Support FIPS mode via feature flags & cluster tags#5333
Conversation
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: mzazrivec The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
Hi @mzazrivec. Thanks for your PR. I'm waiting for a Azure member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
Adds support for provisioning new ARO-HCP clusters in FIPS mode, controlled via an Azure feature flag and an ARM cluster tag (fips-enabled).
Changes:
- Adds
FipsEnabledto experimental feature configuration and maps it into ClusterService cluster builder. - Introduces a new ARM tag constant and admission mutation logic to parse/validate the tag and set
ExperimentalFeatures.FipsEnabled. - Extends cluster customer properties with a
fipsEnabledfield.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
| internal/ocm/convert.go | Plumbs ExperimentalFeatures.FipsEnabled into the CS cluster builder (FIPS flag). |
| internal/api/types_experimental.go | Adds FipsEnabled to experimental feature type and defines string constants for tag parsing. |
| internal/api/types_cluster.go | Adds FipsEnabled to customer properties (JSON). |
| internal/api/featureflags.go | Adds tag constant for enabling FIPS via ARM tags. |
| internal/admission/admit_cluster.go | Reads fips-enabled tag and sets experimentalFeatures.FipsEnabled / validates values. |
| Etcd EtcdProfile `json:"etcd,omitempty"` | ||
| ClusterImageRegistry ClusterImageRegistryProfile `json:"clusterImageRegistry,omitempty"` | ||
| ImageDigestMirrors []ImageDigestMirror `json:"imageDigestMirrors,omitempty"` | ||
| FipsEnabled bool `json:"fipsEnabled` |
| fipsEnabled := lookupTag(tags, api.TagClusterFipsEnabled) | ||
| switch fipsEnabled { | ||
| case api.FipsModeEnabled: | ||
| experimentalFeatures.FipsEnabled = true | ||
| case api.FipsModeDisabled: | ||
| experimentalFeatures.FipsEnabled = false | ||
| default: | ||
| errs = append(errs, field.Invalid( | ||
| fldPath.Key(api.TagClusterFipsEnabled), fipsEnabled, | ||
| fmt.Sprintf("must be %s or %s", api.FipsModeEnabled, api.FipsModeDisabled), | ||
| )) | ||
| } |
| // TagClusterFipsEnabled is the ARM resource tag that enables FIPS mode | ||
| // for the ARO-HCP cluster during installation when the ExperimentalReleaseFeatures | ||
| // AFEC is registered on the subscription. | ||
| TagClusterFipsEnabled = "fips-enabled" |
| ControlPlanePodSizing ControlPlanePodSizing `json:"sizeOverride,omitempty"` | ||
|
|
||
| // FipsEnabled controls the fips mode for the installation of a new ARO-HCP cluster. | ||
| FipsEnabled bool `json:"fipsEnabled"` |
| if experimentalFeatures.FipsEnabled { | ||
| clusterBuilder.FIPS(true) | ||
| } else { | ||
| clusterBuilder.FIPS(false) | ||
| } |
mzazrivec
force-pushed
the
support_fips_via_feature_flags
branch
2 times, most recently
from
a0dd1bd to
f70aae7
Compare
mzazrivec
force-pushed
the
support_fips_via_feature_flags
branch
from
f70aae7 to
97c553a
Compare
What
This pull request adds the ability to provision a new ARO-HCP cluster in FIPS mode using Azure feature flags & cluster tag
fips-enabled.Why
Testing
Special notes for your reviewer
PR Checklist