Skip to content

Switch to use Go 1.24+ runtime FIPS support. #783

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
sky1122 wants to merge 2 commits into
base: develop
Choose a base branch
from
Open

Switch to use Go 1.24+ runtime FIPS support. #783

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7bb958f
release: add Go FIPS 140-3 runtime support for FIPS variants
sky1122 Dec 22, 2025
5074097
[skip ci]kubernetes: switch to runtime FIPS instead of compile-time b…
sky1122 Dec 22, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 2 additions & 8 deletions packages/kubernetes-1.29/kubernetes-1.29.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -160,11 +160,6 @@ export KUBE_CGO_OVERRIDES="kube-proxy"
make WHAT="cmd/kubelet"
make WHAT="cmd/kube-proxy"

export KUBE_OUTPUT_SUBPATH="_fips_output/local"
export GOEXPERIMENT="boringcrypto"
make WHAT="cmd/kubelet"
make WHAT="cmd/kube-proxy"

# build the pause container
cd build/pause/linux/

Expand All @@ -188,10 +183,9 @@ install -d %{buildroot}%{_cross_bindir}
install -p -m 0755 ${output}/kubelet %{buildroot}%{_cross_bindir}
install -p -m 0755 ${output}/kube-proxy %{buildroot}%{_cross_bindir}

fips_output="./_fips_output/local/bin/linux/%{_cross_go_arch}"
install -d %{buildroot}%{_cross_fips_bindir}
install -p -m 0755 ${fips_output}/kubelet %{buildroot}%{_cross_fips_bindir}
install -p -m 0755 ${fips_output}/kube-proxy %{buildroot}%{_cross_fips_bindir}
install -p -m 0755 ${output}/kubelet %{buildroot}%{_cross_fips_bindir}
install -p -m 0755 ${output}/kube-proxy %{buildroot}%{_cross_fips_bindir}

install -d %{buildroot}%{_cross_unitdir}
install -p -m 0644 %{S:1} %{S:10} %{S:13} %{buildroot}%{_cross_unitdir}
Expand Down
10 changes: 2 additions & 8 deletions packages/kubernetes-1.30/kubernetes-1.30.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -161,11 +161,6 @@ export KUBE_CGO_OVERRIDES="kube-proxy"
make WHAT="cmd/kubelet"
make WHAT="cmd/kube-proxy"

export KUBE_OUTPUT_SUBPATH="_fips_output/local"
export GOEXPERIMENT="boringcrypto"
make WHAT="cmd/kubelet"
make WHAT="cmd/kube-proxy"

# build the pause container
cd build/pause/linux/

Expand All @@ -189,10 +184,9 @@ install -d %{buildroot}%{_cross_bindir}
install -p -m 0755 ${output}/kubelet %{buildroot}%{_cross_bindir}
install -p -m 0755 ${output}/kube-proxy %{buildroot}%{_cross_bindir}

fips_output="./_fips_output/local/bin/linux/%{_cross_go_arch}"
install -d %{buildroot}%{_cross_fips_bindir}
install -p -m 0755 ${fips_output}/kubelet %{buildroot}%{_cross_fips_bindir}
install -p -m 0755 ${fips_output}/kube-proxy %{buildroot}%{_cross_fips_bindir}
install -p -m 0755 ${output}/kubelet %{buildroot}%{_cross_fips_bindir}
install -p -m 0755 ${output}/kube-proxy %{buildroot}%{_cross_fips_bindir}

install -d %{buildroot}%{_cross_unitdir}
install -p -m 0644 %{S:1} %{S:10} %{S:13} %{buildroot}%{_cross_unitdir}
Expand Down
10 changes: 2 additions & 8 deletions packages/kubernetes-1.31/kubernetes-1.31.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -161,11 +161,6 @@ export KUBE_CGO_OVERRIDES="kube-proxy"
make WHAT="cmd/kubelet"
make WHAT="cmd/kube-proxy"

export KUBE_OUTPUT_SUBPATH="_fips_output/local"
export GOEXPERIMENT="boringcrypto"
make WHAT="cmd/kubelet"
make WHAT="cmd/kube-proxy"

# build the pause container
cd build/pause/linux/

Expand All @@ -189,10 +184,9 @@ install -d %{buildroot}%{_cross_bindir}
install -p -m 0755 ${output}/kubelet %{buildroot}%{_cross_bindir}
install -p -m 0755 ${output}/kube-proxy %{buildroot}%{_cross_bindir}

fips_output="./_fips_output/local/bin/linux/%{_cross_go_arch}"
install -d %{buildroot}%{_cross_fips_bindir}
install -p -m 0755 ${fips_output}/kubelet %{buildroot}%{_cross_fips_bindir}
install -p -m 0755 ${fips_output}/kube-proxy %{buildroot}%{_cross_fips_bindir}
install -p -m 0755 ${output}/kubelet %{buildroot}%{_cross_fips_bindir}
install -p -m 0755 ${output}/kube-proxy %{buildroot}%{_cross_fips_bindir}

install -d %{buildroot}%{_cross_unitdir}
install -p -m 0644 %{S:1} %{S:10} %{S:13} %{buildroot}%{_cross_unitdir}
Expand Down
10 changes: 2 additions & 8 deletions packages/kubernetes-1.32/kubernetes-1.32.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -160,11 +160,6 @@ export KUBE_CGO_OVERRIDES="kube-proxy"
make WHAT="cmd/kubelet"
make WHAT="cmd/kube-proxy"

export KUBE_OUTPUT_SUBPATH="_fips_output/local"
export GOEXPERIMENT="boringcrypto"
make WHAT="cmd/kubelet"
make WHAT="cmd/kube-proxy"

# build the pause container
cd build/pause/linux/

Expand All @@ -188,10 +183,9 @@ install -d %{buildroot}%{_cross_bindir}
install -p -m 0755 ${output}/kubelet %{buildroot}%{_cross_bindir}
install -p -m 0755 ${output}/kube-proxy %{buildroot}%{_cross_bindir}

fips_output="./_fips_output/local/bin/linux/%{_cross_go_arch}"
install -d %{buildroot}%{_cross_fips_bindir}
install -p -m 0755 ${fips_output}/kubelet %{buildroot}%{_cross_fips_bindir}
install -p -m 0755 ${fips_output}/kube-proxy %{buildroot}%{_cross_fips_bindir}
install -p -m 0755 ${output}/kubelet %{buildroot}%{_cross_fips_bindir}
install -p -m 0755 ${output}/kube-proxy %{buildroot}%{_cross_fips_bindir}

install -d %{buildroot}%{_cross_unitdir}
install -p -m 0644 %{S:1} %{S:10} %{S:13} %{buildroot}%{_cross_unitdir}
Expand Down
10 changes: 2 additions & 8 deletions packages/kubernetes-1.33/kubernetes-1.33.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -162,11 +162,6 @@ export KUBE_CGO_OVERRIDES="kube-proxy"
make WHAT="cmd/kubelet"
make WHAT="cmd/kube-proxy"

export KUBE_OUTPUT_SUBPATH="_fips_output/local"
export GOEXPERIMENT="boringcrypto"
make WHAT="cmd/kubelet"
make WHAT="cmd/kube-proxy"

# build the pause container
cd build/pause/linux/

Expand All @@ -190,10 +185,9 @@ install -d %{buildroot}%{_cross_bindir}
install -p -m 0755 ${output}/kubelet %{buildroot}%{_cross_bindir}
install -p -m 0755 ${output}/kube-proxy %{buildroot}%{_cross_bindir}

fips_output="./_fips_output/local/bin/linux/%{_cross_go_arch}"
install -d %{buildroot}%{_cross_fips_bindir}
install -p -m 0755 ${fips_output}/kubelet %{buildroot}%{_cross_fips_bindir}
install -p -m 0755 ${fips_output}/kube-proxy %{buildroot}%{_cross_fips_bindir}
install -p -m 0755 ${output}/kubelet %{buildroot}%{_cross_fips_bindir}
install -p -m 0755 ${output}/kube-proxy %{buildroot}%{_cross_fips_bindir}

install -d %{buildroot}%{_cross_unitdir}
install -p -m 0644 %{S:1} %{S:10} %{S:13} %{buildroot}%{_cross_unitdir}
Expand Down
10 changes: 2 additions & 8 deletions packages/kubernetes-1.34/kubernetes-1.34.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -162,11 +162,6 @@ export KUBE_CGO_OVERRIDES="kube-proxy"
make WHAT="cmd/kubelet"
make WHAT="cmd/kube-proxy"

export KUBE_OUTPUT_SUBPATH="_fips_output/local"
export GOEXPERIMENT="boringcrypto"
make WHAT="cmd/kubelet"
make WHAT="cmd/kube-proxy"

# build the pause container
cd build/pause/linux/

Expand All @@ -190,10 +185,9 @@ install -d %{buildroot}%{_cross_bindir}
install -p -m 0755 ${output}/kubelet %{buildroot}%{_cross_bindir}
install -p -m 0755 ${output}/kube-proxy %{buildroot}%{_cross_bindir}

fips_output="./_fips_output/local/bin/linux/%{_cross_go_arch}"
install -d %{buildroot}%{_cross_fips_bindir}
install -p -m 0755 ${fips_output}/kubelet %{buildroot}%{_cross_fips_bindir}
install -p -m 0755 ${fips_output}/kube-proxy %{buildroot}%{_cross_fips_bindir}
install -p -m 0755 ${output}/kubelet %{buildroot}%{_cross_fips_bindir}
install -p -m 0755 ${output}/kube-proxy %{buildroot}%{_cross_fips_bindir}

install -d %{buildroot}%{_cross_unitdir}
install -p -m 0644 %{S:1} %{S:10} %{S:13} %{buildroot}%{_cross_unitdir}
Expand Down
10 changes: 2 additions & 8 deletions packages/kubernetes-1.35/kubernetes-1.35.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -162,11 +162,6 @@ export KUBE_CGO_OVERRIDES="kube-proxy"
make WHAT="cmd/kubelet"
make WHAT="cmd/kube-proxy"

export KUBE_OUTPUT_SUBPATH="_fips_output/local"
export GOEXPERIMENT="boringcrypto"
make WHAT="cmd/kubelet"
make WHAT="cmd/kube-proxy"

# build the pause container
cd build/pause/linux/

Expand All @@ -190,10 +185,9 @@ install -d %{buildroot}%{_cross_bindir}
install -p -m 0755 ${output}/kubelet %{buildroot}%{_cross_bindir}
install -p -m 0755 ${output}/kube-proxy %{buildroot}%{_cross_bindir}

fips_output="./_fips_output/local/bin/linux/%{_cross_go_arch}"
install -d %{buildroot}%{_cross_fips_bindir}
install -p -m 0755 ${fips_output}/kubelet %{buildroot}%{_cross_fips_bindir}
install -p -m 0755 ${fips_output}/kube-proxy %{buildroot}%{_cross_fips_bindir}
install -p -m 0755 ${output}/kubelet %{buildroot}%{_cross_fips_bindir}
install -p -m 0755 ${output}/kube-proxy %{buildroot}%{_cross_fips_bindir}

install -d %{buildroot}%{_cross_unitdir}
install -p -m 0644 %{S:1} %{S:10} %{S:13} %{buildroot}%{_cross_unitdir}
Expand Down
4 changes: 4 additions & 0 deletions packages/release/fips-go.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
[Service]
# Enable Go FIPS 140-3 mode for all services. This restricts Go's crypto
# packages to use only FIPS-approved algorithms.
Environment=GODEBUG=fips140=only
5 changes: 5 additions & 0 deletions packages/release/release.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -110,6 +110,7 @@ Source1108: systemd-sysusers-selinux.conf
Source1109: modprobe-no-exit.conf
Source1110: tmp-mount-noexec.conf
Source1111: network-pre-target-dbus-dep.conf
Source1112: fips-go.conf

# network link rules
Source1200: 80-release.link
Expand Down Expand Up @@ -231,6 +232,9 @@ install -p -m 0644 %{S:81} %{buildroot}%{_cross_sysctldir}/81-release-swap.conf
install -d %{buildroot}%{_cross_unitdir}/service.d
install -p -m 0644 %{S:1104} %{buildroot}%{_cross_unitdir}/service.d/00-aws-config.conf

install -d %{buildroot}%{_cross_unitdir}/service.d
install -p -m 0644 %{S:1112} %{buildroot}%{_cross_unitdir}/service.d/00-fips-go.conf

install -d %{buildroot}%{_cross_libdir}/systemd/system.conf.d
install -p -m 0644 %{S:98} %{buildroot}%{_cross_libdir}/systemd/system.conf.d/80-release.conf

Expand Down Expand Up @@ -467,6 +471,7 @@ ln -s preconfigured.target %{buildroot}%{_cross_unitdir}/default.target
%files fips
%{_cross_bootconfigdir}/10-fips.conf
%{_cross_tmpfilesdir}/release-fips.conf
%{_cross_unitdir}/service.d/00-fips-go.conf
%{_cross_unitdir}/*-bin.mount
%{_cross_unitdir}/*-libexec.mount
%{_cross_unitdir}/fipscheck.target
Expand Down