done
    • Icon: Normal Normal
    • None
    • None
    • None
    • False
    • Hide

      None

      Show
      None
    • False
    • Unset
    • CRCPLAN-321 - Management Fabric | Enable Workspaces Features and UX in FedRAMP Production
    • None

      Repos to modify

      • inventory
      • relations
      • spicedb
      • spicedb-operator

      fips-detect does not appear to be compatible with how RHEL/UBI 9 are setting which openssl providers are used when running in "fips mode".

      fips-detect can be removed from dockerfiles

      Moving forward, the following should be used to determine fips mode with our images

      1. Reference the fips_enabled file that ubi9 creates for the host

      cat /proc/sys/crypto/fips_enabled

      2. Check go tool for the binary

      go tool nm /usr/local/bin/inventory-api | grep FIPS 

      3. Ensure openssl providers have a FIPS provider active

       

      sh-5.1$ openssl list -providers
      ...
        fips
          name: Red Hat Enterprise Linux 9 - OpenSSL FIPS Provider
          version: 3.0.7-395c1a240fbfffd8
          status: active 

       

       

       

       

              anatale.openshift Antony Natale
              rh-ee-tcreller Tyler Creller
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated:
                Resolved: