Use fips-140-3 compliance policy - #2217
Conversation
When Istio version > 1.30, `fips-140-3` policy should be used since Istio 1.31 is built with go1.26 and the upstream FIPS mode is certified for go1.26. Signed-off-by: Nick Fox <nfox@redhat.com>
Signed-off-by: Nick Fox <nfox@redhat.com>
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #2217 +/- ##
==========================================
+ Coverage 78.88% 83.37% +4.49%
==========================================
Files 59 60 +1
Lines 3272 2918 -354
==========================================
- Hits 2581 2433 -148
+ Misses 534 485 -49
+ Partials 157 0 -157
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
This uses the go std lib check for FIPS being enabled rather than the existing one which reads from the filesystem. Signed-off-by: Nick Fox <nfox@redhat.com>
| detectFipsMode(FipsEnableFilePath) | ||
| } | ||
| // This is separated out solely to let tests override it. | ||
| var fipsEnabled = fips140.Enabled |
There was a problem hiding this comment.
hmm. I'm not sure this is correct. Aren't we setting COMPLIANCE_POLICY now always, because FIPS in Go is enabled at build time? and won't that break the other TLS settings work?
There was a problem hiding this comment.
I'll revert this change. I don't think there's support for autodetecting FIPS from the hardware in upstream golang. Even if there was it shouldn't be included with this change.
There was a problem hiding this comment.
Reverted this part of the PR. Now this PR only is concerned with conditionally setting fips-140-3.
We can't use the stdlib package func because it doesn't check the underlying hardware. Signed-off-by: Nick Fox <nfox@redhat.com>
|
@nrfox: The following tests failed, say
DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
3 participants
What type of PR is this?
What this PR does / why we need it:
When Istio version > 1.30,
fips-140-3policy should be used since Istio 1.31 is built with go1.26 and go's FIPS mode is certified on platforms that have openssl crypto backends.Which issue(s) this PR fixes:
Fixes #
Related Issue/PR #
Additional information: