Add FIPS support with Go native crypto and unique operator labels

.tekton/images-mirror-set.yaml

@@ -0,0 +1,16 @@
+---
+apiVersion: operator.openshift.io/v1alpha1
+kind: ImageDigestMirrorSet
+metadata:
+  name: registries
+spec:
+  imageDigestMirrors:
+    - mirrors:
+        - quay.io/securesign/policy-controller
+      source: registry.redhat.io/rhtas/policy-controller-rhel9
+    - mirrors:
+        - quay.io/securesign/policy-controller-operator
+      source: registry.redhat.io/rhtas/policy-controller-rhel9-operator
+    - mirrors:
+        - quay.io/securesign/policy-controller-operator-bundle
+      source: registry.redhat.io/rhtas/policy-controller-operator-bundle

.tekton/policy-controller-operator-bundle-pull-request.yaml

@@ -49,6 +49,8 @@ spec:
     value: "1.1.0"
   - name: release-version
     value: "1.5.0"
+  - name: fips-check
+    value: "true"
   pipelineRef:
     params:
     - name: url

.tekton/policy-controller-operator-bundle-push.yaml

@@ -46,6 +46,8 @@ spec:
     value: "1.1.0"
   - name: release-version
     value: "1.5.0"
+  - name: fips-check
+    value: "true"
   pipelineRef:
     params:
     - name: url

.tekton/policy-controller-operator-pull-request.yaml

@@ -47,6 +47,8 @@ spec:
     value: "1.1.0"
   - name: release-version
     value: "1.5.0"
+  - name: fips-check
+    value: "true"
   pipelineRef:
     params:
     - name: url

.tekton/policy-controller-operator-push.yaml

@@ -44,6 +44,8 @@ spec:
     value: "1.1.0"
   - name: release-version
     value: "1.5.0"
+  - name: fips-check
+    value: "true"
   pipelineRef:
     params:
     - name: url

Dockerfile

@@ -1,14 +1,15 @@
 # Build the admission-webhook-controller binary
 FROM registry.redhat.io/ubi9/go-toolset:latest@sha256:444e81b3e88d8a68b92a081a7b3abc7d3fed2450f8473ea6b3caebf3bb73a0b8 AS admission-webhook-controller
 WORKDIR /opt/app-root/src/
-ENV GOEXPERIMENT=strictfipsruntime
-ENV CGO_ENABLED=1
+ENV CGO_ENABLED=0
+ENV GOFIPS140=v1.0.0
 
-COPY go.mod go.mod
-COPY go.sum go.sum
-COPY cmd cmd
+COPY --chown=1001:0 go.mod go.mod
+COPY --chown=1001:0 go.sum go.sum
+COPY --chown=1001:0 cmd cmd
 
-RUN go build -mod=mod -o admission-webhook-controller ./cmd
+RUN go mod edit -godebug=fips140=auto && \
+    go build -mod=mod -tags 'no_openssl' -o admission-webhook-controller ./cmd
 
 # Unpack Helm chart
 FROM registry.redhat.io/ubi9/ubi-minimal:latest@sha256:7c372902c8d211db2d25c8277ba534a73b92742a334874dced829a63b0f21221 AS unpack-templates

Makefile

@@ -278,7 +278,11 @@ e2e-test:
 
 .PHONY: e2e-test-upgrade
 e2e-test-upgrade:
-	go test -count=1 -tags=upgrade -v -timeout 30m ./test/... 
+	go test -count=1 -tags=upgrade -v -timeout 30m ./test/...
+
+.PHONY: e2e-test-fips
+e2e-test-fips:
+	go test -count=1 -tags=fips -v -timeout 30m ./test/...
 
 # Generate related image
 FILE := helm-charts/policy-controller-operator/values.yaml

bundle.Dockerfile

@@ -59,7 +59,7 @@ LABEL name="rhtas/policy-controller-operator-bundle"
 
 LABEL features.operators.openshift.io/cni="false"
 LABEL features.operators.openshift.io/disconnected="false"
-LABEL features.operators.openshift.io/fips-compliant="false"
+LABEL features.operators.openshift.io/fips-compliant="true"
 LABEL features.operators.openshift.io/proxy-aware="false"
 LABEL features.operators.openshift.io/cnf="false"
 LABEL features.operators.openshift.io/csi="false"

config/default/metrics_service.yaml

@@ -2,7 +2,7 @@ apiVersion: v1
 kind: Service
 metadata:
   labels:
-    control-plane: controller-manager
+    control-plane: policy-controller-operator
     app.kubernetes.io/name: policy-controller-operator
     app.kubernetes.io/managed-by: kustomize
   name: controller-manager-metrics-service
@@ -14,4 +14,4 @@ spec:
     protocol: TCP
     targetPort: 8443
   selector:
-    control-plane: controller-manager
+    control-plane: policy-controller-operator

config/manager/manager.yaml

@@ -2,7 +2,7 @@ apiVersion: v1
 kind: Namespace
 metadata:
   labels:
-    control-plane: controller-manager
+    control-plane: policy-controller-operator
     app.kubernetes.io/name: policy-controller-operator
     app.kubernetes.io/managed-by: kustomize
   name: system
@@ -13,20 +13,20 @@ metadata:
   name: controller-manager
   namespace: system
   labels:
-    control-plane: controller-manager
+    control-plane: policy-controller-operator
     app.kubernetes.io/name: policy-controller-operator
     app.kubernetes.io/managed-by: kustomize
 spec:
   selector:
     matchLabels:
-      control-plane: controller-manager
+      control-plane: policy-controller-operator
   replicas: 1
   template:
     metadata:
       annotations:
         kubectl.kubernetes.io/default-container: manager
       labels:
-        control-plane: controller-manager
+        control-plane: policy-controller-operator
     spec:
       securityContext:
         runAsNonRoot: true

config/manifests/bases/policy-controller-operator.clusterserviceversion.yaml

@@ -9,7 +9,7 @@ metadata:
     features.operators.openshift.io/cni: "false"
     features.operators.openshift.io/csi: "false"
     features.operators.openshift.io/disconnected: "false"
-    features.operators.openshift.io/fips-compliant: "false"
+    features.operators.openshift.io/fips-compliant: "true"
     features.operators.openshift.io/proxy-aware: "false"
     features.operators.openshift.io/tls-profiles: "false"
     features.operators.openshift.io/token-auth-aws: "false"

config/network-policy/allow-metrics-traffic.yaml

@@ -12,7 +12,7 @@ metadata:
 spec:
   podSelector:
     matchLabels:
-      control-plane: controller-manager
+      control-plane: policy-controller-operator
   policyTypes:
     - Ingress
   ingress:

config/openshift/serving_cert_annotation_patch.yaml

@@ -4,6 +4,6 @@ metadata:
   name: controller-manager-webhook-service
   namespace: system
   labels:
-    control-plane: controller-manager
+    control-plane: policy-controller-operator
   annotations:
     service.beta.openshift.io/serving-cert-secret-name: webhook-cert

config/prometheus/monitor.yaml

@@ -3,7 +3,7 @@ apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
   labels:
-    control-plane: controller-manager
+    control-plane: policy-controller-operator
     app.kubernetes.io/name: policy-controller-operator
     app.kubernetes.io/managed-by: kustomize
   name: controller-manager-metrics-monitor
@@ -27,4 +27,4 @@ spec:
         insecureSkipVerify: true
   selector:
     matchLabels:
-      control-plane: controller-manager
+      control-plane: policy-controller-operator

config/webhook/service.yaml

@@ -4,12 +4,12 @@ metadata:
   name: controller-manager-webhook-service
   namespace: system
   labels:
-    control-plane: controller-manager
+    control-plane: policy-controller-operator
 spec:
   ports:
     - name: https-webhook
       port: 443
       targetPort: 9443
       protocol: TCP
   selector:
-    control-plane: controller-manager
+    control-plane: policy-controller-operator

go.mod

@@ -32,7 +32,9 @@ require (
 	github.com/go-openapi/swag/stringutils v0.28.0 // indirect
 	github.com/go-openapi/swag/typeutils v0.28.0 // indirect
 	github.com/go-openapi/swag/yamlutils v0.28.0 // indirect
+	github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 // indirect
 	github.com/klauspost/compress v1.19.2 // indirect
+	github.com/moby/spdystream v0.5.1 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.1.1 // indirect
 	github.com/secure-systems-lab/go-securesystemslib v0.11.0 // indirect
@@ -48,6 +50,7 @@ require (
 	google.golang.org/genproto/googleapis/api v0.0.0-20260727163830-6c54dddc4772 // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
 	gotest.tools/v3 v3.5.2 // indirect
+	k8s.io/streaming v0.36.3 // indirect
 	sigs.k8s.io/structured-merge-diff/v6 v6.4.2 // indirect
 )
 

go.sum

@@ -87,6 +87,8 @@ github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3 h1:LMLX+LgTNWpfvCBdFe
 github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3/go.mod h1:jl5iWTm0/hd5PjEYEOuwAJ57L/CibdZfrqZ5XA5GrCk=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 h1:JeSE6pjso5THxAzdVpqr6/geYxZytqFMBCOtn/ujyeo=
+github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674/go.mod h1:r4w70xmWCQKmi1ONH4KIaBptdivuRPyosB9RmPlGEwA=
 github.com/joshdk/go-junit v1.0.0 h1:S86cUKIdwBHWwA6xCmFlf3RTLfVXYQfvanM5Uh+K6GE=
 github.com/joshdk/go-junit v1.0.0/go.mod h1:TiiV0PqkaNfFXjEiyjWM3XXrhVyCa1K4Zfga6W52ung=
 github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
@@ -103,6 +105,8 @@ github.com/maruel/natural v1.1.1 h1:Hja7XhhmvEFhcByqDoHz9QZbkWey+COd9xWfCfn1ioo=
 github.com/maruel/natural v1.1.1/go.mod h1:v+Rfd79xlw1AgVBjbO0BEQmptqb5HvL/k9GRHB7ZKEg=
 github.com/mfridman/tparse v0.18.0 h1:wh6dzOKaIwkUGyKgOntDW4liXSo37qg5AXbIhkMV3vE=
 github.com/mfridman/tparse v0.18.0/go.mod h1:gEvqZTuCgEhPbYk/2lS3Kcxg1GmTxxU7kTC8DvP0i/A=
+github.com/moby/spdystream v0.5.1 h1:9sNYeYZUcci9R6/w7KDaFWEWeV4LStVG78Mpyq/Zm/Y=
+github.com/moby/spdystream v0.5.1/go.mod h1:xBAYlnt/ay+11ShkdFKNAG7LsyK/tmNBVvVOwrfMgdI=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
@@ -223,6 +227,8 @@ k8s.io/klog/v2 v2.140.0 h1:Tf+J3AH7xnUzZyVVXhTgGhEKnFqye14aadWv7bzXdzc=
 k8s.io/klog/v2 v2.140.0/go.mod h1:o+/RWfJ6PwpnFn7OyAG3QnO47BFsymfEfrz6XyYSSp0=
 k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad h1:oXImqH8mQNk7PmvzKhmN3ddJoY6OnyM225MXwGHPm0A=
 k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad/go.mod h1:0/mqHCVhlumdJ3BhCfnjSZQE037nAhNodh1/hK0T8/I=
+k8s.io/streaming v0.36.3 h1:9rAaqBk0C0Pc7+/fqGekj07NV+/Xrew58p647A0JT8w=
+k8s.io/streaming v0.36.3/go.mod h1:z6fV3D+NVkoeqRMtWwlUZK6U17SY/LqNzOxWL6GyR/s=
 k8s.io/utils v0.0.0-20260707023825-cf1189d6abe3 h1:jVkFFVfXdXP74B/zbO3hM3hpSFD0xvhQ5U686DPurkE=
 k8s.io/utils v0.0.0-20260707023825-cf1189d6abe3/go.mod h1:M2s5JB1lIYP3jzZdorPLHXIPJzt9vv2muW5a6L9DtNM=
 sigs.k8s.io/controller-runtime v0.24.1 h1:miPEwrmirImAvgME1L9qebGHrOnGJoVmVdtOU9fRfo4=

helm-charts/policy-controller-operator/values.yaml

@@ -16,7 +16,7 @@ policy-controller:
     name: webhook
     image:
       repository: registry.redhat.io/rhtas/policy-controller-rhel9
-      version: sha256:c784547c9ad24ba39e3826607c945cabcee9cbc7b585795683a79611356589df
+      version: sha256:8bd5171bc05bdbf77622db9ea77f47a59e881cc876f0fadf2c03f7006eb816d5
       pullPolicy: IfNotPresent
     env:
       KUBERNETES_MIN_VERSION: "1.29.0-0"

test/e2e/e2e_suite_test.go

@@ -58,6 +58,7 @@ var _ = SynchronizedBeforeSuite(func() []byte {
 
 	k8sClient, err = client.New(restCfg, client.Options{Scheme: scheme})
 	Expect(err).NotTo(HaveOccurred())
+	e2e_utils.SetRestConfig(restCfg)
 
 	ctx = context.Background()
 
@@ -88,6 +89,9 @@ var _ = SynchronizedBeforeSuite(func() []byte {
 		return e2e_utils.WaitForDeploymentReady(ctx, k8sClient, e2e_utils.InstallNamespace, e2e_utils.DeploymentName)
 	}).WithContext(ctx).Should(Succeed(), "timed out waiting for Deployment %q to be ready", e2e_utils.DeploymentName)
 
+	By("detecting and configuring FIPS mode if cluster is FIPS-enabled")
+	e2e_utils.DetectAndConfigureFIPS(ctx, k8sClient)
+
 	By("injecting CA")
 	injectCA, err = strconv.ParseBool(strings.TrimSpace(e2e_utils.InjectCA()))
 	Expect(err).NotTo(HaveOccurred())

test/e2e_fips/e2e_fips_suite_test.go

@@ -0,0 +1,115 @@
+//go:build fips
+
+package e2e_fips
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+
+	. "github.com/onsi/ginkgo/v2"
+	. "github.com/onsi/gomega"
+	"github.com/onsi/gomega/format"
+	e2e_utils "github.com/securesign/policy-controller-operator/test/utils"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
+	"k8s.io/client-go/tools/clientcmd"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/log"
+	"sigs.k8s.io/e2e-framework/klient/conf"
+)
+
+var (
+	k8sClient client.Client
+	ctx       context.Context
+	scheme    = runtime.NewScheme()
+)
+
+func init() {
+	utilruntime.Must(clientgoscheme.AddToScheme(scheme))
+}
+
+func TestFips(t *testing.T) {
+	format.MaxLength = 0
+	RegisterFailHandler(Fail)
+	log.SetLogger(GinkgoLogr)
+	SetDefaultEventuallyTimeout(3 * time.Minute)
+	SetDefaultEventuallyPollingInterval(1 * time.Second)
+	EnforceDefaultTimeoutsWhenUsingContexts()
+	RunSpecs(t, "Policy Controller FIPS E2E Suite")
+}
+
+var _ = SynchronizedBeforeSuite(func() []byte {
+	kubeconfig := conf.ResolveKubeConfigFile()
+	data, err := os.ReadFile(kubeconfig)
+	Expect(err).NotTo(HaveOccurred())
+	return data
+}, func(data []byte) {
+	restCfg, err := clientcmd.RESTConfigFromKubeConfig(data)
+	Expect(err).NotTo(HaveOccurred())
+
+	k8sClient, err = client.New(restCfg, client.Options{Scheme: scheme})
+	Expect(err).NotTo(HaveOccurred())
+	e2e_utils.SetRestConfig(restCfg)
+
+	ctx = context.Background()
+
+	fmt.Println(">>> Running FIPS E2E tests with the following parameters:")
+	fmt.Printf("  %-24s %s\n", "Install Namespace:", e2e_utils.InstallNamespace)
+	fmt.Printf("  %-24s %s\n", "Inject CA:", e2e_utils.InjectCA())
+
+	By("ensuring the policy-controller-operator namespace exists")
+	Expect(k8sClient.Create(ctx, &corev1.Namespace{
+		ObjectMeta: metav1.ObjectMeta{Name: e2e_utils.InstallNamespace},
+	})).To(SatisfyAny(Succeed(), MatchError(ContainSubstring("already exists"))))
+
+	By("applying the PolicyController CR")
+	renderedPolicyController, err := e2e_utils.RenderTemplate(e2e_utils.PolicyControllerCRPath, map[string]string{
+		"NS": e2e_utils.InstallNamespace,
+	})
+	Expect(err).NotTo(HaveOccurred())
+	Expect(e2e_utils.ApplyManifest(ctx, k8sClient, renderedPolicyController, "")).To(Succeed())
+
+	By("ensuring deployment is ready")
+	Eventually(func(ctx context.Context) error {
+		return e2e_utils.WaitForDeploymentReady(ctx, k8sClient, e2e_utils.InstallNamespace, e2e_utils.DeploymentName)
+	}).WithContext(ctx).Should(Succeed(), "timed out waiting for Deployment %q to be ready", e2e_utils.DeploymentName)
+
+	By("detecting and configuring FIPS mode")
+	e2e_utils.DetectAndConfigureFIPS(ctx, k8sClient)
+
+	By("injecting CA")
+	injectCA, err := strconv.ParseBool(strings.TrimSpace(e2e_utils.InjectCA()))
+	Expect(err).NotTo(HaveOccurred())
+	if injectCA {
+		Expect(e2e_utils.InjectCAIntoDeployment(ctx, k8sClient, e2e_utils.DeploymentName, e2e_utils.InstallNamespace)).To(Succeed())
+		Eventually(func(ctx context.Context) error {
+			return e2e_utils.WaitForConfigMapKey(ctx, k8sClient, e2e_utils.InstallNamespace, "trusted-ca-bundle", "ca-bundle.crt")
+		}).WithContext(ctx).Should(Succeed(), "trusted-ca-bundle never got its ca-bundle.crt")
+
+		Eventually(func(ctx context.Context) error {
+			return e2e_utils.WaitForDeploymentReady(ctx, k8sClient, e2e_utils.InstallNamespace, e2e_utils.DeploymentName)
+		}).WithContext(ctx).Should(Succeed(), "timed out waiting for Deployment %q to be ready after CA injection", e2e_utils.DeploymentName)
+	}
+
+	By("verifying all required resources are created")
+	e2e_utils.ExpectRequiredResources(ctx, k8sClient)
+})
+
+var _ = AfterSuite(func() {
+	By("cleaning up policy controller resources")
+	gvk := schema.GroupVersionKind{
+		Group:   "rhtas.charts.redhat.com",
+		Version: "v1alpha1",
+		Kind:    "PolicyController",
+	}
+	Expect(e2e_utils.DeleteResource(ctx, k8sClient, gvk, "policycontroller-sample", e2e_utils.InstallNamespace)).To(Succeed())
+})