Skip to content

Commit c88b6fd

Browse files
authored
docs: Update FIPS documentation to reference k8s-snap docs (#62)
- Remove duplicate general FIPS information - Keep CoreDNS-specific details (extended crypto module usage) - Reference comprehensive k8s-snap FIPS documentation
1 parent 9ae57c2 commit c88b6fd

File tree

1 file changed

+7
-39
lines changed

1 file changed

+7
-39
lines changed

docs/fips.md

Lines changed: 7 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -1,43 +1,11 @@
1-
## Overview
2-
This document provides an analysis of CoreDNS's cryptographic implementation with respect to FIPS 140 compliance requirements.
1+
# CoreDNS FIPS Compliance
32

4-
> **Note:** As of now, pebble is not built in a FIPS-compliant way. This document will be updated once it is.
5-
6-
## FIPS Compliance Status
7-
8-
CoreDNS uses both standard Go `crypto` and the extended `https://pkg.go.dev/golang.org/x/crypto` modules. To address the FIPS compliance for the standard package, the following steps are required:
9-
10-
1. **Go Toolchain**: Must use the modified [Go toolchain from Microsoft](https://github.com/microsoft/go/blob/microsoft/release-branch.go1.23/eng/doc/fips/README.md) that links against FIPS-validated cryptographic modules.
11-
2. **OpenSSL**: Must link against a FIPS-validated OpenSSL implementation.
12-
13-
**NOTE**: This ROCK is bundled with a FIPS-validated OpenSSL library which is described in the ROCK manifest (see [this discourse post]).
14-
```yaml
15-
...
16-
parts:
17-
openssl:
18-
plugin: nil
19-
stage-packages:
20-
- openssl-fips-module-3
21-
- openssl
22-
...
23-
```
24-
25-
For the extended module, enduring the non-approved algorithms are not executed would suffice.
3+
For comprehensive information about FIPS 140-3 compliance in Canonical Kubernetes, including how ROCKs are built with FIPS support, please refer to the [k8s-snap FIPS documentation](https://github.com/canonical/k8s-snap/blob/main/docs/dev/fips.md).
264

27-
## Manual build
28-
29-
**Prerequisites**:
30-
31-
- a `rockcraft` version that allows building with Ubuntu Pro services (refer to [this discourse post]).
32-
33-
**Building the Image**:
34-
35-
Use the following command to build the image:
36-
37-
```bash
38-
sudo rockcraft pack --pro=fips-updates
39-
```
5+
> **Note:** As of now, pebble is not built in a FIPS-compliant way. This document will be updated once it is.
406
41-
<!-- LINKS -->
7+
CoreDNS's cryptographic usage includes:
428

43-
[this discourse post]: https://discourse.ubuntu.com/t/build-rocks-with-ubuntu-pro-services/57578
9+
- **DNS-over-TLS (DoT)**: Secure DNS queries using TLS
10+
- **DNS-over-HTTPS (DoH)**: Secure DNS queries over HTTPS
11+
- **Backend Communication**: Secure communication with backend services using TLS

0 commit comments

Comments
 (0)