mirrors/pinniped
1
0
Fork 0
mirror of https://github.com/vmware-tanzu/pinniped.git synced 2026-07-20 23:12:40 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

update FIPS docs

Browse Source 
Signed-off-by: Ryan Richard <richardry@vmware.com>
This commit is contained in:
Ryan Richard
2026-06-19 14:01:09 -07:00
parent a6fca1d101
commit fdbaaad26f
2 changed files with 39 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hack/Dockerfile_fips
+3
View File
@@ -3,6 +3,9 @@
# Copyright 2022-2026 the Pinniped contributors. All Rights Reserved.
# SPDX-License-Identifier: Apache-2.0
# Note: This dockerfile is for using boring crypto. If you would like to
# use Go's built-in GOFIPS140 instead, please use the top-level Dockerfile.
# this dockerfile is used to produce a binary of Pinniped that uses
# only fips-allowable ciphers. Note that this is provided only as
# an example. Pinniped has no official support for fips and using
site/content/docs/reference/fips.md
+36 -7
View File
@@ -10,23 +10,52 @@ menu:
parent: reference
---
By default, the Pinniped supervisor and concierge use ciphers that
are not supported by FIPS 140-2. If you are deploying Pinniped in an
are not supported by FIPS 140-2 or 140-3. If you are deploying Pinniped in an
environment with FIPS compliance requirements, you will have to build
the binaries yourself using the `fips_strict` build tag and Golang's
`GOEXPERIMENT=boringcrypto` compiler option.
the binaries yourself.
The Pinniped team provides an [example Dockerfile](https://github.com/vmware/pinniped/blob/main/hack/Dockerfile_fips)
demonstrating how you can build Pinniped images in a FIPS compatible way.
However, we do not provide official support for FIPS configuration.
The open source Pinniped project does not provide official support for FIPS configuration.
We provide this for informational purposes only.
To build Pinniped use our example FIPS Dockerfile, you can run:
There are two options for building FIPS-compatible server binaries.
## Using Go's GOFIPS140
The top-level [Dockerfile](https://github.com/vmware/pinniped/blob/main/Dockerfile) has a build arg to allow you
to optionally enable GOFIPS140. Before choosing which value to set for this build arg, please refer to the
Go [announcement of GOFIPS140](https://go.dev/blog/fips140) and [documentation for GOFIPS140](https://go.dev/doc/security/fips140).
## The old option: Using boring crypto
The Pinniped team provides an [example Dockerfile](https://github.com/vmware/pinniped/blob/main/hack/Dockerfile_fips)
demonstrating how you can build Pinniped images using boring crypto.
This sample dockerfile uses the `fips_strict` build tag and Golang's `GOEXPERIMENT=boringcrypto` compiler option.
Note that the Go team has announced the deprecation of their support for boring crypto, so this method may
stop working in some future version of Go.
## The build commands
To build the Pinniped container image, first clone and repo and checkout the release tag:
```bash
$ git clone git@github.com:vmware/pinniped.git
$ cd pinniped
$ git checkout {{< latestversion >}}
```
If you choose to use GOFIPS140, then choose the value of GOFIPS140 that you prefer and run:
```bash
# For example, if you prefer to use "certified"...
$ docker build . --build-arg "GOFIPS140=certified"
```
If you choose to use the old boring crypto, then instead run:
```bash
$ docker build -f hack/Dockerfile_fips .
```
Push the image to your preferred container image repository.
Now you can deploy [the concierge]({{< ref "install-concierge" >}}) and [the supervisor]({{< ref "install-supervisor" >}})
by specifying this image instead of the standard Pinniped image in your `values.yaml` or `deployment.yaml` file.