Enable FIPS in documentation examples#306
Conversation
| A user wants to customize and produce a RAW image that will be running an operating system, Kubernetes distribution and Rancher version that are supported by the aforementioned consumer product. | ||
|
|
||
| Furthermore, using this image, the user wants to setup a multi-node Kubernetes cluster that will be extended with the `NeuVector` Helm chart along with a specific set of Kubernetes manifests that will enable access to the Rancher UI. | ||
| Furthermore, using this image, the user wants to enable compliance with FIPS and setup a multi-node Kubernetes cluster that will be extended with the `NeuVector` Helm chart along with a specific set of Kubernetes manifests that will enable access to the Rancher UI. |
There was a problem hiding this comment.
I would highly appreciate to have a small caveat here that mentions that enabling fips mode is not just for the host, it expands to the workload also which might not be fips ready and then will not run.
there fore I would also suggest to only enable cryptoPolicy: fips in the linux-only usecase.
There was a problem hiding this comment.
Since we are controlling the example use-cases from config-dir -> image build -> image boot, IMO it is safe enough to keep the FIPS option enabled by default for the examples. That way we are actually showcasing FIPS and not having users guess how to set it up.
I can have a better explanation of the use-case here, as well as add information that FIPS will be enabled on the full setup (control-plane + workloads). Furthermore I can add a comment on each cryptoPolicy: configuration in install.yaml file saying that if for some reason you are not following the examples directory, you need to be aware that your full setup can support FIPS. Also I can further explain that we are enabling FIPS on the install.yaml explanation of each config directory overview. WDYT?
There was a problem hiding this comment.
either place is fine, basically it might not be obvious that the host setup leaks to the workload
There was a problem hiding this comment.
Cool, I'll add the additional information asap.
There was a problem hiding this comment.
Added the additional clarification comments and documentation, please take a look at let me know what you think.
3 participants
This PR enables the
fipscrypto policy by default in our examples, showcasing a larger range of elemental's functionality.