Aller au contenu principal

FIPS 140-2 Enablement

FIPS 140-2 is a U.S. Federal Government security standard used to approve cryptographic modules. This document explains how kubernetes is built with FIPS validated cryptographic libraries.

Use of FIPS Compatible Go compiler.​

The Go compiler in use can be found here. Each component of the system is built with the version of this compiler that matches the same standard Go compiler version that would be used otherwise.

This version of Go replaces the standard Go crypto libraries with the FIPS validated BoringCrypto module. See GoBoring's readme for more details. This module is validated by NIST as the BoringCrypto module on a wide range of systems.

FIPS Support in Cluster Components​

Most of the components of the Kubernetes system are statically compiled with the GoBoring Go compiler implementation. The list below contains the sections and associated components.

  • Kubernetes

    • API Server
    • Controller Manager
    • Scheduler
    • Kubelet
    • Kube Proxy
    • Metric Server
    • Kubectl

  • Helm Charts

    • CoreDNS

Runtime​

To ensure that all aspects of the system architecture are using FIPS 140-2 compliant algorithm implementations, the Kubernetes runtime contains utilities statically compiled with the FIPS enabled Go compiler for FIPS 140-2 compliance. This ensures that all levels of the stack are compliant from Kubernetes daemons to container orchestration mechanics.

  • etcd
  • containerd
    • containerd-shim
    • containerd-shim-runc-v1
    • containerd-shim-runc-v2
    • ctr
  • crictl
  • runc

Ingress​

Kubernetes ships with FIPS compliant NGINX as its default ingress provider. There are two primary sub-components for NGINX ingress:

  • controller - responsible for monitoring/updating Kubernetes resources and configuring the server accordingly
  • server - responsible for accepting and routing traffic

The controller is written in Go and as such is compiled using our FIPS compatible Go compiler.

The server is written in C and also requires OpenSSL to function properly. As such, it leverages a FIPS-validated version of OpenSSL to achieve FIPS compliance.