Skip to content

Resolving FIPS incompliance caused by K8sNameHash in mcp-operator #96

@SimonTheLeg

Description

@SimonTheLeg

Description

In this piece of our code, we are making a call to sha1.New and then .Write(), which will lead to a panic on applications running in FIPS mode https://github.com/SimonTheLeg/mcp-operator/blob/d95336cbd9a45f69cc273da98a2f0b4bf7bee97a/internal/utils/utils.go#L25


To be discussed in refinement:

As far as I can see it, we only call this function in two places:

  1. https://github.com/openmcp-project/mcp-operator/blob/2cf7aea0fc68e41e64ee5579c2042153a7f19f51/internal/controller/core/landscaper/conversion/v1alpha_to_v1alpha.go#L27 Where we create a unique(?) tenantID for Landscaper ⟹ I think here there is no big problem
  2. https://github.com/openmcp-project/mcp-operator/blob/2cf7aea0fc68e41e64ee5579c2042153a7f19f51/internal/controller/core/apiserver/handler/gardener/conversion.go#L503 where we use it to find the name of a shoot, thus "decomputing" the hash => I think for this we need to create some migration logic.

Done Criteria:

  • Replace the offending code with a FIPS compliant version
  • Deploy version on dev and see that it works with existing hashes as well as there are not any panics in
    (you can simply use the GODEBUG=GOFIPS=only setting in the helmchart to make this work)

Metadata

Metadata

Assignees

No one assigned

    Labels

    area/open-mcpAll ManagedControlPlane related issues

    Type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions