Adds PQC release note to 4.22

[stevsmit]

Version(s):

Issue:

Link to docs preview:

QE review:

• QE has approved this change.

Additional information:

[stevsmit]

Maybe make this into a section, like:

Suggested change

	{product-title} is designed for FIPS. When running {op-system-base-full} or {op-system-first} booted in FIPS mode, {product-title} core components use the {op-system-base} cryptographic libraries that have been submitted to NIST for FIPS 140-2/140-3 Validation on only the `x86_64`, `ppc64le`, and `s390x` architectures.
	== About FIPS compliance
	{product-title} is designed for FIPS. When running {op-system-base-full} or {op-system-first} booted in FIPS mode, {product-title} core components use the {op-system-base} cryptographic libraries that have been submitted to NIST for FIPS 140-2/140-3 Validation on only the `x86_64`, `ppc64le`, and `s390x` architectures.

[stevsmit]

If we make the above into a section, maybe we could do the same here?

Suggested change

	{product-title} supports post-quantum cryptography (PQC) readiness for secure cluster communication. When running on {op-system-base-full} or {op-system-first}, core {product-title} components use the cryptographic capabilities provided by the platform operating system and TLS 1.3 security profiles, including hybrid Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM) key exchange where enabled by the configured TLS security profile and supported by the component.
	== About PQC compliance
	{product-title} supports post-quantum cryptography (PQC) readiness for secure cluster communication. When running on {op-system-base-full} or {op-system-first}, core {product-title} components use the cryptographic capabilities provided by the platform operating system and TLS 1.3 security profiles, including hybrid Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM) key exchange where enabled by the configured TLS security profile and supported by the component.

[TheFoxAtWork]

concur

[stevsmit]

Do we want to be specific about which core components this includes? The FIPs note also says "core components"

[joelanford]

The expectation for 4.22 is that all core payload and platform-aligned layered products have tested that their components offer TLS 1.3 and hybrid ML-KEM.

There is some ongoing project management happening in https://redhat.atlassian.net/browse/OCPSTRAT-2361 to make sure platform-aligned layered products have done the required testing for their 4.22-aligned versions.

But your statement only specifically mentions core components, which we're in better shape on.

I think this sounds good. We could extend this to say "and platform-aligned layered products" but I'm not confident about that yet.

[TheFoxAtWork]

dont include it unless we're 100%.

[ocpdocs-previewbot]

🤖 Tue May 19 19:43:29 - Prow CI generated the docs preview:

https://111946--ocpdocs-pr.netlify.app/openshift-enterprise/latest/release_notes/ocp-4-22-release-notes.html

[openshift-ci]

@stevsmit: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.