Reduce memory consumption of pinniped-concierge-kube-cert-agent binary

Co-authored-by: Joshua Casey <joshuatcasey@gmail.com>

internal/crypto/fips/doc.go

@@ -0,0 +1,6 @@
+// Copyright 2023 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+// Package fips can be imported to enable fipsonly tls mode when compiling with fips_strict.
+// It will also cause cgo to be explicitly imported when compiling with fips_strict.
+package fips

internal/crypto/fips/fips_strict.go

@@ -0,0 +1,12 @@
+// Copyright 2023 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+//go:build fips_strict
+// +build fips_strict
+
+package fips
+
+import (
+	"C"                     // explicitly import cgo so that runtime/cgo gets linked into the kube-cert-agent
+	_ "crypto/tls/fipsonly" // restricts all TLS configuration to FIPS-approved settings.
+)

internal/crypto/ptls/fips_strict.go

@@ -1,4 +1,4 @@
-// Copyright 2022 the Pinniped contributors. All Rights Reserved.
+// Copyright 2022-2023 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 // The configurations here override the usual ptls.Secure, ptls.Default, and ptls.DefaultLDAP
@@ -16,11 +16,10 @@ import (
 	"path/filepath"
 	"runtime"
 
-	"C"                     // explicitly import cgo so that runtime/cgo gets linked into the kube-cert-agent
-	_ "crypto/tls/fipsonly" // restricts all TLS configuration to FIPS-approved settings.
-
 	"k8s.io/apiserver/pkg/server/options"
 
+	// Cause fipsonly tls mode with this side effect import.
+	_ "go.pinniped.dev/internal/crypto/fips"
 	"go.pinniped.dev/internal/plog"
 )