|
1 | | -## Overview |
2 | | -This document provides an analysis of CoreDNS's cryptographic implementation with respect to FIPS 140 compliance requirements. |
| 1 | +# CoreDNS FIPS Compliance |
3 | 2 |
|
4 | | -> **Note:** As of now, pebble is not built in a FIPS-compliant way. This document will be updated once it is. |
5 | | -
|
6 | | -## FIPS Compliance Status |
7 | | - |
8 | | -CoreDNS uses both standard Go `crypto` and the extended `https://pkg.go.dev/golang.org/x/crypto` modules. To address the FIPS compliance for the standard package, the following steps are required: |
9 | | - |
10 | | -1. **Go Toolchain**: Must use the modified [Go toolchain from Microsoft](https://github.com/microsoft/go/blob/microsoft/release-branch.go1.23/eng/doc/fips/README.md) that links against FIPS-validated cryptographic modules. |
11 | | -2. **OpenSSL**: Must link against a FIPS-validated OpenSSL implementation. |
12 | | - |
13 | | -**NOTE**: This ROCK is bundled with a FIPS-validated OpenSSL library which is described in the ROCK manifest (see [this discourse post]). |
14 | | -```yaml |
15 | | -... |
16 | | -parts: |
17 | | - openssl: |
18 | | - plugin: nil |
19 | | - stage-packages: |
20 | | - - openssl-fips-module-3 |
21 | | - - openssl |
22 | | -... |
23 | | -``` |
24 | | - |
25 | | -For the extended module, enduring the non-approved algorithms are not executed would suffice. |
| 3 | +For comprehensive information about FIPS 140-3 compliance in Canonical Kubernetes, including how ROCKs are built with FIPS support, please refer to the [k8s-snap FIPS documentation](https://github.com/canonical/k8s-snap/blob/main/docs/dev/fips.md). |
26 | 4 |
|
27 | | -## Manual build |
28 | | - |
29 | | -**Prerequisites**: |
30 | | - |
31 | | -- a `rockcraft` version that allows building with Ubuntu Pro services (refer to [this discourse post]). |
32 | | - |
33 | | -**Building the Image**: |
34 | | - |
35 | | -Use the following command to build the image: |
36 | | - |
37 | | -```bash |
38 | | -sudo rockcraft pack --pro=fips-updates |
39 | | -``` |
| 5 | +> **Note:** As of now, pebble is not built in a FIPS-compliant way. This document will be updated once it is. |
40 | 6 |
|
41 | | -<!-- LINKS --> |
| 7 | +CoreDNS's cryptographic usage includes: |
42 | 8 |
|
43 | | -[this discourse post]: https://discourse.ubuntu.com/t/build-rocks-with-ubuntu-pro-services/57578 |
| 9 | +- **DNS-over-TLS (DoT)**: Secure DNS queries using TLS |
| 10 | +- **DNS-over-HTTPS (DoH)**: Secure DNS queries over HTTPS |
| 11 | +- **Backend Communication**: Secure communication with backend services using TLS |
0 commit comments