Skip to content

[eck]: Document fips for 3.5.0 #7907

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
moukoublen merged 7 commits into from
Aug 18, 2026
Merged

[eck]: Document fips for 3.5.0 #7907

Changes from 4 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
6a9f4bc
[eck]: Document fips for 3.5.0
moukoublen Aug 11, 2026
c4174d2
fix product lifecycle term
moukoublen Aug 11, 2026
8f0a6e3
change wording
moukoublen Aug 11, 2026
74453bf
replace compliance with compatibility
moukoublen Aug 11, 2026
3aa25b1
Update deploy-manage/deploy/cloud-on-k8s/deploy-fips-compatible-versi…
moukoublen Aug 11, 2026
784d88f
Update deploy-manage/deploy/cloud-on-k8s/deploy-fips-compatible-versi…
moukoublen Aug 18, 2026
875f171
Merge branch 'main' into eck_fips_350
moukoublen Aug 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 4 additions & 3 deletions deploy-manage/deploy/cloud-on-k8s/deploy-fips-compatible-version-of-eck.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,17 +14,18 @@ products:

The Federal Information Processing Standard (FIPS) Publication 140-2, (FIPS PUB 140-2), titled "Security Requirements for Cryptographic Modules" is a U.S. government computer security standard used to approve cryptographic modules. Since version 2.6 ECK offers a FIPS-enabled image that is a drop-in replacement for the standard image.

For the ECK operator, adherence to FIPS 140-2 is ensured by:
For the ECK operator, FIPS compatibility is ensured by:

* Using FIPS approved / NIST recommended cryptographic algorithms.
* Compiling the operator using the [BoringCrypto](https://github.com/golang/go/blob/dev.boringcrypto/README.boringcrypto.md) library for various cryptographic primitives.
* {applies_to}`eck: ga 3.5` Using Go's native [FIPS 140-3 cryptographic module](https://go.dev/doc/security/fips140). The build pins the Go Cryptographic Module at v1.0.0 ([CMVP Certificate #5247](https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/5247)), which is the certified version.
Comment thread
moukoublen marked this conversation as resolved.
Outdated
* {applies_to}`eck: deprecated 3.5` Compiling the operator using the [BoringCrypto](https://github.com/golang/go/blob/dev.boringcrypto/README.boringcrypto.md) library for various cryptographic primitives.
Comment thread
moukoublen marked this conversation as resolved.
Outdated

::::{warning}
Due to a build configuration issue, ECK operator images published between versions 2.9.0 and 3.3.1 use the standard Go cryptography library instead of BoringCrypto. Standard Go **does not use FIPS 140-2/3 validated cryptographic libraries**. Upgrade to version 3.3.2 or later to get images built using FIPS 140-2/3 validated cryptographic libraries.
::::

:::{important}
This page covers FIPS compliance for the ECK operator only. Making your managed {{es}} clusters FIPS-compliant requires additional configuration for each {{es}} node, including:
This page covers FIPS compatibility for the ECK operator only. Making your managed {{es}} clusters FIPS-compatible requires additional configuration for each {{es}} node, including:

* `xpack.security.fips_mode.enabled: true`
* An external JDK with a FIPS-certified security provider
Expand Down
Loading