[Build] Add FIPS docker image for GovCloud #117152

breskeby · 2024-11-20T13:02:27Z

Adds docker image based on chainguard base fips image
x86 only for now as the base image is x86 only
the image does not provide a valid elasticsearch.yml configuration. for testing purposes you can follow the elasticsearch fips guide available at https://github.com/elastic/FIPSGuide/tree/main/elasticsearch

The image is shipped with:

org.bouncycastle:bc-fips:1.0.2.5 and org.bouncycastle:bctls-fips:1.0.19 in Elasticsearch libs folder
config/jvm.options.d/fips.options for fips specific JVM options
fips_java.security file
fips_java.policy

Out of scope:

Add packaging test coverage (part of later PR as we want to provide that image for testing early and packaging tests require more general restructuring for support fips scenarios)

elasticsearchmachine · 2024-11-20T13:02:52Z

Pinging @elastic/es-delivery (Team:Delivery)

jakelandis · 2024-12-09T18:34:22Z

build-tools-internal/src/main/java/org/elasticsearch/gradle/internal/DockerBase.java

-    CLOUD_ESS(null, "-cloud-ess", "apk");
+    CLOUD_ESS(null, "-cloud-ess", "apk"),
+    // Based on WOLFI above, we programmatically extend from the wolfi image.
+    FIPS(null, "-fips", "apk");


we need to base the image from: chainguard-base-fips

while the majority of the FIPS compliant for ES is from the JDK/app level, the container itself must also be FIPS compliant.
(EDIT: or is that already the case here ? ...if so, for my own education, how are the tags defined across base and base-fips?)

we transitively base this on chainguard-base as cloud-ess is based on our es-wolfi image and this is based on chainguard-base. @jakelandis you say this must be chainguard-base-fips instead?

This is coded into distribution/docker/build.gradle

I need to do more tweaking as but you can test this from the branch by running:

./gradlew buildAarch64FipsDockerImage # start image directly docker run elasticsearch-fips:aarch64 # inspect image docker run -it --entrypoint /bin/bash elasticsearch-fips:aarch64

@jakelandis With the latest WIP I configure a hardcoded password for the keystore (as it must be >12 characters) Strictly speaking that's fips compliant as I get it, but how is that safe enough if we bake that password into the image itself? each image would have the same keystone password basically public.

It seems we should instead have the ability in ES to ensure we generate dynamically a keystore with fips compliant password without explicitly declaring it?

you say this must be chainguard-base-fips instead?

Yes, the base image, for this purpose, must also be FIPS compliant.

but how is that safe enough if we bake that password into the image itself? each image would have the same keystone password basically public.

This probably warrants it's own discussion, there is likely some cloud level config needed here.

@jakelandis I changed the base image to be chainguard-base-fips. One side effect here is that aarch64 is not supported anymore. You can test this with

./gradlew buildFipsDockerImage # start image directly docker run elasticsearch-fips:x86_64 # inspect image docker run -it --entrypoint /bin/bash elasticsearch-fips:x86_64

xnox · 2025-03-06T14:36:36Z

distribution/docker/src/docker/Dockerfile

+xpack.security.http.ssl.enabled: true
+xpack.security.http.ssl.key: node1.key
+xpack.security.http.ssl.certificate: node1.crt
+xpack.security.http.ssl.certificate_authorities: node1.crt


these keys will work for netty; but not for BCJSSE in approved only mode.

Was this tested or solved?

this has been removed

xnox · 2025-03-06T14:37:53Z

distribution/docker/src/docker/Dockerfile.fips

+# xpack.security.transport.ssl.enabled: true
+# xpack.security.transport.ssl.certificate: node1.crt
+# xpack.security.transport.ssl.certificate_authorities: node1.crt
+# xpack.security.transport.ssl.key: node1.key


ah, that's how incompatibility is fixed by turning off xpack.security ssl.

- Adds docker image based on chainguard base fips image - x86 only for now as base image is x86b only TODO: Add packaging test coverage

jozala

LGTM

- Adds docker image based on chainguard base fips image - x86 only for now as the base image is x86 only - the image does not provide any elasticsearch.yml configuration. for testing purposes you can follow the elasticsearch fips guide available at https://github.com/elastic/FIPSGuide/tree/main/elasticsearch The image is shipped with: - org.bouncycastle:bc-fips:1.0.2.5 and org.bouncycastle:bctls-fips:1.0.19 in Elasticsearch libs folder - config/jvm.options.d/fips.options for fips specific JVM options - fips_java.security file - fips_java.policy Out of scope: - Add packaging test coverage (part of later PR as we want to provide that image for testing early and packaging tests require more general restructuring for support fips scenarios)

elasticsearchmachine · 2025-03-26T15:16:48Z

💔 Backport failed

Status	Branch	Result
✅	9.0
❌	8.x	Commit could not be cherrypicked due to conflicts

You can use sqren/backport to manually backport by running backport --upstream elastic/elasticsearch --pr 117152

- Adds docker image based on chainguard base fips image - x86 only for now as the base image is x86 only - the image does not provide any elasticsearch.yml configuration. for testing purposes you can follow the elasticsearch fips guide available at https://github.com/elastic/FIPSGuide/tree/main/elasticsearch The image is shipped with: - org.bouncycastle:bc-fips:1.0.2.5 and org.bouncycastle:bctls-fips:1.0.19 in Elasticsearch libs folder - config/jvm.options.d/fips.options for fips specific JVM options - fips_java.security file - fips_java.policy Out of scope: - Add packaging test coverage (part of later PR as we want to provide that image for testing early and packaging tests require more general restructuring for support fips scenarios) (cherry picked from commit 653c179) # Conflicts: # build-tools-internal/src/main/java/org/elasticsearch/gradle/internal/distribution/InternalElasticsearchDistributionTypes.java # distribution/docker/build.gradle # distribution/docker/src/docker/Dockerfile

breskeby · 2025-03-26T16:02:29Z

💚 All backports created successfully

Status	Branch	Result
✅	8.x

Questions ?

Please refer to the Backport tool documentation

- Adds docker image based on chainguard base fips image - x86 only for now as the base image is x86 only - the image does not provide any elasticsearch.yml configuration. for testing purposes you can follow the elasticsearch fips guide available at https://github.com/elastic/FIPSGuide/tree/main/elasticsearch The image is shipped with: - org.bouncycastle:bc-fips:1.0.2.5 and org.bouncycastle:bctls-fips:1.0.19 in Elasticsearch libs folder - config/jvm.options.d/fips.options for fips specific JVM options - fips_java.security file - fips_java.policy Out of scope: - Add packaging test coverage (part of later PR as we want to provide that image for testing early and packaging tests require more general restructuring for support fips scenarios) (cherry picked from commit 653c179) # Conflicts: # build-tools-internal/src/main/java/org/elasticsearch/gradle/internal/distribution/InternalElasticsearchDistributionTypes.java # distribution/docker/build.gradle # distribution/docker/src/docker/Dockerfile

* [Build] Add FIPS docker image for GovCloud (#117152) - Adds docker image based on chainguard base fips image - x86 only for now as the base image is x86 only - the image does not provide any elasticsearch.yml configuration. for testing purposes you can follow the elasticsearch fips guide available at https://github.com/elastic/FIPSGuide/tree/main/elasticsearch The image is shipped with: - org.bouncycastle:bc-fips:1.0.2.5 and org.bouncycastle:bctls-fips:1.0.19 in Elasticsearch libs folder - config/jvm.options.d/fips.options for fips specific JVM options - fips_java.security file - fips_java.policy Out of scope: - Add packaging test coverage (part of later PR as we want to provide that image for testing early and packaging tests require more general restructuring for support fips scenarios) (cherry picked from commit 653c179) # Conflicts: # build-tools-internal/src/main/java/org/elasticsearch/gradle/internal/distribution/InternalElasticsearchDistributionTypes.java # distribution/docker/build.gradle # distribution/docker/src/docker/Dockerfile * Fix merge conflict while back porting * Fix another merge conflict * Fix fips tests reported as broken due to issue in gradle setup

- Adds docker image based on chainguard base fips image - x86 only for now as the base image is x86 only - the image does not provide any elasticsearch.yml configuration. for testing purposes you can follow the elasticsearch fips guide available at https://github.com/elastic/FIPSGuide/tree/main/elasticsearch The image is shipped with: - org.bouncycastle:bc-fips:1.0.2.5 and org.bouncycastle:bctls-fips:1.0.19 in Elasticsearch libs folder - config/jvm.options.d/fips.options for fips specific JVM options - fips_java.security file - fips_java.policy Out of scope: - Add packaging test coverage (part of later PR as we want to provide that image for testing early and packaging tests require more general restructuring for support fips scenarios)

* [Build] Add FIPS docker image for GovCloud (#117152) - Adds docker image based on chainguard base fips image - x86 only for now as the base image is x86 only - the image does not provide any elasticsearch.yml configuration. for testing purposes you can follow the elasticsearch fips guide available at https://github.com/elastic/FIPSGuide/tree/main/elasticsearch The image is shipped with: - org.bouncycastle:bc-fips:1.0.2.5 and org.bouncycastle:bctls-fips:1.0.19 in Elasticsearch libs folder - config/jvm.options.d/fips.options for fips specific JVM options - fips_java.security file - fips_java.policy Out of scope: - Add packaging test coverage (part of later PR as we want to provide that image for testing early and packaging tests require more general restructuring for support fips scenarios) * Fix fips tests reported as broken due to issue in gradle setup

breskeby requested a review from a team as a code owner November 20, 2024 13:02

breskeby added >non-issue :Delivery/Build Build or test infrastructure Team:Delivery Meta label for Delivery team v8.17.0 labels Nov 20, 2024

breskeby self-assigned this Nov 20, 2024

breskeby marked this pull request as draft November 20, 2024 13:02

elasticsearchmachine added the v9.0.0 label Nov 20, 2024

breskeby changed the title ~~Add FIPS docker image for GovCloud~~ [Build] Add FIPS docker image for GovCloud Nov 20, 2024

elasticsearchmachine added v8.18.0 and removed v8.17.0 labels Nov 20, 2024

breskeby force-pushed the add-fips-docker-image branch from 8003e4c to c11d177 Compare December 3, 2024 19:18

breskeby added the :Delivery/Packaging RPM and deb packaging, tar and zip archives, shell and batch scripts label Dec 3, 2024

breskeby force-pushed the add-fips-docker-image branch 3 times, most recently from a23256c to 3f203b4 Compare December 5, 2024 09:54

jakelandis reviewed Dec 9, 2024

View reviewed changes

breskeby force-pushed the add-fips-docker-image branch from be6f4c6 to 853068f Compare December 10, 2024 13:09

breskeby force-pushed the add-fips-docker-image branch from 853068f to 9598e33 Compare January 29, 2025 18:17

elasticsearchmachine added v8.19.0 v9.1.0 and removed v8.18.0 v9.0.0 labels Jan 30, 2025

xnox reviewed Mar 6, 2025

View reviewed changes

breskeby force-pushed the add-fips-docker-image branch from 9598e33 to 85966a5 Compare March 17, 2025 07:56

breskeby added the v9.0.0 label Mar 17, 2025

breskeby marked this pull request as ready for review March 17, 2025 08:00

breskeby force-pushed the add-fips-docker-image branch from 85966a5 to ea43aeb Compare March 17, 2025 08:19

breskeby force-pushed the add-fips-docker-image branch from ea43aeb to b92d01f Compare March 25, 2025 19:13

breskeby added 3 commits March 25, 2025 20:24

Add FIPS docker image for gov cloud highramp compatibility

26aa466

- Adds docker image based on chainguard base fips image - x86 only for now as base image is x86b only TODO: Add packaging test coverage

Some cleanup

4213e1b

Simplify dockerfile

2ee47f2

breskeby force-pushed the add-fips-docker-image branch from da2a817 to 2ee47f2 Compare March 25, 2025 19:25

breskeby added the auto-backport Automatically create backport pull requests when merged label Mar 25, 2025

breskeby requested a review from jozala March 26, 2025 10:25

jozala approved these changes Mar 26, 2025

View reviewed changes

breskeby merged commit 653c179 into elastic:main Mar 26, 2025
19 checks passed

breskeby mentioned this pull request Mar 26, 2025

[9.0] [Build] Add FIPS docker image for GovCloud (#117152) #125674

Merged

elasticsearchmachine added the backport pending label Mar 26, 2025

breskeby mentioned this pull request Mar 26, 2025

[8.x] [Build] Add FIPS docker image for GovCloud (#117152) #125684

Merged

[Build] Add FIPS docker image for GovCloud #117152

[Build] Add FIPS docker image for GovCloud #117152

Uh oh!

Conversation

breskeby commented Nov 20, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

elasticsearchmachine commented Nov 20, 2024

Uh oh!

jakelandis Dec 9, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

breskeby Dec 9, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

breskeby Dec 9, 2024

Choose a reason for hiding this comment

Uh oh!

breskeby Dec 9, 2024

Choose a reason for hiding this comment

Uh oh!

jakelandis Dec 9, 2024

Choose a reason for hiding this comment

Uh oh!

breskeby Dec 10, 2024

Choose a reason for hiding this comment

Uh oh!

xnox Mar 6, 2025

Choose a reason for hiding this comment

Uh oh!

breskeby Mar 17, 2025

Choose a reason for hiding this comment

Uh oh!

xnox Mar 6, 2025

Choose a reason for hiding this comment

Uh oh!

jozala left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

elasticsearchmachine commented Mar 26, 2025

💔 Backport failed

Uh oh!

breskeby commented Mar 26, 2025

💚 All backports created successfully

Questions ?

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

breskeby commented Nov 20, 2024 •

edited

Loading

jakelandis Dec 9, 2024 •

edited

Loading

breskeby Dec 9, 2024 •

edited

Loading