feat(operator): support FIPS 140-3 runtime mode (v0.2 backport) - #348
Merged
Conversation
Reduced-scope backport of the FIPS 140-3 support added to main in #335. v0.2 predates the crd-upgrader Job and webhook support that #335 also touched, so this backport is operator-only: - Pins GOFIPS140=v1.0.0 in operator/Dockerfile so the Go toolchain's CMVP-validated FIPS 140-3 crypto module is always linked into the operator binary. - Adds a fipsMode chart value (off/on/only, default off, validated via a shared karta.validateFipsMode helper) that sets GODEBUG=fips140=<mode> on the operator container. - Adds --attest type=sbom to operator/Makefile's docker-buildx-push. - Adds docs/FIPS.md, trimmed to the operator-only scope (no crd-upgrader or tlsmlkem content, since that Job does not exist on this branch). Relates to #334 Signed-off-by: Nir Shidlansik <nshidlansik@nvidia.com>
nshidlansik
requested review from
AviadHayumi,
Isan-Rivkin,
rogirun,
ronlv10,
shaked-bouktus and
yuval-gr
as code owners
September 8, 2026 13:25
Signed-off-by: Nir Shidlansik <nshidlansik@nvidia.com>
rogirun
approved these changes
Sep 8, 2026
Same fix as the main-branch backport source: GOFIPS140=v1.0.0 at build
time makes the operator binary's own compiled-in GODEBUG default
fips140=on, so wrapping the GODEBUG env var in
{{- if ne .Values.fipsMode "off" }} meant fipsMode=off (the chart
default) set no GODEBUG at all and fell through to the compiled-in
on default. off and on were identical; every default install silently
ran FIPS self-tests and the FIPS-restricted TLS cipher/curve list.
Always render GODEBUG explicitly so fipsMode maps to the runtime mode
it names.
Found by Aviad Hayumi in review after #335 (the main-branch source of
this backport) merged.
Signed-off-by: Nir Shidlansik <nshidlansik@nvidia.com>
AviadHayumi
approved these changes
Sep 8, 2026
yuval-gr
reviewed
Sep 8, 2026
| - name: {{ .Chart.Name }} | ||
| image: "{{ required "image.repository is required" .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}" | ||
| imagePullPolicy: {{ .Values.image.pullPolicy }} | ||
| env: |
Collaborator
There was a problem hiding this comment.
The current fix works but leaves an unnecessary env var in place (my original comment). Please change it to GODEBUG=fips140=off as Aviad wrote above, and keep the if condition on the env var.
5 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Reduced-scope backport of the FIPS 140-3 support added to
mainin #335.v0.2predates thecrd-upgraderJob and webhook support that #335 alsotouched, so this backport is operator-only:
GOFIPS140=v1.0.0inoperator/Dockerfileso the Go toolchain'sCMVP-validated FIPS 140-3 crypto module is always linked into the operator
binary.
fipsModechart value (off/on/only, defaultoff,validated via a shared
karta.validateFipsModehelper) that setsGODEBUG=fips140=<mode>on the operator container.--attest type=sbomtooperator/Makefile'sdocker-buildx-push.docs/FIPS.md, trimmed to this operator-only scope: nocrd-upgraderortlsmlkemcontent, since that Job and the TLS-curveworkaround it needed do not apply on this branch.
Related issue(s)
Relates to #334
Checklist
git commit -s)docs/FIPS.md,README.md)make check)