fix(operator): set GODEBUG explicitly even when fipsMode=off

[nshidlansik]

What does this PR do?

Fixes a bug in the FIPS 140-3 support added by #335: fipsMode: off (the
chart default) silently ran the operator with FIPS mode enabled instead of
disabled.

GOFIPS140=v1.0.0 at build time makes the operator binary's own compiled-in
GODEBUG default fips140=on (per Go's own docs: GOFIPS140 "enable[s]
FIPS 140-3 mode by default", and the fips140 GODEBUG option "defaults to
off unless GOFIPS140 is set at build time"). deployment.yaml wrapped the
GODEBUG env var in {{- if ne .Values.fipsMode "off" }} to avoid setting
it unnecessarily, per review on #335. That meant fipsMode=off set no
GODEBUG at all, so the binary fell through to its compiled-in default of
fips140=on instead of actually running off.

Found by Aviad Hayumi in review after #335 merged.

Fix: add a godebug fips140=off directive to operator/go.mod, which
overrides GOFIPS140's default back to off at compile time. The chart's
{{- if ne .Values.fipsMode "off" }} guard is kept as-is (an earlier version
of this PR removed it and always rendered GODEBUG instead, but fixing the
binary's own default is more direct and keeps the chart's original,
reviewed-and-requested shape).

Verified with crypto/fips140.Enabled() run inside the operator module:

GOFIPS140=v1.0.0, no GODEBUG at runtime -> Enabled() == false (was true before this fix)
GOFIPS140=v1.0.0, GODEBUG=fips140=on    -> Enabled() == true
GOFIPS140=v1.0.0, GODEBUG=fips140=only  -> Enabled() == true

Runtime GODEBUG still overrides the go.mod default, as expected.

Related issue(s)

Relates to #334

Checklist

• All commits are signed off with DCO (git commit -s)
• New/modified files have SPDX license and copyright headers
• Documentation updated (if applicable)
• Tests pass (make check)
• No proprietary or internal information included

Summary by CodeRabbit

• Configuration
  • Updated runtime configuration to disable FIPS 140 mode.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: c89cd6b4-8e73-41ac-a303-7fc4b83dfe6f

📥 Commits

Reviewing files that changed from the base of the PR and between 1d91de7 and 4e00a0d.

📒 Files selected for processing (1)

• operator/go.mod

Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review.

---

Walkthrough

The operator Go module adds a godebug fips140=off directive to disable FIPS 140 mode.

Changes

FIPS configuration

Layer / File(s)	Summary
Go module configuration operator/go.mod	Adds the godebug fips140=off directive to disable FIPS 140 mode for the module.

Priority: ⬇️ Low — Defer this narrow operator configuration fix because it only corrects the default FIPS mode behavior without supplied evidence of broader product impact.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to 4e00a

The operator now defaults FIPS mode to off while runtime configuration can still enable it. No merge-blocking risk remains.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: setting the operator's GODEBUG behavior so that FIPS remains explicitly disabled when fipsMode=off.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/operator-fips-default-on-when-off

---

_{A rabbit found a setting bright
FIPS now rests through module night
One small directive leads the way
The operator knows what to say
Hop, hop, configured today}

_{Comment @coderabbitai help to get the list of available commands.}

[yuval-gr]

The current fix works but leaves an unnecessary env var in place (my original comment). Please change it to GODEBUG=fips140=off as Aviad wrote above, and keep the if condition on the env var.