Skip to content

Commit 6a87a97

Browse files
authored
TLS cipher suites and FIPS compliance (#755)
Add support for configuring the TLS cipher suites the Operator uses and running the Operator in a FIPS compliant mode.
1 parent cf92ffe commit 6a87a97

File tree

12 files changed

+792
-12
lines changed

12 files changed

+792
-12
lines changed

.github/workflows/compatibility-tests.yaml

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,7 @@ jobs:
3737
fail-fast: false
3838
matrix:
3939
compatibilityVersion:
40+
- 3.5.0
4041
- 3.4.3
4142
- 3.4.2
4243
- 3.4.1
@@ -45,8 +46,11 @@ jobs:
4546
- 3.3.4
4647
- 3.3.3
4748
- 3.3.2
48-
- 3.3.1
4949
include:
50+
- compatibilityVersion: 3.5.0
51+
coherence-image: "ghcr.io/oracle/coherence-ce:14.1.2-0-1"
52+
compatibilitySelector: control-plane=coherence
53+
k8s: kindest/node:v1.33.0@sha256:91e9ed777db80279c22d1d1068c091b899b2078506e4a0f797fbf6e397c0b0b2
5054
- compatibilityVersion: 3.4.3
5155
coherence-image: "ghcr.io/oracle/coherence-ce:14.1.2-0-1"
5256
compatibilitySelector: control-plane=coherence
@@ -79,10 +83,6 @@ jobs:
7983
coherence-image: "ghcr.io/oracle/coherence-ce:22.06.10"
8084
compatibilitySelector: control-plane=coherence
8185
k8s: kindest/node:v1.27.3@sha256:3966ac761ae0136263ffdb6cfd4db23ef8a83cba8a463690e98317add2c9ba72
82-
- compatibilityVersion: 3.3.1
83-
coherence-image: "ghcr.io/oracle/coherence-ce:22.06.10"
84-
compatibilitySelector: control-plane=coherence
85-
k8s: kindest/node:v1.27.3@sha256:3966ac761ae0136263ffdb6cfd4db23ef8a83cba8a463690e98317add2c9ba72
8686

8787
steps:
8888
- uses: actions/checkout@v4

Makefile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1544,7 +1544,7 @@ run-prometheus-test: gotestsum
15441544
# These tests will use whichever k8s cluster the local environment is pointing to.
15451545
# ----------------------------------------------------------------------------------------------------------------------
15461546
.PHONY: compatibility-test
1547-
compatibility-test: undeploy build-all-images helm-chart undeploy clean-namespace reset-namespace ensure-pull-secret gotestsum just-compatibility-test ## Run the Operator backwards compatibility tests
1547+
compatibility-test: undeploy helm-chart undeploy clean-namespace reset-namespace ensure-pull-secret gotestsum just-compatibility-test ## Run the Operator backwards compatibility tests
15481548

15491549
.PHONY: just-compatibility-test
15501550
just-compatibility-test: export OPERATOR_NAMESPACE := $(OPERATOR_NAMESPACE)

controllers/errorhandling/error_handler_test.go

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,6 @@ func TestOperationError(t *testing.T) {
3333

3434
// Test error message formatting
3535
assert.Contains(t, opErr.Error(), "operation 'test_operation' failed")
36-
assert.Contains(t, opErr.Error(), "context: key1=value1, key2=value2")
3736
assert.Contains(t, opErr.Error(), "base error")
3837

3938
// Test Unwrap

docs/about/01_overview.adoc

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,13 @@ Deploying Coherence Applications using the Coherence Operator.
4242
Hints and tips to troubleshoot common issues.
4343
--
4444
45+
[CARD]
46+
.FIPS
47+
[icon=widgets,link=docs/installation/100_fips.adoc]
48+
--
49+
FIPS Compliance
50+
--
51+
4552
====
4653
4754

docs/installation/001_installation.adoc

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,10 @@ easily be installed into a Kubernetes cluster.
2121
* <<images,Coherence Operator Images>>
2222
* <<scope,Operator Scope - monitoring all or a fixed set of namespaces>>
2323
24+
* <<docs/installation/090_tls_cipher.adoc,Configure TLS Cipher Suites>>
25+
26+
* <<docs/installation/100_fips.adoc,FIPS Compliance>>
27+
2428
[#prereq]
2529
=== Prerequisites
2630
The prerequisites apply to all installation methods.
@@ -51,7 +55,6 @@ There are a number of ways to install the Coherence Operator.
5155
* <<docs/installation/015_install_olm.adoc,Install using the Operator Lifecycle Manager (OLM)>>
5256
* <<docs/installation/016_install_tanzu.adoc,Install on VMWare Tanzu>>
5357
54-
5558
[#ha]
5659
=== High Availability
5760
Lines changed: 129 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,129 @@
1+
///////////////////////////////////////////////////////////////////////////////
2+
3+
Copyright (c) 2020, 2025 Oracle and/or its affiliates.
4+
Licensed under the Universal Permissive License v 1.0 as shown at
5+
http://oss.oracle.com/licenses/upl.
6+
7+
///////////////////////////////////////////////////////////////////////////////
8+
9+
= TLS Cipher Suites
10+
:description: Coherence Operator Documentation - TLS Cipher Suites
11+
:keywords: oracle coherence, kubernetes, operator, documentation, TLS, cipher
12+
13+
== TLS Cipher Suites
14+
15+
The Coherence Operator uses TLS for various client connections and server sockets.
16+
TLS can support a number of cipher suites, some of which are deemed legacy and insecure.
17+
These insecure ciphers are usually only present for backwards compatability.
18+
19+
The Coherence Operator is written in Go, and the ciphers supported are determined by the version og Go
20+
used to build the operator.
21+
Go splits ciphers into two lists a secure list and an insecure list, the insecure ciphers are disabled by default.
22+
23+
Oracle Global Security has stricter requirements than the default Go cipher list.
24+
By default, the Coherence Operator enables only ciphers in Go's secure list, except for
25+
`TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA` and `TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA`, which are disabled.
26+
27+
It is possible to enable or disable cipher suites when installing the Coherence Operator.
28+
The Coherence Operator has two command line flags which can be used to specify ciphers to be allowed or denied.
29+
30+
31+
* The `--cipher-allow-list` command line flag is used to specify cipher names to add to the allowed list.
32+
* The `--cipher-deny-list` command line flag is used to specify cipher names to add to the disabled list.
33+
34+
Multiple ciphers can be enabled and disabled by specifying the relevant command line flag multiple times.
35+
36+
If a cipher name is added to both the allow list and to the deny list, it will be disabled.
37+
38+
[NOTE]
39+
====
40+
If either the `--cipher-allow-list` or `--cipher-deny-list` is set to a name that does not match any of the
41+
supported Go cipher names, the Operator will display an error in its log and will not start.
42+
See the https://pkg.go.dev/crypto/tls#pkg-constants[Go TLS package documentation] for a lost of valid names.
43+
====
44+
45+
**Only Allow FIPS Ciphers**
46+
47+
The Coherence Operator can be installed in FIPS mode to only support FIPS compliant ciphers,
48+
see the <<docs/installation/100_fips.adoc,FIPS modes>> documentation for details.
49+
50+
How the command line flags are set depends on how the Coherence Operator is installed.
51+
52+
=== Install Using Yaml Manifests
53+
54+
If <<docs/installation/011_install_manifests.adoc,installing using the yaml manifests>>,
55+
the yaml must be edited to add the required flags:
56+
57+
Find the `args:` section of the operator `Deployment` in the yaml file, it looks like this:
58+
59+
[source,yaml]
60+
----
61+
args:
62+
- operator
63+
- --enable-leader-election
64+
----
65+
66+
then add the required allow or disallow flags. For example to allow `TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA`
67+
the args can be edited as shown below:
68+
69+
[source,yaml]
70+
----
71+
args:
72+
- operator
73+
- --enable-leader-election
74+
- --cipher-allow-list=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
75+
----
76+
77+
To enable both `TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA` and `TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA` ciphers:
78+
79+
[source,yaml]
80+
----
81+
args:
82+
- operator
83+
- --enable-leader-election
84+
- --cipher-allow-list=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
85+
- --cipher-allow-list=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
86+
----
87+
88+
89+
90+
=== Install Using Helm
91+
92+
If <<docs/installation/012_install_helm.adoc,installing the operator using Helm>>
93+
The Coherence Operator Helm chart has a `cipherAllowList` field and `cipherDenyList` field in its values file.
94+
These values are Helm arrays and can be set to a list of ciphers to be enabled or disabled.
95+
96+
The simplest way to set lists on the Helm command line is using the `--set-json` command line flag.
97+
For example to allow `TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA`
98+
99+
[source,bash]
100+
----
101+
helm install \
102+
--namespace <namespace> \
103+
--set-json='cipherAllowList=["TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA"]'
104+
coherence-operator \
105+
coherence/coherence-operator
106+
----
107+
108+
To enable both `TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA` and `TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA` ciphers:
109+
110+
[source,bash]
111+
----
112+
helm install \
113+
--namespace <namespace> \
114+
--set-json='cipherAllowList=["TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA"]'
115+
coherence-operator \
116+
coherence/coherence-operator
117+
----
118+
119+
To disable `TLS_CHACHA20_POLY1305_SHA256`
120+
121+
[source,bash]
122+
----
123+
helm install \
124+
--namespace <namespace> \
125+
--set-json='cipherDenyList=["TLS_CHACHA20_POLY1305_SHA256"]'
126+
coherence-operator \
127+
coherence/coherence-operator
128+
----
129+

docs/installation/100_fips.adoc

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
///////////////////////////////////////////////////////////////////////////////
2+
3+
Copyright (c) 2020, 2025 Oracle and/or its affiliates.
4+
Licensed under the Universal Permissive License v 1.0 as shown at
5+
http://oss.oracle.com/licenses/upl.
6+
7+
///////////////////////////////////////////////////////////////////////////////
8+
9+
= FIPS Compatibility
10+
:description: Coherence Operator Documentation - TLS Cipher Suites
11+
:keywords: oracle coherence, kubernetes, operator, documentation, TLS, cipher
12+
13+
== FIPS Compatibility
14+
15+
The Coherence Operator image uses an empty scratch image for its base image.
16+
This means that the Coherence Operator image is FIPS compatible and can be run in a FIPS compliant Kubernetes cluster.
17+
18+
As the Coherence Operator is written in Go, it can use Go's built in FIPS support.
19+
To run the Coherence Operator in a FIPS compliant mode, it needs to be installed with the environment variable `GODEBUG`
20+
set to either `fips140=on` or `fips140=only`. This is explained in the Golang https://go.dev/doc/security/fips140[FIPS-140 documentation].
21+
22+
How the `GODEBUG` environment variable is set depends on how the operator is installed.
23+
24+
[NOTE]
25+
====
26+
Although the Coherence Operator image can easily be installed in a FIPS compliant mode, none of the default
27+
Oracle Coherence images used by the operator are FIPS complaint.
28+
The Oracle Coherence team does not currently publish FIPS compliant Coherence images.
29+
Coherence is FIPS compatible and correctly configured applications running in an image that has a FIPS
30+
compliant JDK and FIPS compliant base O/S will be FIPS complaint.
31+
Customers must build their own FIPS complaint Java and Coherence images, which the operator will then manage.
32+
====
33+
34+
=== Install Using Yaml Manifests
35+
36+
If <<docs/installation/011_install_manifests.adoc,installing using the yaml manifests>>,
37+
the yaml must be edited to add the `GODEBUG` environment variable to
38+
the operator deployments environment variables:
39+
40+
Find the `env:` section of the operator `Deployment` in the yaml file, it looks like this:
41+
42+
[source,yaml]
43+
----
44+
env:
45+
- name: OPERATOR_NAMESPACE
46+
valueFrom:
47+
fieldRef:
48+
fieldPath: metadata.namespace
49+
----
50+
51+
then add the required `GODEBUG` value, for example
52+
53+
[source,yaml]
54+
----
55+
env:
56+
- name: OPERATOR_NAMESPACE
57+
valueFrom:
58+
fieldRef:
59+
fieldPath: metadata.namespace
60+
- name: GODEBUG
61+
value: fips140=on
62+
----
63+
64+
=== Install Using Helm
65+
66+
If <<docs/installation/012_install_helm.adoc,installing the operator using Helm>>
67+
The Coherence Operator Helm chart has a `fips` field in its values file.
68+
This value is used to set the `GODEBUG` environment variables.
69+
The `fips` value is unset by default, if set it must be one of the values, "off", "on" or "only".
70+
If `fips` is set to any other value the chart will fail to install.
71+
72+
For example, to install the operator with fips set to "on"
73+
74+
[source,bash]
75+
----
76+
helm install \
77+
--namespace <namespace> \
78+
--set fips=on
79+
coherence-operator \
80+
coherence/coherence-operator
81+
----

helm-charts/coherence-operator/templates/deployment.yaml

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -178,11 +178,17 @@ spec:
178178
{{- range $k, $v := .Values.globalLabels }}
179179
- --global-label={{ $k }}={{ $v }}
180180
{{- end }}
181+
{{- end }}
181182
{{- if (.Values.globalAnnotations) }}
182183
{{- range $k, $v := .Values.globalAnnotations }}
183184
- --global-annotation={{ $k }}={{ $v }}
184185
{{- end }}
185186
{{- end }}
187+
{{- range .Values.cipherAllowList }}
188+
- --cipher-allow-list={{ . }}
189+
{{- end }}
190+
{{- range .Values.cipherDenyList }}
191+
- --cipher-deny-list={{ . }}
186192
{{- end }}
187193
command:
188194
- "/files/runner"
@@ -203,6 +209,20 @@ spec:
203209
value: coherence-operator-rest
204210
- name: CERT_TYPE
205211
value: {{ default "self-signed" .Values.webhookCertType | quote }}
212+
{{- if .Values.fips }}
213+
{{- if (eq .Values.fips "off") }}
214+
- name: GODEBUG
215+
value: fips140=off
216+
{{- else if (eq .Values.fips "on") }}
217+
- name: GODEBUG
218+
value: fips140=on
219+
{{- else if (eq .Values.fips "only") }}
220+
- name: GODEBUG
221+
value: fips140=only
222+
{{- else }}
223+
{{ fail (printf "Invalid fips value '%s', must be one of 'off', 'on', or 'only'" .Values.fips) }}
224+
{{- end }}
225+
{{- end }}
206226
- name: COHERENCE_IMAGE
207227
{{- if kindIs "string" .Values.defaultCoherenceImage }}
208228
value: {{ .Values.defaultCoherenceImage | quote }}

helm-charts/coherence-operator/values.yaml

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -207,12 +207,12 @@ clusterRoles: true
207207
# nodeRoles controls whether the Helm chart will create RBAC ClusterRole and bindings for the Operator to
208208
# lookup cluster-wide Node information.
209209
# Setting this value clusterRoles and to false will mean that the Operator cannot look up Node labels that will be used
210-
# to set theCoherence site and rack values so Coherence cluster will be unable to automatically achieve site-safety.
210+
# to set the Coherence site and rack values so Coherence cluster will be unable to automatically achieve site-safety.
211211
# The default is true.
212212
nodeRoles: false
213213
# webhooks controls whether the Coherence Operator registers admission web-hooks for the Coherence resource.
214214
# If this is set to false, then it will be possible to install invalid Coherence resource into the Kubernetes
215-
# cluster, that may cause errors when the Operator tries to reconcile them, or worse the Operator may create
215+
# cluster. This may cause errors when the Operator tries to reconcile them, or worse, the Operator may create
216216
# other invalid Kubernetes resources that fail to run.
217217
webhooks: true
218218

@@ -224,3 +224,9 @@ allowCoherenceJobs: true
224224
# If set to false, the Helm chart will not install the CRDs.
225225
# The CRDs must be manually installed before the Operator can be installed.
226226
installCrd: true
227+
228+
cipherAllowList: []
229+
230+
cipherDenyList: []
231+
232+
fips:

0 commit comments

Comments
 (0)