Build the operator for FIPS enabled environments #456
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
rhmdnd
requested review from
yuumasato and
xiaojiey
and removed request for
jhrozek
This commit includes a file that allows strict usage of algorithms for FIPS. This was copied for openshift/boilerplate, which includes some scripts for enabling FIPS-compliant container image builds. Since we're not using boilerplate, this just copies the file over, but ultimately does the same thing as what boilerplate is doing. To build with strict FIPS runtimes, enable CGO and use the `strictfipsruntime` Go experimenal variable with a compiler that supports it.
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: rhmdnd, Vincent056 The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This commit does a few things to make sure the Compliance Operator is built
so that it can run in FIPS-enabled clusters.
links dynamically to the necessary openssl libraries
feature
The ubi9-micro image we were using was ideal for minimal dependencies,
but it doesn't include openssl, which we need to support FIPS. This
commit changes the operator container image to fix this.
Set CGO_ENABLE=1 so that go can link dynamically to the openssl library.
Use an image from app-sre/boilerplate to build the operator binary. This
is needed so that golang links the necessary libraries.
Set the appropriate golang experimental flags at build time so the
complier knows to build for FIPS-enabled clusters. The other part of
this change is a golang file we need to keep in-tree. If we're missing
either, the build won't produce container images for FIPS-enabled
environments.
This commit is a smattering of openshift/boilerplate code that enables
FIPS for operator builds. Eventually, we should reconsider maintaining
our hand-rolled Makefiles for boilerplate, which contains handy tools
and scripts for maintaining common operator components.