Skip to content

Commit 67b52d6

Browse files
committed
Enable FIPS compliance enforcement for prometheus-operator build
Explicitly set OPENSHIFT_CI=1 and GO_COMPLIANCE_POLICY to enable the Go compliance shim in openshift-golang-builder. This ensures: - CGO_ENABLED=1 (dynamic linking to OpenSSL) - GOEXPERIMENT=strictfipsruntime automatically added - Build fails if FIPS requirements not met Without OPENSHIFT_CI=1, the shim defaults to "exempt_all" policy and bypasses all FIPS compliance checks. Signed-off-by: Daniel Mellado <dmellado@fedoraproject.org>
1 parent 9de1c88 commit 67b52d6

File tree

1 file changed

+2
-1
lines changed

1 file changed

+2
-1
lines changed

Dockerfile.prom-op

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,8 @@ WORKDIR /workspace
55
COPY obo-prometheus-operator/ .
66

77
ENV GOFLAGS='-mod=mod'
8-
ENV CGO_ENABLED=1
8+
ENV OPENSHIFT_CI=1
9+
ENV GO_COMPLIANCE_POLICY="exempt_darwin,exempt_windows,exempt_cross_compile"
910

1011
RUN GOOS=$TARGETOS GOARCH=$TARGETARCH go build $GOFLAGS -o operator ./cmd/operator/
1112

0 commit comments

Comments
 (0)