diff --git a/config/v1/types_tlssecurityprofile.go b/config/v1/types_tlssecurityprofile.go index 2e9be97aeb4..9701cfdc363 100644 --- a/config/v1/types_tlssecurityprofile.go +++ b/config/v1/types_tlssecurityprofile.go @@ -15,8 +15,16 @@ type TLSSecurityProfile struct { // Note that not all platform components honor the ordering: Go-based components use Go's // internal preference order and treat this list as a filter of allowed groups rather than // an ordered preference. - // Note that X25519MLKEM768 is a post-quantum hybrid group that is not - // FIPS-approved and should be ignored by components running in FIPS mode. + // Note on FIPS: the NIST P-curves (secp256r1, secp384r1, secp521r1) are + // FIPS-approved, as are the ML-KEM hybrid groups SecP256r1MLKEM768 and + // SecP384r1MLKEM1024 with a validated FIPS module (Go 1.26+). Plain X25519 is + // not FIPS-approved. X25519MLKEM768 is not usable under the OpenSSL-backed + // FIPS runtime OpenShift ships today, but is supported by Go's native FIPS + // module (planned as the FIPS backend from Go 1.27), so whether it is honored + // in FIPS mode depends on the component's crypto backend. Go-based components + // drop groups their FIPS runtime does not support; components that configure + // OpenSSL directly must omit unsupported groups or TLS configuration is + // rejected. // // The profiles are intent based, so they may change over time as new ciphers are // developed and existing ciphers are found to be insecure. Depending on @@ -168,8 +176,16 @@ const ( // There is a one-to-one mapping between these names and the group IDs defined // in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: // https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 -// Note that X25519MLKEM768 is a post-quantum hybrid group that is not -// FIPS-approved and should be ignored by components running in FIPS mode. +// Note on FIPS: the NIST P-curves (secp256r1, secp384r1, secp521r1) are +// FIPS-approved, as are the ML-KEM hybrid groups SecP256r1MLKEM768 and +// SecP384r1MLKEM1024 with a validated FIPS module (Go 1.26+). Plain X25519 is +// not FIPS-approved. X25519MLKEM768 is not usable under the OpenSSL-backed +// FIPS runtime OpenShift ships today, but is supported by Go's native FIPS +// module (planned as the FIPS backend from Go 1.27), so whether it is honored +// in FIPS mode depends on the component's crypto backend. Go-based components +// drop groups their FIPS runtime does not support; components that configure +// OpenSSL directly must omit unsupported groups or TLS configuration is +// rejected. // // +kubebuilder:validation:Enum=X25519;secp256r1;secp384r1;secp521r1;X25519MLKEM768;SecP256r1MLKEM768;SecP384r1MLKEM1024 type TLSGroup string @@ -274,8 +290,14 @@ const ( // NOTE: The caller needs to make sure to check that these constants are valid // for their binary. Not all entries map to values for all binaries. In the case // of ties, the kube-apiserver wins. Do not fail, just be sure to include only -// valid entries and everything will be ok. In particular, X25519MLKEM768 is -// not FIPS-approved and must be omitted by components running in FIPS mode. +// valid entries and everything will be ok. Regarding FIPS: the NIST P-curves +// (secp256r1, secp384r1, secp521r1) are FIPS-approved, as are the ML-KEM hybrid +// groups SecP256r1MLKEM768 and SecP384r1MLKEM1024 with a validated FIPS module +// (Go 1.26+). Plain X25519 is not FIPS-approved, and X25519MLKEM768 is usable in +// FIPS mode only with Go's native FIPS module (planned as the FIPS backend from +// Go 1.27), not the OpenSSL-backed runtime OpenShift ships today; components +// running in FIPS mode must omit whatever groups their crypto backend does not +// support. var TLSProfiles = map[TLSProfileType]*TLSProfileSpec{ TLSProfileOldType: { Ciphers: []string{ diff --git a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml index f3793fac61d..8b922868566 100644 --- a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml +++ b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml @@ -619,8 +619,16 @@ spec: There is a one-to-one mapping between these names and the group IDs defined in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note on FIPS: the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved, as are the ML-KEM hybrid groups SecP256r1MLKEM768 and + SecP384r1MLKEM1024 with a validated FIPS module (Go 1.26+). Plain X25519 is + not FIPS-approved. X25519MLKEM768 is not usable under the OpenSSL-backed + FIPS runtime OpenShift ships today, but is supported by Go's native FIPS + module (planned as the FIPS backend from Go 1.27), so whether it is honored + in FIPS mode depends on the component's crypto backend. Go-based components + drop groups their FIPS runtime does not support; components that configure + OpenSSL directly must omit unsupported groups or TLS configuration is + rejected. enum: - X25519 - secp256r1 @@ -738,8 +746,16 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note on FIPS: the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved, as are the ML-KEM hybrid groups SecP256r1MLKEM768 and + SecP384r1MLKEM1024 with a validated FIPS module (Go 1.26+). Plain X25519 is + not FIPS-approved. X25519MLKEM768 is not usable under the OpenSSL-backed + FIPS runtime OpenShift ships today, but is supported by Go's native FIPS + module (planned as the FIPS backend from Go 1.27), so whether it is honored + in FIPS mode depends on the component's crypto backend. Go-based components + drop groups their FIPS runtime does not support; components that configure + OpenSSL directly must omit unsupported groups or TLS configuration is + rejected. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-Default.crd.yaml b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-Default.crd.yaml index ef855e38741..67ad7182d1b 100644 --- a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-Default.crd.yaml +++ b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-Default.crd.yaml @@ -366,8 +366,16 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note on FIPS: the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved, as are the ML-KEM hybrid groups SecP256r1MLKEM768 and + SecP384r1MLKEM1024 with a validated FIPS module (Go 1.26+). Plain X25519 is + not FIPS-approved. X25519MLKEM768 is not usable under the OpenSSL-backed + FIPS runtime OpenShift ships today, but is supported by Go's native FIPS + module (planned as the FIPS backend from Go 1.27), so whether it is honored + in FIPS mode depends on the component's crypto backend. Go-based components + drop groups their FIPS runtime does not support; components that configure + OpenSSL directly must omit unsupported groups or TLS configuration is + rejected. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml index d06cd26ca79..85421b0fc59 100644 --- a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml +++ b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml @@ -619,8 +619,16 @@ spec: There is a one-to-one mapping between these names and the group IDs defined in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note on FIPS: the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved, as are the ML-KEM hybrid groups SecP256r1MLKEM768 and + SecP384r1MLKEM1024 with a validated FIPS module (Go 1.26+). Plain X25519 is + not FIPS-approved. X25519MLKEM768 is not usable under the OpenSSL-backed + FIPS runtime OpenShift ships today, but is supported by Go's native FIPS + module (planned as the FIPS backend from Go 1.27), so whether it is honored + in FIPS mode depends on the component's crypto backend. Go-based components + drop groups their FIPS runtime does not support; components that configure + OpenSSL directly must omit unsupported groups or TLS configuration is + rejected. enum: - X25519 - secp256r1 @@ -738,8 +746,16 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note on FIPS: the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved, as are the ML-KEM hybrid groups SecP256r1MLKEM768 and + SecP384r1MLKEM1024 with a validated FIPS module (Go 1.26+). Plain X25519 is + not FIPS-approved. X25519MLKEM768 is not usable under the OpenSSL-backed + FIPS runtime OpenShift ships today, but is supported by Go's native FIPS + module (planned as the FIPS backend from Go 1.27), so whether it is honored + in FIPS mode depends on the component's crypto backend. Go-based components + drop groups their FIPS runtime does not support; components that configure + OpenSSL directly must omit unsupported groups or TLS configuration is + rejected. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-OKD.crd.yaml b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-OKD.crd.yaml index 99c093b2176..44bbb8276c6 100644 --- a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-OKD.crd.yaml +++ b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-OKD.crd.yaml @@ -366,8 +366,16 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note on FIPS: the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved, as are the ML-KEM hybrid groups SecP256r1MLKEM768 and + SecP384r1MLKEM1024 with a validated FIPS module (Go 1.26+). Plain X25519 is + not FIPS-approved. X25519MLKEM768 is not usable under the OpenSSL-backed + FIPS runtime OpenShift ships today, but is supported by Go's native FIPS + module (planned as the FIPS backend from Go 1.27), so whether it is honored + in FIPS mode depends on the component's crypto backend. Go-based components + drop groups their FIPS runtime does not support; components that configure + OpenSSL directly must omit unsupported groups or TLS configuration is + rejected. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml index cce33594546..d10d330a018 100644 --- a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml +++ b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml @@ -619,8 +619,16 @@ spec: There is a one-to-one mapping between these names and the group IDs defined in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note on FIPS: the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved, as are the ML-KEM hybrid groups SecP256r1MLKEM768 and + SecP384r1MLKEM1024 with a validated FIPS module (Go 1.26+). Plain X25519 is + not FIPS-approved. X25519MLKEM768 is not usable under the OpenSSL-backed + FIPS runtime OpenShift ships today, but is supported by Go's native FIPS + module (planned as the FIPS backend from Go 1.27), so whether it is honored + in FIPS mode depends on the component's crypto backend. Go-based components + drop groups their FIPS runtime does not support; components that configure + OpenSSL directly must omit unsupported groups or TLS configuration is + rejected. enum: - X25519 - secp256r1 @@ -738,8 +746,16 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note on FIPS: the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved, as are the ML-KEM hybrid groups SecP256r1MLKEM768 and + SecP384r1MLKEM1024 with a validated FIPS module (Go 1.26+). Plain X25519 is + not FIPS-approved. X25519MLKEM768 is not usable under the OpenSSL-backed + FIPS runtime OpenShift ships today, but is supported by Go's native FIPS + module (planned as the FIPS backend from Go 1.27), so whether it is honored + in FIPS mode depends on the component's crypto backend. Go-based components + drop groups their FIPS runtime does not support; components that configure + OpenSSL directly must omit unsupported groups or TLS configuration is + rejected. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/AAA_ungated.yaml b/config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/AAA_ungated.yaml index 2bdf5884339..c5142e4b6b1 100644 --- a/config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/AAA_ungated.yaml +++ b/config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/AAA_ungated.yaml @@ -366,8 +366,16 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note on FIPS: the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved, as are the ML-KEM hybrid groups SecP256r1MLKEM768 and + SecP384r1MLKEM1024 with a validated FIPS module (Go 1.26+). Plain X25519 is + not FIPS-approved. X25519MLKEM768 is not usable under the OpenSSL-backed + FIPS runtime OpenShift ships today, but is supported by Go's native FIPS + module (planned as the FIPS backend from Go 1.27), so whether it is honored + in FIPS mode depends on the component's crypto backend. Go-based components + drop groups their FIPS runtime does not support; components that configure + OpenSSL directly must omit unsupported groups or TLS configuration is + rejected. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/KMSEncryption.yaml b/config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/KMSEncryption.yaml index 22c41067598..9433b99d6e4 100644 --- a/config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/KMSEncryption.yaml +++ b/config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/KMSEncryption.yaml @@ -662,8 +662,16 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note on FIPS: the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved, as are the ML-KEM hybrid groups SecP256r1MLKEM768 and + SecP384r1MLKEM1024 with a validated FIPS module (Go 1.26+). Plain X25519 is + not FIPS-approved. X25519MLKEM768 is not usable under the OpenSSL-backed + FIPS runtime OpenShift ships today, but is supported by Go's native FIPS + module (planned as the FIPS backend from Go 1.27), so whether it is honored + in FIPS mode depends on the component's crypto backend. Go-based components + drop groups their FIPS runtime does not support; components that configure + OpenSSL directly must omit unsupported groups or TLS configuration is + rejected. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/TLSAdherence.yaml b/config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/TLSAdherence.yaml index 1d77abba1dc..751a629d065 100644 --- a/config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/TLSAdherence.yaml +++ b/config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/TLSAdherence.yaml @@ -397,8 +397,16 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note on FIPS: the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved, as are the ML-KEM hybrid groups SecP256r1MLKEM768 and + SecP384r1MLKEM1024 with a validated FIPS module (Go 1.26+). Plain X25519 is + not FIPS-approved. X25519MLKEM768 is not usable under the OpenSSL-backed + FIPS runtime OpenShift ships today, but is supported by Go's native FIPS + module (planned as the FIPS backend from Go 1.27), so whether it is honored + in FIPS mode depends on the component's crypto backend. Go-based components + drop groups their FIPS runtime does not support; components that configure + OpenSSL directly must omit unsupported groups or TLS configuration is + rejected. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/TLSGroupPreferences.yaml b/config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/TLSGroupPreferences.yaml index e3b095c3aa7..ad2f087ac85 100644 --- a/config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/TLSGroupPreferences.yaml +++ b/config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/TLSGroupPreferences.yaml @@ -282,8 +282,16 @@ spec: There is a one-to-one mapping between these names and the group IDs defined in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note on FIPS: the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved, as are the ML-KEM hybrid groups SecP256r1MLKEM768 and + SecP384r1MLKEM1024 with a validated FIPS module (Go 1.26+). Plain X25519 is + not FIPS-approved. X25519MLKEM768 is not usable under the OpenSSL-backed + FIPS runtime OpenShift ships today, but is supported by Go's native FIPS + module (planned as the FIPS backend from Go 1.27), so whether it is honored + in FIPS mode depends on the component's crypto backend. Go-based components + drop groups their FIPS runtime does not support; components that configure + OpenSSL directly must omit unsupported groups or TLS configuration is + rejected. enum: - X25519 - secp256r1 @@ -401,8 +409,16 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note on FIPS: the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved, as are the ML-KEM hybrid groups SecP256r1MLKEM768 and + SecP384r1MLKEM1024 with a validated FIPS module (Go 1.26+). Plain X25519 is + not FIPS-approved. X25519MLKEM768 is not usable under the OpenSSL-backed + FIPS runtime OpenShift ships today, but is supported by Go's native FIPS + module (planned as the FIPS backend from Go 1.27), so whether it is honored + in FIPS mode depends on the component's crypto backend. Go-based components + drop groups their FIPS runtime does not support; components that configure + OpenSSL directly must omit unsupported groups or TLS configuration is + rejected. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/config/v1/zz_generated.swagger_doc_generated.go b/config/v1/zz_generated.swagger_doc_generated.go index 0519119af44..fbf63af9082 100644 --- a/config/v1/zz_generated.swagger_doc_generated.go +++ b/config/v1/zz_generated.swagger_doc_generated.go @@ -3216,7 +3216,7 @@ func (TLSProfileSpec) SwaggerDoc() map[string]string { var map_TLSSecurityProfile = map[string]string{ "": "TLSSecurityProfile defines the schema for a TLS security profile. This object is used by operators to apply TLS security settings to operands.", - "type": "type is one of Old, Intermediate, Modern or Custom. Custom provides the ability to specify individual TLS security profile parameters.\n\nThe cipher and groups lists in these profiles are based on version 5.8 of the Mozilla Server Side TLS configuration guidelines. See: https://ssl-config.mozilla.org/guidelines/5.8.json\n\nThe groups are listed in suggested preference order, with the most preferred group first. Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. Note that X25519MLKEM768 is a post-quantum hybrid group that is not FIPS-approved and should be ignored by components running in FIPS mode.\n\nThe profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on precisely which ciphers are available to a process, the list may be reduced.", + "type": "type is one of Old, Intermediate, Modern or Custom. Custom provides the ability to specify individual TLS security profile parameters.\n\nThe cipher and groups lists in these profiles are based on version 5.8 of the Mozilla Server Side TLS configuration guidelines. See: https://ssl-config.mozilla.org/guidelines/5.8.json\n\nThe groups are listed in suggested preference order, with the most preferred group first. Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. Note on FIPS: the NIST P-curves (secp256r1, secp384r1, secp521r1) are FIPS-approved, as are the ML-KEM hybrid groups SecP256r1MLKEM768 and SecP384r1MLKEM1024 with a validated FIPS module (Go 1.26+). Plain X25519 is not FIPS-approved. X25519MLKEM768 is not usable under the OpenSSL-backed FIPS runtime OpenShift ships today, but is supported by Go's native FIPS module (planned as the FIPS backend from Go 1.27), so whether it is honored in FIPS mode depends on the component's crypto backend. Go-based components drop groups their FIPS runtime does not support; components that configure OpenSSL directly must omit unsupported groups or TLS configuration is rejected.\n\nThe profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on precisely which ciphers are available to a process, the list may be reduced.", "old": "old is a TLS profile for use when services need to be accessed by very old clients or libraries and should be used only as a last resort.\n\nThe supported groups list includes by default the following groups in suggested preference order (ordering may not be honored by all implementations): X25519MLKEM768, X25519, secp256r1, secp384r1.\n\nThis profile is equivalent to a Custom profile specified as:\n minTLSVersion: VersionTLS10\n ciphers:\n - TLS_AES_128_GCM_SHA256\n - TLS_AES_256_GCM_SHA384\n - TLS_CHACHA20_POLY1305_SHA256\n - ECDHE-ECDSA-AES128-GCM-SHA256\n - ECDHE-RSA-AES128-GCM-SHA256\n - ECDHE-ECDSA-AES256-GCM-SHA384\n - ECDHE-RSA-AES256-GCM-SHA384\n - ECDHE-ECDSA-CHACHA20-POLY1305\n - ECDHE-RSA-CHACHA20-POLY1305\n - ECDHE-ECDSA-AES128-SHA256\n - ECDHE-RSA-AES128-SHA256\n - ECDHE-ECDSA-AES128-SHA\n - ECDHE-RSA-AES128-SHA\n - ECDHE-ECDSA-AES256-SHA384\n - ECDHE-RSA-AES256-SHA384\n - ECDHE-ECDSA-AES256-SHA\n - ECDHE-RSA-AES256-SHA\n - AES128-GCM-SHA256\n - AES256-GCM-SHA384\n - AES128-SHA256\n - AES256-SHA256\n - AES128-SHA\n - AES256-SHA\n - DES-CBC3-SHA", "intermediate": "intermediate is a TLS profile for use when you do not need compatibility with legacy clients and want to remain highly secure while being compatible with most clients currently in use.\n\nThe supported groups list includes by default the following groups in suggested preference order (ordering may not be honored by all implementations): X25519MLKEM768, X25519, secp256r1, secp384r1.\n\nThis profile is equivalent to a Custom profile specified as:\n minTLSVersion: VersionTLS12\n ciphers:\n - TLS_AES_128_GCM_SHA256\n - TLS_AES_256_GCM_SHA384\n - TLS_CHACHA20_POLY1305_SHA256\n - ECDHE-ECDSA-AES128-GCM-SHA256\n - ECDHE-RSA-AES128-GCM-SHA256\n - ECDHE-ECDSA-AES256-GCM-SHA384\n - ECDHE-RSA-AES256-GCM-SHA384\n - ECDHE-ECDSA-CHACHA20-POLY1305\n - ECDHE-RSA-CHACHA20-POLY1305", "modern": "modern is a TLS security profile for use with clients that support TLS 1.3 and do not need backward compatibility for older clients. The supported groups list includes by default the following groups in suggested preference order (ordering may not be honored by all implementations): X25519MLKEM768, X25519, secp256r1, secp384r1. This profile is equivalent to a Custom profile specified as:\n minTLSVersion: VersionTLS13\n ciphers:\n - TLS_AES_128_GCM_SHA256\n - TLS_AES_256_GCM_SHA384\n - TLS_CHACHA20_POLY1305_SHA256", diff --git a/machineconfiguration/v1/zz_generated.crd-manifests/0000_80_machine-config_01_kubeletconfigs-CustomNoUpgrade.crd.yaml b/machineconfiguration/v1/zz_generated.crd-manifests/0000_80_machine-config_01_kubeletconfigs-CustomNoUpgrade.crd.yaml index 3c3fbc06176..58d162cabf2 100644 --- a/machineconfiguration/v1/zz_generated.crd-manifests/0000_80_machine-config_01_kubeletconfigs-CustomNoUpgrade.crd.yaml +++ b/machineconfiguration/v1/zz_generated.crd-manifests/0000_80_machine-config_01_kubeletconfigs-CustomNoUpgrade.crd.yaml @@ -202,8 +202,16 @@ spec: There is a one-to-one mapping between these names and the group IDs defined in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note on FIPS: the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved, as are the ML-KEM hybrid groups SecP256r1MLKEM768 and + SecP384r1MLKEM1024 with a validated FIPS module (Go 1.26+). Plain X25519 is + not FIPS-approved. X25519MLKEM768 is not usable under the OpenSSL-backed + FIPS runtime OpenShift ships today, but is supported by Go's native FIPS + module (planned as the FIPS backend from Go 1.27), so whether it is honored + in FIPS mode depends on the component's crypto backend. Go-based components + drop groups their FIPS runtime does not support; components that configure + OpenSSL directly must omit unsupported groups or TLS configuration is + rejected. enum: - X25519 - secp256r1 @@ -321,8 +329,16 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note on FIPS: the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved, as are the ML-KEM hybrid groups SecP256r1MLKEM768 and + SecP384r1MLKEM1024 with a validated FIPS module (Go 1.26+). Plain X25519 is + not FIPS-approved. X25519MLKEM768 is not usable under the OpenSSL-backed + FIPS runtime OpenShift ships today, but is supported by Go's native FIPS + module (planned as the FIPS backend from Go 1.27), so whether it is honored + in FIPS mode depends on the component's crypto backend. Go-based components + drop groups their FIPS runtime does not support; components that configure + OpenSSL directly must omit unsupported groups or TLS configuration is + rejected. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/machineconfiguration/v1/zz_generated.crd-manifests/0000_80_machine-config_01_kubeletconfigs-Default.crd.yaml b/machineconfiguration/v1/zz_generated.crd-manifests/0000_80_machine-config_01_kubeletconfigs-Default.crd.yaml index a28b15e4f22..ce3756058ba 100644 --- a/machineconfiguration/v1/zz_generated.crd-manifests/0000_80_machine-config_01_kubeletconfigs-Default.crd.yaml +++ b/machineconfiguration/v1/zz_generated.crd-manifests/0000_80_machine-config_01_kubeletconfigs-Default.crd.yaml @@ -265,8 +265,16 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note on FIPS: the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved, as are the ML-KEM hybrid groups SecP256r1MLKEM768 and + SecP384r1MLKEM1024 with a validated FIPS module (Go 1.26+). Plain X25519 is + not FIPS-approved. X25519MLKEM768 is not usable under the OpenSSL-backed + FIPS runtime OpenShift ships today, but is supported by Go's native FIPS + module (planned as the FIPS backend from Go 1.27), so whether it is honored + in FIPS mode depends on the component's crypto backend. Go-based components + drop groups their FIPS runtime does not support; components that configure + OpenSSL directly must omit unsupported groups or TLS configuration is + rejected. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/machineconfiguration/v1/zz_generated.crd-manifests/0000_80_machine-config_01_kubeletconfigs-DevPreviewNoUpgrade.crd.yaml b/machineconfiguration/v1/zz_generated.crd-manifests/0000_80_machine-config_01_kubeletconfigs-DevPreviewNoUpgrade.crd.yaml index a3165d1d83c..7e4309a002c 100644 --- a/machineconfiguration/v1/zz_generated.crd-manifests/0000_80_machine-config_01_kubeletconfigs-DevPreviewNoUpgrade.crd.yaml +++ b/machineconfiguration/v1/zz_generated.crd-manifests/0000_80_machine-config_01_kubeletconfigs-DevPreviewNoUpgrade.crd.yaml @@ -202,8 +202,16 @@ spec: There is a one-to-one mapping between these names and the group IDs defined in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note on FIPS: the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved, as are the ML-KEM hybrid groups SecP256r1MLKEM768 and + SecP384r1MLKEM1024 with a validated FIPS module (Go 1.26+). Plain X25519 is + not FIPS-approved. X25519MLKEM768 is not usable under the OpenSSL-backed + FIPS runtime OpenShift ships today, but is supported by Go's native FIPS + module (planned as the FIPS backend from Go 1.27), so whether it is honored + in FIPS mode depends on the component's crypto backend. Go-based components + drop groups their FIPS runtime does not support; components that configure + OpenSSL directly must omit unsupported groups or TLS configuration is + rejected. enum: - X25519 - secp256r1 @@ -321,8 +329,16 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note on FIPS: the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved, as are the ML-KEM hybrid groups SecP256r1MLKEM768 and + SecP384r1MLKEM1024 with a validated FIPS module (Go 1.26+). Plain X25519 is + not FIPS-approved. X25519MLKEM768 is not usable under the OpenSSL-backed + FIPS runtime OpenShift ships today, but is supported by Go's native FIPS + module (planned as the FIPS backend from Go 1.27), so whether it is honored + in FIPS mode depends on the component's crypto backend. Go-based components + drop groups their FIPS runtime does not support; components that configure + OpenSSL directly must omit unsupported groups or TLS configuration is + rejected. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/machineconfiguration/v1/zz_generated.crd-manifests/0000_80_machine-config_01_kubeletconfigs-OKD.crd.yaml b/machineconfiguration/v1/zz_generated.crd-manifests/0000_80_machine-config_01_kubeletconfigs-OKD.crd.yaml index f15a54fc3ad..3c81dc50841 100644 --- a/machineconfiguration/v1/zz_generated.crd-manifests/0000_80_machine-config_01_kubeletconfigs-OKD.crd.yaml +++ b/machineconfiguration/v1/zz_generated.crd-manifests/0000_80_machine-config_01_kubeletconfigs-OKD.crd.yaml @@ -265,8 +265,16 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note on FIPS: the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved, as are the ML-KEM hybrid groups SecP256r1MLKEM768 and + SecP384r1MLKEM1024 with a validated FIPS module (Go 1.26+). Plain X25519 is + not FIPS-approved. X25519MLKEM768 is not usable under the OpenSSL-backed + FIPS runtime OpenShift ships today, but is supported by Go's native FIPS + module (planned as the FIPS backend from Go 1.27), so whether it is honored + in FIPS mode depends on the component's crypto backend. Go-based components + drop groups their FIPS runtime does not support; components that configure + OpenSSL directly must omit unsupported groups or TLS configuration is + rejected. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/machineconfiguration/v1/zz_generated.crd-manifests/0000_80_machine-config_01_kubeletconfigs-TechPreviewNoUpgrade.crd.yaml b/machineconfiguration/v1/zz_generated.crd-manifests/0000_80_machine-config_01_kubeletconfigs-TechPreviewNoUpgrade.crd.yaml index 23fec954d39..c3b599453ad 100644 --- a/machineconfiguration/v1/zz_generated.crd-manifests/0000_80_machine-config_01_kubeletconfigs-TechPreviewNoUpgrade.crd.yaml +++ b/machineconfiguration/v1/zz_generated.crd-manifests/0000_80_machine-config_01_kubeletconfigs-TechPreviewNoUpgrade.crd.yaml @@ -202,8 +202,16 @@ spec: There is a one-to-one mapping between these names and the group IDs defined in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note on FIPS: the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved, as are the ML-KEM hybrid groups SecP256r1MLKEM768 and + SecP384r1MLKEM1024 with a validated FIPS module (Go 1.26+). Plain X25519 is + not FIPS-approved. X25519MLKEM768 is not usable under the OpenSSL-backed + FIPS runtime OpenShift ships today, but is supported by Go's native FIPS + module (planned as the FIPS backend from Go 1.27), so whether it is honored + in FIPS mode depends on the component's crypto backend. Go-based components + drop groups their FIPS runtime does not support; components that configure + OpenSSL directly must omit unsupported groups or TLS configuration is + rejected. enum: - X25519 - secp256r1 @@ -321,8 +329,16 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note on FIPS: the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved, as are the ML-KEM hybrid groups SecP256r1MLKEM768 and + SecP384r1MLKEM1024 with a validated FIPS module (Go 1.26+). Plain X25519 is + not FIPS-approved. X25519MLKEM768 is not usable under the OpenSSL-backed + FIPS runtime OpenShift ships today, but is supported by Go's native FIPS + module (planned as the FIPS backend from Go 1.27), so whether it is honored + in FIPS mode depends on the component's crypto backend. Go-based components + drop groups their FIPS runtime does not support; components that configure + OpenSSL directly must omit unsupported groups or TLS configuration is + rejected. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/machineconfiguration/v1/zz_generated.featuregated-crd-manifests/kubeletconfigs.machineconfiguration.openshift.io/AAA_ungated.yaml b/machineconfiguration/v1/zz_generated.featuregated-crd-manifests/kubeletconfigs.machineconfiguration.openshift.io/AAA_ungated.yaml index 66d909a97b7..5c1095ef3af 100644 --- a/machineconfiguration/v1/zz_generated.featuregated-crd-manifests/kubeletconfigs.machineconfiguration.openshift.io/AAA_ungated.yaml +++ b/machineconfiguration/v1/zz_generated.featuregated-crd-manifests/kubeletconfigs.machineconfiguration.openshift.io/AAA_ungated.yaml @@ -265,8 +265,16 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note on FIPS: the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved, as are the ML-KEM hybrid groups SecP256r1MLKEM768 and + SecP384r1MLKEM1024 with a validated FIPS module (Go 1.26+). Plain X25519 is + not FIPS-approved. X25519MLKEM768 is not usable under the OpenSSL-backed + FIPS runtime OpenShift ships today, but is supported by Go's native FIPS + module (planned as the FIPS backend from Go 1.27), so whether it is honored + in FIPS mode depends on the component's crypto backend. Go-based components + drop groups their FIPS runtime does not support; components that configure + OpenSSL directly must omit unsupported groups or TLS configuration is + rejected. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/machineconfiguration/v1/zz_generated.featuregated-crd-manifests/kubeletconfigs.machineconfiguration.openshift.io/GomaxprocsInjection.yaml b/machineconfiguration/v1/zz_generated.featuregated-crd-manifests/kubeletconfigs.machineconfiguration.openshift.io/GomaxprocsInjection.yaml index fae4842ea48..f314e766389 100644 --- a/machineconfiguration/v1/zz_generated.featuregated-crd-manifests/kubeletconfigs.machineconfiguration.openshift.io/GomaxprocsInjection.yaml +++ b/machineconfiguration/v1/zz_generated.featuregated-crd-manifests/kubeletconfigs.machineconfiguration.openshift.io/GomaxprocsInjection.yaml @@ -281,8 +281,16 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note on FIPS: the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved, as are the ML-KEM hybrid groups SecP256r1MLKEM768 and + SecP384r1MLKEM1024 with a validated FIPS module (Go 1.26+). Plain X25519 is + not FIPS-approved. X25519MLKEM768 is not usable under the OpenSSL-backed + FIPS runtime OpenShift ships today, but is supported by Go's native FIPS + module (planned as the FIPS backend from Go 1.27), so whether it is honored + in FIPS mode depends on the component's crypto backend. Go-based components + drop groups their FIPS runtime does not support; components that configure + OpenSSL directly must omit unsupported groups or TLS configuration is + rejected. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/machineconfiguration/v1/zz_generated.featuregated-crd-manifests/kubeletconfigs.machineconfiguration.openshift.io/TLSGroupPreferences.yaml b/machineconfiguration/v1/zz_generated.featuregated-crd-manifests/kubeletconfigs.machineconfiguration.openshift.io/TLSGroupPreferences.yaml index 69807f8ea31..c4eb1477eb7 100644 --- a/machineconfiguration/v1/zz_generated.featuregated-crd-manifests/kubeletconfigs.machineconfiguration.openshift.io/TLSGroupPreferences.yaml +++ b/machineconfiguration/v1/zz_generated.featuregated-crd-manifests/kubeletconfigs.machineconfiguration.openshift.io/TLSGroupPreferences.yaml @@ -186,8 +186,16 @@ spec: There is a one-to-one mapping between these names and the group IDs defined in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note on FIPS: the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved, as are the ML-KEM hybrid groups SecP256r1MLKEM768 and + SecP384r1MLKEM1024 with a validated FIPS module (Go 1.26+). Plain X25519 is + not FIPS-approved. X25519MLKEM768 is not usable under the OpenSSL-backed + FIPS runtime OpenShift ships today, but is supported by Go's native FIPS + module (planned as the FIPS backend from Go 1.27), so whether it is honored + in FIPS mode depends on the component's crypto backend. Go-based components + drop groups their FIPS runtime does not support; components that configure + OpenSSL directly must omit unsupported groups or TLS configuration is + rejected. enum: - X25519 - secp256r1 @@ -305,8 +313,16 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note on FIPS: the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved, as are the ML-KEM hybrid groups SecP256r1MLKEM768 and + SecP384r1MLKEM1024 with a validated FIPS module (Go 1.26+). Plain X25519 is + not FIPS-approved. X25519MLKEM768 is not usable under the OpenSSL-backed + FIPS runtime OpenShift ships today, but is supported by Go's native FIPS + module (planned as the FIPS backend from Go 1.27), so whether it is honored + in FIPS mode depends on the component's crypto backend. Go-based components + drop groups their FIPS runtime does not support; components that configure + OpenSSL directly must omit unsupported groups or TLS configuration is + rejected. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/openapi/generated_openapi/zz_generated.openapi.go b/openapi/generated_openapi/zz_generated.openapi.go index ef30e142d5a..dba49f832b0 100644 --- a/openapi/generated_openapi/zz_generated.openapi.go +++ b/openapi/generated_openapi/zz_generated.openapi.go @@ -21707,7 +21707,7 @@ func schema_openshift_api_config_v1_TLSSecurityProfile(ref common.ReferenceCallb Properties: map[string]spec.Schema{ "type": { SchemaProps: spec.SchemaProps{ - Description: "type is one of Old, Intermediate, Modern or Custom. Custom provides the ability to specify individual TLS security profile parameters.\n\nThe cipher and groups lists in these profiles are based on version 5.8 of the Mozilla Server Side TLS configuration guidelines. See: https://ssl-config.mozilla.org/guidelines/5.8.json\n\nThe groups are listed in suggested preference order, with the most preferred group first. Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. Note that X25519MLKEM768 is a post-quantum hybrid group that is not FIPS-approved and should be ignored by components running in FIPS mode.\n\nThe profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on precisely which ciphers are available to a process, the list may be reduced.", + Description: "type is one of Old, Intermediate, Modern or Custom. Custom provides the ability to specify individual TLS security profile parameters.\n\nThe cipher and groups lists in these profiles are based on version 5.8 of the Mozilla Server Side TLS configuration guidelines. See: https://ssl-config.mozilla.org/guidelines/5.8.json\n\nThe groups are listed in suggested preference order, with the most preferred group first. Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. Note on FIPS: the NIST P-curves (secp256r1, secp384r1, secp521r1) are FIPS-approved, as are the ML-KEM hybrid groups SecP256r1MLKEM768 and SecP384r1MLKEM1024 with a validated FIPS module (Go 1.26+). Plain X25519 is not FIPS-approved. X25519MLKEM768 is not usable under the OpenSSL-backed FIPS runtime OpenShift ships today, but is supported by Go's native FIPS module (planned as the FIPS backend from Go 1.27), so whether it is honored in FIPS mode depends on the component's crypto backend. Go-based components drop groups their FIPS runtime does not support; components that configure OpenSSL directly must omit unsupported groups or TLS configuration is rejected.\n\nThe profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on precisely which ciphers are available to a process, the list may be reduced.", Default: "", Type: []string{"string"}, Format: "", diff --git a/openapi/openapi.json b/openapi/openapi.json index 26bf2c9e39c..a50751f4bc7 100644 --- a/openapi/openapi.json +++ b/openapi/openapi.json @@ -11719,7 +11719,7 @@ "$ref": "#/definitions/com.github.openshift.api.config.v1.OldTLSProfile" }, "type": { - "description": "type is one of Old, Intermediate, Modern or Custom. Custom provides the ability to specify individual TLS security profile parameters.\n\nThe cipher and groups lists in these profiles are based on version 5.8 of the Mozilla Server Side TLS configuration guidelines. See: https://ssl-config.mozilla.org/guidelines/5.8.json\n\nThe groups are listed in suggested preference order, with the most preferred group first. Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. Note that X25519MLKEM768 is a post-quantum hybrid group that is not FIPS-approved and should be ignored by components running in FIPS mode.\n\nThe profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on precisely which ciphers are available to a process, the list may be reduced.", + "description": "type is one of Old, Intermediate, Modern or Custom. Custom provides the ability to specify individual TLS security profile parameters.\n\nThe cipher and groups lists in these profiles are based on version 5.8 of the Mozilla Server Side TLS configuration guidelines. See: https://ssl-config.mozilla.org/guidelines/5.8.json\n\nThe groups are listed in suggested preference order, with the most preferred group first. Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. Note on FIPS: the NIST P-curves (secp256r1, secp384r1, secp521r1) are FIPS-approved, as are the ML-KEM hybrid groups SecP256r1MLKEM768 and SecP384r1MLKEM1024 with a validated FIPS module (Go 1.26+). Plain X25519 is not FIPS-approved. X25519MLKEM768 is not usable under the OpenSSL-backed FIPS runtime OpenShift ships today, but is supported by Go's native FIPS module (planned as the FIPS backend from Go 1.27), so whether it is honored in FIPS mode depends on the component's crypto backend. Go-based components drop groups their FIPS runtime does not support; components that configure OpenSSL directly must omit unsupported groups or TLS configuration is rejected.\n\nThe profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on precisely which ciphers are available to a process, the list may be reduced.", "type": "string", "default": "" } diff --git a/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-CustomNoUpgrade.crd.yaml b/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-CustomNoUpgrade.crd.yaml index 3a55f7bdf01..e920c062166 100644 --- a/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-CustomNoUpgrade.crd.yaml +++ b/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-CustomNoUpgrade.crd.yaml @@ -2105,8 +2105,16 @@ spec: There is a one-to-one mapping between these names and the group IDs defined in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note on FIPS: the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved, as are the ML-KEM hybrid groups SecP256r1MLKEM768 and + SecP384r1MLKEM1024 with a validated FIPS module (Go 1.26+). Plain X25519 is + not FIPS-approved. X25519MLKEM768 is not usable under the OpenSSL-backed + FIPS runtime OpenShift ships today, but is supported by Go's native FIPS + module (planned as the FIPS backend from Go 1.27), so whether it is honored + in FIPS mode depends on the component's crypto backend. Go-based components + drop groups their FIPS runtime does not support; components that configure + OpenSSL directly must omit unsupported groups or TLS configuration is + rejected. enum: - X25519 - secp256r1 @@ -2224,8 +2232,16 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note on FIPS: the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved, as are the ML-KEM hybrid groups SecP256r1MLKEM768 and + SecP384r1MLKEM1024 with a validated FIPS module (Go 1.26+). Plain X25519 is + not FIPS-approved. X25519MLKEM768 is not usable under the OpenSSL-backed + FIPS runtime OpenShift ships today, but is supported by Go's native FIPS + module (planned as the FIPS backend from Go 1.27), so whether it is honored + in FIPS mode depends on the component's crypto backend. Go-based components + drop groups their FIPS runtime does not support; components that configure + OpenSSL directly must omit unsupported groups or TLS configuration is + rejected. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on @@ -3469,8 +3485,16 @@ spec: There is a one-to-one mapping between these names and the group IDs defined in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note on FIPS: the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved, as are the ML-KEM hybrid groups SecP256r1MLKEM768 and + SecP384r1MLKEM1024 with a validated FIPS module (Go 1.26+). Plain X25519 is + not FIPS-approved. X25519MLKEM768 is not usable under the OpenSSL-backed + FIPS runtime OpenShift ships today, but is supported by Go's native FIPS + module (planned as the FIPS backend from Go 1.27), so whether it is honored + in FIPS mode depends on the component's crypto backend. Go-based components + drop groups their FIPS runtime does not support; components that configure + OpenSSL directly must omit unsupported groups or TLS configuration is + rejected. enum: - X25519 - secp256r1 diff --git a/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-Default.crd.yaml b/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-Default.crd.yaml index 85ff60dbf83..11204239804 100644 --- a/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-Default.crd.yaml +++ b/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-Default.crd.yaml @@ -2184,8 +2184,16 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note on FIPS: the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved, as are the ML-KEM hybrid groups SecP256r1MLKEM768 and + SecP384r1MLKEM1024 with a validated FIPS module (Go 1.26+). Plain X25519 is + not FIPS-approved. X25519MLKEM768 is not usable under the OpenSSL-backed + FIPS runtime OpenShift ships today, but is supported by Go's native FIPS + module (planned as the FIPS backend from Go 1.27), so whether it is honored + in FIPS mode depends on the component's crypto backend. Go-based components + drop groups their FIPS runtime does not support; components that configure + OpenSSL directly must omit unsupported groups or TLS configuration is + rejected. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-DevPreviewNoUpgrade.crd.yaml b/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-DevPreviewNoUpgrade.crd.yaml index 0a638843f58..fded7a7db7b 100644 --- a/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-DevPreviewNoUpgrade.crd.yaml +++ b/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-DevPreviewNoUpgrade.crd.yaml @@ -2105,8 +2105,16 @@ spec: There is a one-to-one mapping between these names and the group IDs defined in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note on FIPS: the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved, as are the ML-KEM hybrid groups SecP256r1MLKEM768 and + SecP384r1MLKEM1024 with a validated FIPS module (Go 1.26+). Plain X25519 is + not FIPS-approved. X25519MLKEM768 is not usable under the OpenSSL-backed + FIPS runtime OpenShift ships today, but is supported by Go's native FIPS + module (planned as the FIPS backend from Go 1.27), so whether it is honored + in FIPS mode depends on the component's crypto backend. Go-based components + drop groups their FIPS runtime does not support; components that configure + OpenSSL directly must omit unsupported groups or TLS configuration is + rejected. enum: - X25519 - secp256r1 @@ -2224,8 +2232,16 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note on FIPS: the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved, as are the ML-KEM hybrid groups SecP256r1MLKEM768 and + SecP384r1MLKEM1024 with a validated FIPS module (Go 1.26+). Plain X25519 is + not FIPS-approved. X25519MLKEM768 is not usable under the OpenSSL-backed + FIPS runtime OpenShift ships today, but is supported by Go's native FIPS + module (planned as the FIPS backend from Go 1.27), so whether it is honored + in FIPS mode depends on the component's crypto backend. Go-based components + drop groups their FIPS runtime does not support; components that configure + OpenSSL directly must omit unsupported groups or TLS configuration is + rejected. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on @@ -3469,8 +3485,16 @@ spec: There is a one-to-one mapping between these names and the group IDs defined in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note on FIPS: the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved, as are the ML-KEM hybrid groups SecP256r1MLKEM768 and + SecP384r1MLKEM1024 with a validated FIPS module (Go 1.26+). Plain X25519 is + not FIPS-approved. X25519MLKEM768 is not usable under the OpenSSL-backed + FIPS runtime OpenShift ships today, but is supported by Go's native FIPS + module (planned as the FIPS backend from Go 1.27), so whether it is honored + in FIPS mode depends on the component's crypto backend. Go-based components + drop groups their FIPS runtime does not support; components that configure + OpenSSL directly must omit unsupported groups or TLS configuration is + rejected. enum: - X25519 - secp256r1 diff --git a/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-OKD.crd.yaml b/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-OKD.crd.yaml index 8220b5b91e4..190ba2e39d3 100644 --- a/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-OKD.crd.yaml +++ b/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-OKD.crd.yaml @@ -2184,8 +2184,16 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note on FIPS: the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved, as are the ML-KEM hybrid groups SecP256r1MLKEM768 and + SecP384r1MLKEM1024 with a validated FIPS module (Go 1.26+). Plain X25519 is + not FIPS-approved. X25519MLKEM768 is not usable under the OpenSSL-backed + FIPS runtime OpenShift ships today, but is supported by Go's native FIPS + module (planned as the FIPS backend from Go 1.27), so whether it is honored + in FIPS mode depends on the component's crypto backend. Go-based components + drop groups their FIPS runtime does not support; components that configure + OpenSSL directly must omit unsupported groups or TLS configuration is + rejected. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-TechPreviewNoUpgrade.crd.yaml b/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-TechPreviewNoUpgrade.crd.yaml index 27dcb3bab60..15a99dcfafb 100644 --- a/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-TechPreviewNoUpgrade.crd.yaml +++ b/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-TechPreviewNoUpgrade.crd.yaml @@ -2105,8 +2105,16 @@ spec: There is a one-to-one mapping between these names and the group IDs defined in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note on FIPS: the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved, as are the ML-KEM hybrid groups SecP256r1MLKEM768 and + SecP384r1MLKEM1024 with a validated FIPS module (Go 1.26+). Plain X25519 is + not FIPS-approved. X25519MLKEM768 is not usable under the OpenSSL-backed + FIPS runtime OpenShift ships today, but is supported by Go's native FIPS + module (planned as the FIPS backend from Go 1.27), so whether it is honored + in FIPS mode depends on the component's crypto backend. Go-based components + drop groups their FIPS runtime does not support; components that configure + OpenSSL directly must omit unsupported groups or TLS configuration is + rejected. enum: - X25519 - secp256r1 @@ -2224,8 +2232,16 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note on FIPS: the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved, as are the ML-KEM hybrid groups SecP256r1MLKEM768 and + SecP384r1MLKEM1024 with a validated FIPS module (Go 1.26+). Plain X25519 is + not FIPS-approved. X25519MLKEM768 is not usable under the OpenSSL-backed + FIPS runtime OpenShift ships today, but is supported by Go's native FIPS + module (planned as the FIPS backend from Go 1.27), so whether it is honored + in FIPS mode depends on the component's crypto backend. Go-based components + drop groups their FIPS runtime does not support; components that configure + OpenSSL directly must omit unsupported groups or TLS configuration is + rejected. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on @@ -3469,8 +3485,16 @@ spec: There is a one-to-one mapping between these names and the group IDs defined in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note on FIPS: the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved, as are the ML-KEM hybrid groups SecP256r1MLKEM768 and + SecP384r1MLKEM1024 with a validated FIPS module (Go 1.26+). Plain X25519 is + not FIPS-approved. X25519MLKEM768 is not usable under the OpenSSL-backed + FIPS runtime OpenShift ships today, but is supported by Go's native FIPS + module (planned as the FIPS backend from Go 1.27), so whether it is honored + in FIPS mode depends on the component's crypto backend. Go-based components + drop groups their FIPS runtime does not support; components that configure + OpenSSL directly must omit unsupported groups or TLS configuration is + rejected. enum: - X25519 - secp256r1 diff --git a/operator/v1/zz_generated.featuregated-crd-manifests/ingresscontrollers.operator.openshift.io/AAA_ungated.yaml b/operator/v1/zz_generated.featuregated-crd-manifests/ingresscontrollers.operator.openshift.io/AAA_ungated.yaml index 0e2340ea9f7..ce0293fb999 100644 --- a/operator/v1/zz_generated.featuregated-crd-manifests/ingresscontrollers.operator.openshift.io/AAA_ungated.yaml +++ b/operator/v1/zz_generated.featuregated-crd-manifests/ingresscontrollers.operator.openshift.io/AAA_ungated.yaml @@ -2151,8 +2151,16 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note on FIPS: the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved, as are the ML-KEM hybrid groups SecP256r1MLKEM768 and + SecP384r1MLKEM1024 with a validated FIPS module (Go 1.26+). Plain X25519 is + not FIPS-approved. X25519MLKEM768 is not usable under the OpenSSL-backed + FIPS runtime OpenShift ships today, but is supported by Go's native FIPS + module (planned as the FIPS backend from Go 1.27), so whether it is honored + in FIPS mode depends on the component's crypto backend. Go-based components + drop groups their FIPS runtime does not support; components that configure + OpenSSL directly must omit unsupported groups or TLS configuration is + rejected. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/operator/v1/zz_generated.featuregated-crd-manifests/ingresscontrollers.operator.openshift.io/IngressControllerDynamicConfigurationManager.yaml b/operator/v1/zz_generated.featuregated-crd-manifests/ingresscontrollers.operator.openshift.io/IngressControllerDynamicConfigurationManager.yaml index 451a1856a3a..11580f49995 100644 --- a/operator/v1/zz_generated.featuregated-crd-manifests/ingresscontrollers.operator.openshift.io/IngressControllerDynamicConfigurationManager.yaml +++ b/operator/v1/zz_generated.featuregated-crd-manifests/ingresscontrollers.operator.openshift.io/IngressControllerDynamicConfigurationManager.yaml @@ -2151,8 +2151,16 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note on FIPS: the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved, as are the ML-KEM hybrid groups SecP256r1MLKEM768 and + SecP384r1MLKEM1024 with a validated FIPS module (Go 1.26+). Plain X25519 is + not FIPS-approved. X25519MLKEM768 is not usable under the OpenSSL-backed + FIPS runtime OpenShift ships today, but is supported by Go's native FIPS + module (planned as the FIPS backend from Go 1.27), so whether it is honored + in FIPS mode depends on the component's crypto backend. Go-based components + drop groups their FIPS runtime does not support; components that configure + OpenSSL directly must omit unsupported groups or TLS configuration is + rejected. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/operator/v1/zz_generated.featuregated-crd-manifests/ingresscontrollers.operator.openshift.io/IngressControllerMultipleHAProxyVersions.yaml b/operator/v1/zz_generated.featuregated-crd-manifests/ingresscontrollers.operator.openshift.io/IngressControllerMultipleHAProxyVersions.yaml index 8213d8756b4..41977dfa40f 100644 --- a/operator/v1/zz_generated.featuregated-crd-manifests/ingresscontrollers.operator.openshift.io/IngressControllerMultipleHAProxyVersions.yaml +++ b/operator/v1/zz_generated.featuregated-crd-manifests/ingresscontrollers.operator.openshift.io/IngressControllerMultipleHAProxyVersions.yaml @@ -2177,8 +2177,16 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note on FIPS: the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved, as are the ML-KEM hybrid groups SecP256r1MLKEM768 and + SecP384r1MLKEM1024 with a validated FIPS module (Go 1.26+). Plain X25519 is + not FIPS-approved. X25519MLKEM768 is not usable under the OpenSSL-backed + FIPS runtime OpenShift ships today, but is supported by Go's native FIPS + module (planned as the FIPS backend from Go 1.27), so whether it is honored + in FIPS mode depends on the component's crypto backend. Go-based components + drop groups their FIPS runtime does not support; components that configure + OpenSSL directly must omit unsupported groups or TLS configuration is + rejected. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/operator/v1/zz_generated.featuregated-crd-manifests/ingresscontrollers.operator.openshift.io/TLSGroupPreferences.yaml b/operator/v1/zz_generated.featuregated-crd-manifests/ingresscontrollers.operator.openshift.io/TLSGroupPreferences.yaml index 890638706b7..7c98870bd20 100644 --- a/operator/v1/zz_generated.featuregated-crd-manifests/ingresscontrollers.operator.openshift.io/TLSGroupPreferences.yaml +++ b/operator/v1/zz_generated.featuregated-crd-manifests/ingresscontrollers.operator.openshift.io/TLSGroupPreferences.yaml @@ -2072,8 +2072,16 @@ spec: There is a one-to-one mapping between these names and the group IDs defined in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note on FIPS: the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved, as are the ML-KEM hybrid groups SecP256r1MLKEM768 and + SecP384r1MLKEM1024 with a validated FIPS module (Go 1.26+). Plain X25519 is + not FIPS-approved. X25519MLKEM768 is not usable under the OpenSSL-backed + FIPS runtime OpenShift ships today, but is supported by Go's native FIPS + module (planned as the FIPS backend from Go 1.27), so whether it is honored + in FIPS mode depends on the component's crypto backend. Go-based components + drop groups their FIPS runtime does not support; components that configure + OpenSSL directly must omit unsupported groups or TLS configuration is + rejected. enum: - X25519 - secp256r1 @@ -2191,8 +2199,16 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note on FIPS: the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved, as are the ML-KEM hybrid groups SecP256r1MLKEM768 and + SecP384r1MLKEM1024 with a validated FIPS module (Go 1.26+). Plain X25519 is + not FIPS-approved. X25519MLKEM768 is not usable under the OpenSSL-backed + FIPS runtime OpenShift ships today, but is supported by Go's native FIPS + module (planned as the FIPS backend from Go 1.27), so whether it is honored + in FIPS mode depends on the component's crypto backend. Go-based components + drop groups their FIPS runtime does not support; components that configure + OpenSSL directly must omit unsupported groups or TLS configuration is + rejected. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on @@ -3391,8 +3407,16 @@ spec: There is a one-to-one mapping between these names and the group IDs defined in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note on FIPS: the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved, as are the ML-KEM hybrid groups SecP256r1MLKEM768 and + SecP384r1MLKEM1024 with a validated FIPS module (Go 1.26+). Plain X25519 is + not FIPS-approved. X25519MLKEM768 is not usable under the OpenSSL-backed + FIPS runtime OpenShift ships today, but is supported by Go's native FIPS + module (planned as the FIPS backend from Go 1.27), so whether it is honored + in FIPS mode depends on the component's crypto backend. Go-based components + drop groups their FIPS runtime does not support; components that configure + OpenSSL directly must omit unsupported groups or TLS configuration is + rejected. enum: - X25519 - secp256r1 diff --git a/payload-manifests/crds/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml b/payload-manifests/crds/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml index f3793fac61d..8b922868566 100644 --- a/payload-manifests/crds/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml +++ b/payload-manifests/crds/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml @@ -619,8 +619,16 @@ spec: There is a one-to-one mapping between these names and the group IDs defined in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note on FIPS: the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved, as are the ML-KEM hybrid groups SecP256r1MLKEM768 and + SecP384r1MLKEM1024 with a validated FIPS module (Go 1.26+). Plain X25519 is + not FIPS-approved. X25519MLKEM768 is not usable under the OpenSSL-backed + FIPS runtime OpenShift ships today, but is supported by Go's native FIPS + module (planned as the FIPS backend from Go 1.27), so whether it is honored + in FIPS mode depends on the component's crypto backend. Go-based components + drop groups their FIPS runtime does not support; components that configure + OpenSSL directly must omit unsupported groups or TLS configuration is + rejected. enum: - X25519 - secp256r1 @@ -738,8 +746,16 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note on FIPS: the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved, as are the ML-KEM hybrid groups SecP256r1MLKEM768 and + SecP384r1MLKEM1024 with a validated FIPS module (Go 1.26+). Plain X25519 is + not FIPS-approved. X25519MLKEM768 is not usable under the OpenSSL-backed + FIPS runtime OpenShift ships today, but is supported by Go's native FIPS + module (planned as the FIPS backend from Go 1.27), so whether it is honored + in FIPS mode depends on the component's crypto backend. Go-based components + drop groups their FIPS runtime does not support; components that configure + OpenSSL directly must omit unsupported groups or TLS configuration is + rejected. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/payload-manifests/crds/0000_10_config-operator_01_apiservers-Default.crd.yaml b/payload-manifests/crds/0000_10_config-operator_01_apiservers-Default.crd.yaml index ef855e38741..67ad7182d1b 100644 --- a/payload-manifests/crds/0000_10_config-operator_01_apiservers-Default.crd.yaml +++ b/payload-manifests/crds/0000_10_config-operator_01_apiservers-Default.crd.yaml @@ -366,8 +366,16 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note on FIPS: the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved, as are the ML-KEM hybrid groups SecP256r1MLKEM768 and + SecP384r1MLKEM1024 with a validated FIPS module (Go 1.26+). Plain X25519 is + not FIPS-approved. X25519MLKEM768 is not usable under the OpenSSL-backed + FIPS runtime OpenShift ships today, but is supported by Go's native FIPS + module (planned as the FIPS backend from Go 1.27), so whether it is honored + in FIPS mode depends on the component's crypto backend. Go-based components + drop groups their FIPS runtime does not support; components that configure + OpenSSL directly must omit unsupported groups or TLS configuration is + rejected. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/payload-manifests/crds/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml b/payload-manifests/crds/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml index d06cd26ca79..85421b0fc59 100644 --- a/payload-manifests/crds/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml +++ b/payload-manifests/crds/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml @@ -619,8 +619,16 @@ spec: There is a one-to-one mapping between these names and the group IDs defined in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note on FIPS: the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved, as are the ML-KEM hybrid groups SecP256r1MLKEM768 and + SecP384r1MLKEM1024 with a validated FIPS module (Go 1.26+). Plain X25519 is + not FIPS-approved. X25519MLKEM768 is not usable under the OpenSSL-backed + FIPS runtime OpenShift ships today, but is supported by Go's native FIPS + module (planned as the FIPS backend from Go 1.27), so whether it is honored + in FIPS mode depends on the component's crypto backend. Go-based components + drop groups their FIPS runtime does not support; components that configure + OpenSSL directly must omit unsupported groups or TLS configuration is + rejected. enum: - X25519 - secp256r1 @@ -738,8 +746,16 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note on FIPS: the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved, as are the ML-KEM hybrid groups SecP256r1MLKEM768 and + SecP384r1MLKEM1024 with a validated FIPS module (Go 1.26+). Plain X25519 is + not FIPS-approved. X25519MLKEM768 is not usable under the OpenSSL-backed + FIPS runtime OpenShift ships today, but is supported by Go's native FIPS + module (planned as the FIPS backend from Go 1.27), so whether it is honored + in FIPS mode depends on the component's crypto backend. Go-based components + drop groups their FIPS runtime does not support; components that configure + OpenSSL directly must omit unsupported groups or TLS configuration is + rejected. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/payload-manifests/crds/0000_10_config-operator_01_apiservers-OKD.crd.yaml b/payload-manifests/crds/0000_10_config-operator_01_apiservers-OKD.crd.yaml index 99c093b2176..44bbb8276c6 100644 --- a/payload-manifests/crds/0000_10_config-operator_01_apiservers-OKD.crd.yaml +++ b/payload-manifests/crds/0000_10_config-operator_01_apiservers-OKD.crd.yaml @@ -366,8 +366,16 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note on FIPS: the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved, as are the ML-KEM hybrid groups SecP256r1MLKEM768 and + SecP384r1MLKEM1024 with a validated FIPS module (Go 1.26+). Plain X25519 is + not FIPS-approved. X25519MLKEM768 is not usable under the OpenSSL-backed + FIPS runtime OpenShift ships today, but is supported by Go's native FIPS + module (planned as the FIPS backend from Go 1.27), so whether it is honored + in FIPS mode depends on the component's crypto backend. Go-based components + drop groups their FIPS runtime does not support; components that configure + OpenSSL directly must omit unsupported groups or TLS configuration is + rejected. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/payload-manifests/crds/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml b/payload-manifests/crds/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml index cce33594546..d10d330a018 100644 --- a/payload-manifests/crds/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml +++ b/payload-manifests/crds/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml @@ -619,8 +619,16 @@ spec: There is a one-to-one mapping between these names and the group IDs defined in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note on FIPS: the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved, as are the ML-KEM hybrid groups SecP256r1MLKEM768 and + SecP384r1MLKEM1024 with a validated FIPS module (Go 1.26+). Plain X25519 is + not FIPS-approved. X25519MLKEM768 is not usable under the OpenSSL-backed + FIPS runtime OpenShift ships today, but is supported by Go's native FIPS + module (planned as the FIPS backend from Go 1.27), so whether it is honored + in FIPS mode depends on the component's crypto backend. Go-based components + drop groups their FIPS runtime does not support; components that configure + OpenSSL directly must omit unsupported groups or TLS configuration is + rejected. enum: - X25519 - secp256r1 @@ -738,8 +746,16 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note on FIPS: the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved, as are the ML-KEM hybrid groups SecP256r1MLKEM768 and + SecP384r1MLKEM1024 with a validated FIPS module (Go 1.26+). Plain X25519 is + not FIPS-approved. X25519MLKEM768 is not usable under the OpenSSL-backed + FIPS runtime OpenShift ships today, but is supported by Go's native FIPS + module (planned as the FIPS backend from Go 1.27), so whether it is honored + in FIPS mode depends on the component's crypto backend. Go-based components + drop groups their FIPS runtime does not support; components that configure + OpenSSL directly must omit unsupported groups or TLS configuration is + rejected. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/payload-manifests/crds/0000_80_machine-config_01_kubeletconfigs-CustomNoUpgrade.crd.yaml b/payload-manifests/crds/0000_80_machine-config_01_kubeletconfigs-CustomNoUpgrade.crd.yaml index 3c3fbc06176..58d162cabf2 100644 --- a/payload-manifests/crds/0000_80_machine-config_01_kubeletconfigs-CustomNoUpgrade.crd.yaml +++ b/payload-manifests/crds/0000_80_machine-config_01_kubeletconfigs-CustomNoUpgrade.crd.yaml @@ -202,8 +202,16 @@ spec: There is a one-to-one mapping between these names and the group IDs defined in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note on FIPS: the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved, as are the ML-KEM hybrid groups SecP256r1MLKEM768 and + SecP384r1MLKEM1024 with a validated FIPS module (Go 1.26+). Plain X25519 is + not FIPS-approved. X25519MLKEM768 is not usable under the OpenSSL-backed + FIPS runtime OpenShift ships today, but is supported by Go's native FIPS + module (planned as the FIPS backend from Go 1.27), so whether it is honored + in FIPS mode depends on the component's crypto backend. Go-based components + drop groups their FIPS runtime does not support; components that configure + OpenSSL directly must omit unsupported groups or TLS configuration is + rejected. enum: - X25519 - secp256r1 @@ -321,8 +329,16 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note on FIPS: the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved, as are the ML-KEM hybrid groups SecP256r1MLKEM768 and + SecP384r1MLKEM1024 with a validated FIPS module (Go 1.26+). Plain X25519 is + not FIPS-approved. X25519MLKEM768 is not usable under the OpenSSL-backed + FIPS runtime OpenShift ships today, but is supported by Go's native FIPS + module (planned as the FIPS backend from Go 1.27), so whether it is honored + in FIPS mode depends on the component's crypto backend. Go-based components + drop groups their FIPS runtime does not support; components that configure + OpenSSL directly must omit unsupported groups or TLS configuration is + rejected. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/payload-manifests/crds/0000_80_machine-config_01_kubeletconfigs-Default.crd.yaml b/payload-manifests/crds/0000_80_machine-config_01_kubeletconfigs-Default.crd.yaml index a28b15e4f22..ce3756058ba 100644 --- a/payload-manifests/crds/0000_80_machine-config_01_kubeletconfigs-Default.crd.yaml +++ b/payload-manifests/crds/0000_80_machine-config_01_kubeletconfigs-Default.crd.yaml @@ -265,8 +265,16 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note on FIPS: the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved, as are the ML-KEM hybrid groups SecP256r1MLKEM768 and + SecP384r1MLKEM1024 with a validated FIPS module (Go 1.26+). Plain X25519 is + not FIPS-approved. X25519MLKEM768 is not usable under the OpenSSL-backed + FIPS runtime OpenShift ships today, but is supported by Go's native FIPS + module (planned as the FIPS backend from Go 1.27), so whether it is honored + in FIPS mode depends on the component's crypto backend. Go-based components + drop groups their FIPS runtime does not support; components that configure + OpenSSL directly must omit unsupported groups or TLS configuration is + rejected. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/payload-manifests/crds/0000_80_machine-config_01_kubeletconfigs-DevPreviewNoUpgrade.crd.yaml b/payload-manifests/crds/0000_80_machine-config_01_kubeletconfigs-DevPreviewNoUpgrade.crd.yaml index a3165d1d83c..7e4309a002c 100644 --- a/payload-manifests/crds/0000_80_machine-config_01_kubeletconfigs-DevPreviewNoUpgrade.crd.yaml +++ b/payload-manifests/crds/0000_80_machine-config_01_kubeletconfigs-DevPreviewNoUpgrade.crd.yaml @@ -202,8 +202,16 @@ spec: There is a one-to-one mapping between these names and the group IDs defined in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note on FIPS: the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved, as are the ML-KEM hybrid groups SecP256r1MLKEM768 and + SecP384r1MLKEM1024 with a validated FIPS module (Go 1.26+). Plain X25519 is + not FIPS-approved. X25519MLKEM768 is not usable under the OpenSSL-backed + FIPS runtime OpenShift ships today, but is supported by Go's native FIPS + module (planned as the FIPS backend from Go 1.27), so whether it is honored + in FIPS mode depends on the component's crypto backend. Go-based components + drop groups their FIPS runtime does not support; components that configure + OpenSSL directly must omit unsupported groups or TLS configuration is + rejected. enum: - X25519 - secp256r1 @@ -321,8 +329,16 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note on FIPS: the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved, as are the ML-KEM hybrid groups SecP256r1MLKEM768 and + SecP384r1MLKEM1024 with a validated FIPS module (Go 1.26+). Plain X25519 is + not FIPS-approved. X25519MLKEM768 is not usable under the OpenSSL-backed + FIPS runtime OpenShift ships today, but is supported by Go's native FIPS + module (planned as the FIPS backend from Go 1.27), so whether it is honored + in FIPS mode depends on the component's crypto backend. Go-based components + drop groups their FIPS runtime does not support; components that configure + OpenSSL directly must omit unsupported groups or TLS configuration is + rejected. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/payload-manifests/crds/0000_80_machine-config_01_kubeletconfigs-OKD.crd.yaml b/payload-manifests/crds/0000_80_machine-config_01_kubeletconfigs-OKD.crd.yaml index f15a54fc3ad..3c81dc50841 100644 --- a/payload-manifests/crds/0000_80_machine-config_01_kubeletconfigs-OKD.crd.yaml +++ b/payload-manifests/crds/0000_80_machine-config_01_kubeletconfigs-OKD.crd.yaml @@ -265,8 +265,16 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note on FIPS: the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved, as are the ML-KEM hybrid groups SecP256r1MLKEM768 and + SecP384r1MLKEM1024 with a validated FIPS module (Go 1.26+). Plain X25519 is + not FIPS-approved. X25519MLKEM768 is not usable under the OpenSSL-backed + FIPS runtime OpenShift ships today, but is supported by Go's native FIPS + module (planned as the FIPS backend from Go 1.27), so whether it is honored + in FIPS mode depends on the component's crypto backend. Go-based components + drop groups their FIPS runtime does not support; components that configure + OpenSSL directly must omit unsupported groups or TLS configuration is + rejected. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/payload-manifests/crds/0000_80_machine-config_01_kubeletconfigs-TechPreviewNoUpgrade.crd.yaml b/payload-manifests/crds/0000_80_machine-config_01_kubeletconfigs-TechPreviewNoUpgrade.crd.yaml index 23fec954d39..c3b599453ad 100644 --- a/payload-manifests/crds/0000_80_machine-config_01_kubeletconfigs-TechPreviewNoUpgrade.crd.yaml +++ b/payload-manifests/crds/0000_80_machine-config_01_kubeletconfigs-TechPreviewNoUpgrade.crd.yaml @@ -202,8 +202,16 @@ spec: There is a one-to-one mapping between these names and the group IDs defined in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note on FIPS: the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved, as are the ML-KEM hybrid groups SecP256r1MLKEM768 and + SecP384r1MLKEM1024 with a validated FIPS module (Go 1.26+). Plain X25519 is + not FIPS-approved. X25519MLKEM768 is not usable under the OpenSSL-backed + FIPS runtime OpenShift ships today, but is supported by Go's native FIPS + module (planned as the FIPS backend from Go 1.27), so whether it is honored + in FIPS mode depends on the component's crypto backend. Go-based components + drop groups their FIPS runtime does not support; components that configure + OpenSSL directly must omit unsupported groups or TLS configuration is + rejected. enum: - X25519 - secp256r1 @@ -321,8 +329,16 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note on FIPS: the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved, as are the ML-KEM hybrid groups SecP256r1MLKEM768 and + SecP384r1MLKEM1024 with a validated FIPS module (Go 1.26+). Plain X25519 is + not FIPS-approved. X25519MLKEM768 is not usable under the OpenSSL-backed + FIPS runtime OpenShift ships today, but is supported by Go's native FIPS + module (planned as the FIPS backend from Go 1.27), so whether it is honored + in FIPS mode depends on the component's crypto backend. Go-based components + drop groups their FIPS runtime does not support; components that configure + OpenSSL directly must omit unsupported groups or TLS configuration is + rejected. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on