Skip to content

Commit 7fadf81

Browse files
JasonPowrJasonPowr
committed
fips: check provided rekor crypto for fips compliance
1 parent 4db48dc commit 7fadf81

File tree

8 files changed

+476
-0
lines changed

8 files changed

+476
-0
lines changed

‎internal/controller/rekor/actions/backfillRedis/backfill_redis_cronjob.go‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ import (
1515
"github.com/securesign/operator/internal/controller/rekor/actions/searchIndex/redis"
1616
"github.com/securesign/operator/internal/images"
1717
"github.com/securesign/operator/internal/labels"
18+
cryptoutil "github.com/securesign/operator/internal/utils/crypto"
1819
"github.com/securesign/operator/internal/utils/kubernetes"
1920
"github.com/securesign/operator/internal/utils/kubernetes/ensure"
2021
tlsensure "github.com/securesign/operator/internal/utils/tls/ensure"
@@ -62,6 +63,18 @@ func (i backfillRedisCronJob) Handle(ctx context.Context, instance *rhtasv1alpha
6263

6364
labels := labels.For(actions.BackfillRedisCronJobName, actions.BackfillRedisCronJobName, instance.Name)
6465

66+
if cryptoutil.FIPSEnabled {
67+
if err := cryptoutil.ValidateTrustedCA(ctx, i.Client, instance.Namespace, instance.GetTrustedCA()); err != nil {
68+
meta.SetStatusCondition(&instance.Status.Conditions, metav1.Condition{
69+
Type: actions.RedisCondition,
70+
Status: metav1.ConditionFalse,
71+
Reason: constants.Failure,
72+
Message: err.Error(),
73+
})
74+
return i.StatusUpdate(ctx, instance)
75+
}
76+
}
77+
6578
if result, err = kubernetes.CreateOrUpdate(ctx, i.Client,
6679
&batchv1.CronJob{
6780
ObjectMeta: metav1.ObjectMeta{

‎internal/controller/rekor/actions/searchIndex/redis/actions/deployment.go‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ import (
1313
"github.com/securesign/operator/internal/images"
1414
"github.com/securesign/operator/internal/labels"
1515
cutils "github.com/securesign/operator/internal/utils"
16+
cryptoutil "github.com/securesign/operator/internal/utils/crypto"
1617
"github.com/securesign/operator/internal/utils/kubernetes"
1718
"github.com/securesign/operator/internal/utils/kubernetes/ensure"
1819
"github.com/securesign/operator/internal/utils/kubernetes/ensure/deployment"
@@ -60,6 +61,18 @@ func (i deployAction) Handle(ctx context.Context, instance *rhtasv1alpha1.Rekor)
6061
return i.Error(ctx, fmt.Errorf("failed to get CA path: %w", err), instance)
6162
}
6263

64+
if cryptoutil.FIPSEnabled {
65+
if err := cryptoutil.ValidateTrustedCA(ctx, i.Client, instance.Namespace, instance.GetTrustedCA()); err != nil {
66+
meta.SetStatusCondition(&instance.Status.Conditions, metav1.Condition{
67+
Type: actions.RedisCondition,
68+
Status: metav1.ConditionFalse,
69+
Reason: constants.Failure,
70+
Message: err.Error(),
71+
})
72+
return i.StatusUpdate(ctx, instance)
73+
}
74+
}
75+
6376
if result, err = kubernetes.CreateOrUpdate(ctx, i.Client,
6477
&v1.Deployment{
6578
ObjectMeta: metav1.ObjectMeta{

‎internal/controller/rekor/actions/searchIndex/redis/actions/tls.go‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ import (
88
"github.com/securesign/operator/internal/action"
99
"github.com/securesign/operator/internal/constants"
1010
actions2 "github.com/securesign/operator/internal/controller/rekor/actions"
11+
cryptoutil "github.com/securesign/operator/internal/utils/crypto"
1112
"github.com/securesign/operator/internal/utils/kubernetes"
1213
"k8s.io/apimachinery/pkg/api/equality"
1314
"k8s.io/apimachinery/pkg/api/meta"
@@ -47,6 +48,18 @@ func (i tlsAction) CanHandle(_ context.Context, instance *rhtasv1alpha1.Rekor) b
4748
func (i tlsAction) Handle(ctx context.Context, instance *rhtasv1alpha1.Rekor) *action.Result {
4849
switch {
4950
case specTLS(instance).CertRef != nil:
51+
if cryptoutil.FIPSEnabled {
52+
if err := cryptoutil.ValidateTLS(i.Client, instance.Namespace, specTLS(instance)); err != nil {
53+
meta.SetStatusCondition(&instance.Status.Conditions, metav1.Condition{
54+
Type: actions2.RedisCondition,
55+
Status: metav1.ConditionFalse,
56+
Reason: constants.Failure,
57+
Message: fmt.Sprintf("TLS material is not FIPS-compliant: %v", err),
58+
})
59+
i.StatusUpdate(ctx, instance)
60+
return i.Requeue()
61+
}
62+
}
5063
setStatusTLS(instance, specTLS(instance))
5164
case kubernetes.IsOpenShift():
5265
setStatusTLS(instance, rhtasv1alpha1.TLS{

‎internal/controller/rekor/actions/server/deployment.go‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ import (
1616
"github.com/securesign/operator/internal/images"
1717
"github.com/securesign/operator/internal/labels"
1818
utils2 "github.com/securesign/operator/internal/utils"
19+
cryptoutil "github.com/securesign/operator/internal/utils/crypto"
1920
"github.com/securesign/operator/internal/utils/kubernetes"
2021
"github.com/securesign/operator/internal/utils/kubernetes/ensure"
2122
"github.com/securesign/operator/internal/utils/kubernetes/ensure/deployment"
@@ -66,6 +67,18 @@ func (i deployAction) Handle(ctx context.Context, instance *rhtasv1alpha1.Rekor)
6667
}
6768
i.Logger.V(1).Info("trillian logserver", "address", insCopy.Spec.Trillian.Address)
6869

70+
if cryptoutil.FIPSEnabled {
71+
if err := cryptoutil.ValidateTrustedCA(ctx, i.Client, instance.Namespace, instance.GetTrustedCA()); err != nil {
72+
meta.SetStatusCondition(&instance.Status.Conditions, metav1.Condition{
73+
Type: constants.Ready,
74+
Status: metav1.ConditionFalse,
75+
Reason: constants.Failure,
76+
Message: err.Error(),
77+
})
78+
return i.StatusUpdate(ctx, instance)
79+
}
80+
}
81+
6982
if result, err = kubernetes.CreateOrUpdate(ctx, i.Client,
7083
&v2.Deployment{
7184
ObjectMeta: metav1.ObjectMeta{

‎internal/controller/rekor/actions/server/generate_signer.go‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ import (
1717
"github.com/securesign/operator/internal/constants"
1818
"github.com/securesign/operator/internal/controller/rekor/actions"
1919
"github.com/securesign/operator/internal/labels"
20+
cryptoutil "github.com/securesign/operator/internal/utils/crypto"
2021
"github.com/securesign/operator/internal/utils/kubernetes"
2122
"github.com/securesign/operator/internal/utils/kubernetes/ensure"
2223
v1 "k8s.io/api/core/v1"
@@ -174,6 +175,83 @@ func (g generateSigner) Handle(ctx context.Context, instance *v1alpha1.Rekor) *a
174175
}
175176
}
176177
}
178+
179+
if cryptoutil.FIPSEnabled && newSigner.KeyRef != nil {
180+
privateKey, err := kubernetes.GetSecretData(g.Client, instance.Namespace, newSigner.KeyRef)
181+
if err != nil {
182+
if apierrors.IsNotFound(err) {
183+
meta.SetStatusCondition(&instance.Status.Conditions, metav1.Condition{
184+
Type: actions.SignerCondition,
185+
Status: metav1.ConditionFalse,
186+
Reason: constants.Failure,
187+
Message: err.Error(),
188+
})
189+
meta.SetStatusCondition(&instance.Status.Conditions, metav1.Condition{
190+
Type: actions.ServerCondition,
191+
Status: metav1.ConditionFalse,
192+
Reason: constants.Initialize,
193+
Message: fmt.Sprintf("waiting for signer secret %s", newSigner.KeyRef.Name),
194+
})
195+
if res := g.StatusUpdate(ctx, instance); res != nil && res.Err != nil {
196+
return res
197+
}
198+
return g.Requeue()
199+
}
200+
return g.Error(ctx, fmt.Errorf("could not load signer private key: %w", err), instance,
201+
metav1.Condition{
202+
Type: actions.SignerCondition,
203+
Status: metav1.ConditionFalse,
204+
Reason: constants.Failure,
205+
Message: err.Error(),
206+
},
207+
)
208+
}
209+
210+
var password []byte
211+
if newSigner.PasswordRef != nil {
212+
password, err = kubernetes.GetSecretData(g.Client, instance.Namespace, newSigner.PasswordRef)
213+
if err != nil {
214+
if apierrors.IsNotFound(err) {
215+
meta.SetStatusCondition(&instance.Status.Conditions, metav1.Condition{
216+
Type: actions.SignerCondition,
217+
Status: metav1.ConditionFalse,
218+
Reason: constants.Failure,
219+
Message: err.Error(),
220+
})
221+
meta.SetStatusCondition(&instance.Status.Conditions, metav1.Condition{
222+
Type: actions.ServerCondition,
223+
Status: metav1.ConditionFalse,
224+
Reason: constants.Initialize,
225+
Message: fmt.Sprintf("waiting for signer secret %s", newSigner.PasswordRef.Name),
226+
})
227+
if res := g.StatusUpdate(ctx, instance); res != nil && res.Err != nil {
228+
return res
229+
}
230+
return g.Requeue()
231+
}
232+
return g.Error(ctx, fmt.Errorf("could not load signer password: %w", err), instance,
233+
metav1.Condition{
234+
Type: actions.SignerCondition,
235+
Status: metav1.ConditionFalse,
236+
Reason: constants.Failure,
237+
Message: err.Error(),
238+
},
239+
)
240+
}
241+
}
242+
243+
if err := cryptoutil.ValidatePrivateKeyPEM(privateKey, password); err != nil {
244+
return g.Error(ctx, fmt.Errorf("signer key is not FIPS-compliant: %w", err), instance,
245+
metav1.Condition{
246+
Type: actions.SignerCondition,
247+
Status: metav1.ConditionFalse,
248+
Reason: constants.Failure,
249+
Message: err.Error(),
250+
},
251+
)
252+
}
253+
}
254+
177255
instance.Status.Signer = newSigner
178256
// force recreation of public key ref
179257
instance.Status.PublicKeyRef = nil

0 commit comments

Comments
 (0)