From efc48b8d1a804668e34036a7da4c956806bab097 Mon Sep 17 00:00:00 2001 From: Luis Sanchez Date: Fri, 14 Aug 2026 11:46:13 -0400 Subject: [PATCH] config,machineconfiguration,operator: correct FIPS-approved TLS group docs The TLSSecurityProfile and TLSGroup godoc singled out X25519MLKEM768 as the only group "not FIPS-approved and ignored in FIPS mode", which wrongly implied plain X25519 is usable under FIPS. In fact only the NIST P-curves (secp256r1, secp384r1, secp521r1) are FIPS-approved; X25519 and all ML-KEM post-quantum hybrid groups are not, and are ignored by components running in FIPS mode (Go's FIPS module refuses X25519 outright). Clarify the note wherever it appears and regenerate CRD manifests, swagger docs, and openapi. --- config/v1/types_tlssecurityprofile.go | 18 ++++++--- ...tor_01_apiservers-CustomNoUpgrade.crd.yaml | 12 ++++-- ...ig-operator_01_apiservers-Default.crd.yaml | 6 ++- ...01_apiservers-DevPreviewNoUpgrade.crd.yaml | 12 ++++-- ...config-operator_01_apiservers-OKD.crd.yaml | 6 ++- ...1_apiservers-TechPreviewNoUpgrade.crd.yaml | 12 ++++-- .../AAA_ungated.yaml | 6 ++- .../KMSEncryption.yaml | 6 ++- .../TLSAdherence.yaml | 6 ++- .../TLSGroupPreferences.yaml | 12 ++++-- .../v1/zz_generated.swagger_doc_generated.go | 2 +- ...01_kubeletconfigs-CustomNoUpgrade.crd.yaml | 12 ++++-- ...-config_01_kubeletconfigs-Default.crd.yaml | 6 ++- ...ubeletconfigs-DevPreviewNoUpgrade.crd.yaml | 12 ++++-- ...hine-config_01_kubeletconfigs-OKD.crd.yaml | 6 ++- ...beletconfigs-TechPreviewNoUpgrade.crd.yaml | 12 ++++-- .../AAA_ungated.yaml | 6 ++- .../TLSGroupPreferences.yaml | 12 ++++-- .../generated_openapi/zz_generated.openapi.go | 2 +- openapi/openapi.json | 40 ++++++++++++++----- ...ngresscontrollers-CustomNoUpgrade.crd.yaml | 18 ++++++--- ...ess_00_ingresscontrollers-Default.crd.yaml | 6 ++- ...sscontrollers-DevPreviewNoUpgrade.crd.yaml | 18 ++++++--- ...ingress_00_ingresscontrollers-OKD.crd.yaml | 6 ++- ...scontrollers-TechPreviewNoUpgrade.crd.yaml | 18 ++++++--- .../AAA_ungated.yaml | 6 ++- ...ControllerDynamicConfigurationManager.yaml | 6 ++- .../TLSGroupPreferences.yaml | 18 ++++++--- ...tor_01_apiservers-CustomNoUpgrade.crd.yaml | 12 ++++-- ...ig-operator_01_apiservers-Default.crd.yaml | 6 ++- ...01_apiservers-DevPreviewNoUpgrade.crd.yaml | 12 ++++-- ...config-operator_01_apiservers-OKD.crd.yaml | 6 ++- ...1_apiservers-TechPreviewNoUpgrade.crd.yaml | 12 ++++-- ...01_kubeletconfigs-CustomNoUpgrade.crd.yaml | 12 ++++-- ...-config_01_kubeletconfigs-Default.crd.yaml | 6 ++- ...ubeletconfigs-DevPreviewNoUpgrade.crd.yaml | 12 ++++-- ...hine-config_01_kubeletconfigs-OKD.crd.yaml | 6 ++- ...beletconfigs-TechPreviewNoUpgrade.crd.yaml | 12 ++++-- 38 files changed, 267 insertions(+), 131 deletions(-) diff --git a/config/v1/types_tlssecurityprofile.go b/config/v1/types_tlssecurityprofile.go index 2e9be97aeb4..8d295ca5341 100644 --- a/config/v1/types_tlssecurityprofile.go +++ b/config/v1/types_tlssecurityprofile.go @@ -15,8 +15,10 @@ type TLSSecurityProfile struct { // Note that not all platform components honor the ordering: Go-based components use Go's // internal preference order and treat this list as a filter of allowed groups rather than // an ordered preference. - // Note that X25519MLKEM768 is a post-quantum hybrid group that is not - // FIPS-approved and should be ignored by components running in FIPS mode. + // Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + // FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + // (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + // FIPS-approved and are ignored by components running in FIPS mode. // // The profiles are intent based, so they may change over time as new ciphers are // developed and existing ciphers are found to be insecure. Depending on @@ -168,8 +170,10 @@ const ( // There is a one-to-one mapping between these names and the group IDs defined // in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: // https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 -// Note that X25519MLKEM768 is a post-quantum hybrid group that is not -// FIPS-approved and should be ignored by components running in FIPS mode. +// Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are +// FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups +// (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not +// FIPS-approved and are ignored by components running in FIPS mode. // // +kubebuilder:validation:Enum=X25519;secp256r1;secp384r1;secp521r1;X25519MLKEM768;SecP256r1MLKEM768;SecP384r1MLKEM1024 type TLSGroup string @@ -274,8 +278,10 @@ const ( // NOTE: The caller needs to make sure to check that these constants are valid // for their binary. Not all entries map to values for all binaries. In the case // of ties, the kube-apiserver wins. Do not fail, just be sure to include only -// valid entries and everything will be ok. In particular, X25519MLKEM768 is -// not FIPS-approved and must be omitted by components running in FIPS mode. +// valid entries and everything will be ok. In particular, only the NIST P-curves +// (secp256r1, secp384r1, secp521r1) are FIPS-approved; X25519 and the ML-KEM +// post-quantum hybrid groups (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) +// are not FIPS-approved and must be omitted by components running in FIPS mode. var TLSProfiles = map[TLSProfileType]*TLSProfileSpec{ TLSProfileOldType: { Ciphers: []string{ diff --git a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml index b18ea746404..2c5b19ca1a3 100644 --- a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml +++ b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml @@ -600,8 +600,10 @@ spec: There is a one-to-one mapping between these names and the group IDs defined in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. enum: - X25519 - secp256r1 @@ -719,8 +721,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-Default.crd.yaml b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-Default.crd.yaml index ef855e38741..5fdb2bb9e58 100644 --- a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-Default.crd.yaml +++ b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-Default.crd.yaml @@ -366,8 +366,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml index b8700ff3f16..5afc7467ec6 100644 --- a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml +++ b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml @@ -600,8 +600,10 @@ spec: There is a one-to-one mapping between these names and the group IDs defined in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. enum: - X25519 - secp256r1 @@ -719,8 +721,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-OKD.crd.yaml b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-OKD.crd.yaml index 99c093b2176..9731e5b4bb9 100644 --- a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-OKD.crd.yaml +++ b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-OKD.crd.yaml @@ -366,8 +366,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml index 6728a62ef56..ce13280ce41 100644 --- a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml +++ b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml @@ -600,8 +600,10 @@ spec: There is a one-to-one mapping between these names and the group IDs defined in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. enum: - X25519 - secp256r1 @@ -719,8 +721,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/AAA_ungated.yaml b/config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/AAA_ungated.yaml index 2bdf5884339..556f726c433 100644 --- a/config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/AAA_ungated.yaml +++ b/config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/AAA_ungated.yaml @@ -366,8 +366,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/KMSEncryption.yaml b/config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/KMSEncryption.yaml index 4bbdc315e3e..5aa498efd65 100644 --- a/config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/KMSEncryption.yaml +++ b/config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/KMSEncryption.yaml @@ -643,8 +643,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/TLSAdherence.yaml b/config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/TLSAdherence.yaml index 1d77abba1dc..9ad4892c8d6 100644 --- a/config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/TLSAdherence.yaml +++ b/config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/TLSAdherence.yaml @@ -397,8 +397,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/TLSGroupPreferences.yaml b/config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/TLSGroupPreferences.yaml index e3b095c3aa7..67a20ac3983 100644 --- a/config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/TLSGroupPreferences.yaml +++ b/config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/TLSGroupPreferences.yaml @@ -282,8 +282,10 @@ spec: There is a one-to-one mapping between these names and the group IDs defined in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. enum: - X25519 - secp256r1 @@ -401,8 +403,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/config/v1/zz_generated.swagger_doc_generated.go b/config/v1/zz_generated.swagger_doc_generated.go index 1e9c65bf862..cf429b19ba9 100644 --- a/config/v1/zz_generated.swagger_doc_generated.go +++ b/config/v1/zz_generated.swagger_doc_generated.go @@ -3174,7 +3174,7 @@ func (TLSProfileSpec) SwaggerDoc() map[string]string { var map_TLSSecurityProfile = map[string]string{ "": "TLSSecurityProfile defines the schema for a TLS security profile. This object is used by operators to apply TLS security settings to operands.", - "type": "type is one of Old, Intermediate, Modern or Custom. Custom provides the ability to specify individual TLS security profile parameters.\n\nThe cipher and groups lists in these profiles are based on version 5.8 of the Mozilla Server Side TLS configuration guidelines. See: https://ssl-config.mozilla.org/guidelines/5.8.json\n\nThe groups are listed in suggested preference order, with the most preferred group first. Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. Note that X25519MLKEM768 is a post-quantum hybrid group that is not FIPS-approved and should be ignored by components running in FIPS mode.\n\nThe profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on precisely which ciphers are available to a process, the list may be reduced.", + "type": "type is one of Old, Intermediate, Modern or Custom. Custom provides the ability to specify individual TLS security profile parameters.\n\nThe cipher and groups lists in these profiles are based on version 5.8 of the Mozilla Server Side TLS configuration guidelines. See: https://ssl-config.mozilla.org/guidelines/5.8.json\n\nThe groups are listed in suggested preference order, with the most preferred group first. Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not FIPS-approved and are ignored by components running in FIPS mode.\n\nThe profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on precisely which ciphers are available to a process, the list may be reduced.", "old": "old is a TLS profile for use when services need to be accessed by very old clients or libraries and should be used only as a last resort.\n\nThe supported groups list includes by default the following groups in suggested preference order (ordering may not be honored by all implementations): X25519MLKEM768, X25519, secp256r1, secp384r1.\n\nThis profile is equivalent to a Custom profile specified as:\n minTLSVersion: VersionTLS10\n ciphers:\n - TLS_AES_128_GCM_SHA256\n - TLS_AES_256_GCM_SHA384\n - TLS_CHACHA20_POLY1305_SHA256\n - ECDHE-ECDSA-AES128-GCM-SHA256\n - ECDHE-RSA-AES128-GCM-SHA256\n - ECDHE-ECDSA-AES256-GCM-SHA384\n - ECDHE-RSA-AES256-GCM-SHA384\n - ECDHE-ECDSA-CHACHA20-POLY1305\n - ECDHE-RSA-CHACHA20-POLY1305\n - ECDHE-ECDSA-AES128-SHA256\n - ECDHE-RSA-AES128-SHA256\n - ECDHE-ECDSA-AES128-SHA\n - ECDHE-RSA-AES128-SHA\n - ECDHE-ECDSA-AES256-SHA384\n - ECDHE-RSA-AES256-SHA384\n - ECDHE-ECDSA-AES256-SHA\n - ECDHE-RSA-AES256-SHA\n - AES128-GCM-SHA256\n - AES256-GCM-SHA384\n - AES128-SHA256\n - AES256-SHA256\n - AES128-SHA\n - AES256-SHA\n - DES-CBC3-SHA", "intermediate": "intermediate is a TLS profile for use when you do not need compatibility with legacy clients and want to remain highly secure while being compatible with most clients currently in use.\n\nThe supported groups list includes by default the following groups in suggested preference order (ordering may not be honored by all implementations): X25519MLKEM768, X25519, secp256r1, secp384r1.\n\nThis profile is equivalent to a Custom profile specified as:\n minTLSVersion: VersionTLS12\n ciphers:\n - TLS_AES_128_GCM_SHA256\n - TLS_AES_256_GCM_SHA384\n - TLS_CHACHA20_POLY1305_SHA256\n - ECDHE-ECDSA-AES128-GCM-SHA256\n - ECDHE-RSA-AES128-GCM-SHA256\n - ECDHE-ECDSA-AES256-GCM-SHA384\n - ECDHE-RSA-AES256-GCM-SHA384\n - ECDHE-ECDSA-CHACHA20-POLY1305\n - ECDHE-RSA-CHACHA20-POLY1305", "modern": "modern is a TLS security profile for use with clients that support TLS 1.3 and do not need backward compatibility for older clients. The supported groups list includes by default the following groups in suggested preference order (ordering may not be honored by all implementations): X25519MLKEM768, X25519, secp256r1, secp384r1. This profile is equivalent to a Custom profile specified as:\n minTLSVersion: VersionTLS13\n ciphers:\n - TLS_AES_128_GCM_SHA256\n - TLS_AES_256_GCM_SHA384\n - TLS_CHACHA20_POLY1305_SHA256", diff --git a/machineconfiguration/v1/zz_generated.crd-manifests/0000_80_machine-config_01_kubeletconfigs-CustomNoUpgrade.crd.yaml b/machineconfiguration/v1/zz_generated.crd-manifests/0000_80_machine-config_01_kubeletconfigs-CustomNoUpgrade.crd.yaml index a3e3f4ba1d5..4305da605ad 100644 --- a/machineconfiguration/v1/zz_generated.crd-manifests/0000_80_machine-config_01_kubeletconfigs-CustomNoUpgrade.crd.yaml +++ b/machineconfiguration/v1/zz_generated.crd-manifests/0000_80_machine-config_01_kubeletconfigs-CustomNoUpgrade.crd.yaml @@ -186,8 +186,10 @@ spec: There is a one-to-one mapping between these names and the group IDs defined in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. enum: - X25519 - secp256r1 @@ -305,8 +307,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/machineconfiguration/v1/zz_generated.crd-manifests/0000_80_machine-config_01_kubeletconfigs-Default.crd.yaml b/machineconfiguration/v1/zz_generated.crd-manifests/0000_80_machine-config_01_kubeletconfigs-Default.crd.yaml index a28b15e4f22..87528646106 100644 --- a/machineconfiguration/v1/zz_generated.crd-manifests/0000_80_machine-config_01_kubeletconfigs-Default.crd.yaml +++ b/machineconfiguration/v1/zz_generated.crd-manifests/0000_80_machine-config_01_kubeletconfigs-Default.crd.yaml @@ -265,8 +265,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/machineconfiguration/v1/zz_generated.crd-manifests/0000_80_machine-config_01_kubeletconfigs-DevPreviewNoUpgrade.crd.yaml b/machineconfiguration/v1/zz_generated.crd-manifests/0000_80_machine-config_01_kubeletconfigs-DevPreviewNoUpgrade.crd.yaml index 5f76118f194..db8fbda4d2f 100644 --- a/machineconfiguration/v1/zz_generated.crd-manifests/0000_80_machine-config_01_kubeletconfigs-DevPreviewNoUpgrade.crd.yaml +++ b/machineconfiguration/v1/zz_generated.crd-manifests/0000_80_machine-config_01_kubeletconfigs-DevPreviewNoUpgrade.crd.yaml @@ -186,8 +186,10 @@ spec: There is a one-to-one mapping between these names and the group IDs defined in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. enum: - X25519 - secp256r1 @@ -305,8 +307,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/machineconfiguration/v1/zz_generated.crd-manifests/0000_80_machine-config_01_kubeletconfigs-OKD.crd.yaml b/machineconfiguration/v1/zz_generated.crd-manifests/0000_80_machine-config_01_kubeletconfigs-OKD.crd.yaml index f15a54fc3ad..b0ecbbe1330 100644 --- a/machineconfiguration/v1/zz_generated.crd-manifests/0000_80_machine-config_01_kubeletconfigs-OKD.crd.yaml +++ b/machineconfiguration/v1/zz_generated.crd-manifests/0000_80_machine-config_01_kubeletconfigs-OKD.crd.yaml @@ -265,8 +265,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/machineconfiguration/v1/zz_generated.crd-manifests/0000_80_machine-config_01_kubeletconfigs-TechPreviewNoUpgrade.crd.yaml b/machineconfiguration/v1/zz_generated.crd-manifests/0000_80_machine-config_01_kubeletconfigs-TechPreviewNoUpgrade.crd.yaml index af17f6f69b1..ed34e85021a 100644 --- a/machineconfiguration/v1/zz_generated.crd-manifests/0000_80_machine-config_01_kubeletconfigs-TechPreviewNoUpgrade.crd.yaml +++ b/machineconfiguration/v1/zz_generated.crd-manifests/0000_80_machine-config_01_kubeletconfigs-TechPreviewNoUpgrade.crd.yaml @@ -186,8 +186,10 @@ spec: There is a one-to-one mapping between these names and the group IDs defined in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. enum: - X25519 - secp256r1 @@ -305,8 +307,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/machineconfiguration/v1/zz_generated.featuregated-crd-manifests/kubeletconfigs.machineconfiguration.openshift.io/AAA_ungated.yaml b/machineconfiguration/v1/zz_generated.featuregated-crd-manifests/kubeletconfigs.machineconfiguration.openshift.io/AAA_ungated.yaml index 66d909a97b7..43671e8e75d 100644 --- a/machineconfiguration/v1/zz_generated.featuregated-crd-manifests/kubeletconfigs.machineconfiguration.openshift.io/AAA_ungated.yaml +++ b/machineconfiguration/v1/zz_generated.featuregated-crd-manifests/kubeletconfigs.machineconfiguration.openshift.io/AAA_ungated.yaml @@ -265,8 +265,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/machineconfiguration/v1/zz_generated.featuregated-crd-manifests/kubeletconfigs.machineconfiguration.openshift.io/TLSGroupPreferences.yaml b/machineconfiguration/v1/zz_generated.featuregated-crd-manifests/kubeletconfigs.machineconfiguration.openshift.io/TLSGroupPreferences.yaml index 69807f8ea31..c560582c958 100644 --- a/machineconfiguration/v1/zz_generated.featuregated-crd-manifests/kubeletconfigs.machineconfiguration.openshift.io/TLSGroupPreferences.yaml +++ b/machineconfiguration/v1/zz_generated.featuregated-crd-manifests/kubeletconfigs.machineconfiguration.openshift.io/TLSGroupPreferences.yaml @@ -186,8 +186,10 @@ spec: There is a one-to-one mapping between these names and the group IDs defined in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. enum: - X25519 - secp256r1 @@ -305,8 +307,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/openapi/generated_openapi/zz_generated.openapi.go b/openapi/generated_openapi/zz_generated.openapi.go index 372ab5b69ac..4a0c6af3bb7 100644 --- a/openapi/generated_openapi/zz_generated.openapi.go +++ b/openapi/generated_openapi/zz_generated.openapi.go @@ -21392,7 +21392,7 @@ func schema_openshift_api_config_v1_TLSSecurityProfile(ref common.ReferenceCallb Properties: map[string]spec.Schema{ "type": { SchemaProps: spec.SchemaProps{ - Description: "type is one of Old, Intermediate, Modern or Custom. Custom provides the ability to specify individual TLS security profile parameters.\n\nThe cipher and groups lists in these profiles are based on version 5.8 of the Mozilla Server Side TLS configuration guidelines. See: https://ssl-config.mozilla.org/guidelines/5.8.json\n\nThe groups are listed in suggested preference order, with the most preferred group first. Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. Note that X25519MLKEM768 is a post-quantum hybrid group that is not FIPS-approved and should be ignored by components running in FIPS mode.\n\nThe profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on precisely which ciphers are available to a process, the list may be reduced.", + Description: "type is one of Old, Intermediate, Modern or Custom. Custom provides the ability to specify individual TLS security profile parameters.\n\nThe cipher and groups lists in these profiles are based on version 5.8 of the Mozilla Server Side TLS configuration guidelines. See: https://ssl-config.mozilla.org/guidelines/5.8.json\n\nThe groups are listed in suggested preference order, with the most preferred group first. Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not FIPS-approved and are ignored by components running in FIPS mode.\n\nThe profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on precisely which ciphers are available to a process, the list may be reduced.", Default: "", Type: []string{"string"}, Format: "", diff --git a/openapi/openapi.json b/openapi/openapi.json index 3c26ba31946..7712f62d919 100644 --- a/openapi/openapi.json +++ b/openapi/openapi.json @@ -17919,6 +17919,15 @@ }, "x-kubernetes-list-type": "atomic" }, + "groups": { + "description": "groups is an optional, ordered field used to specify the supported groups (formerly known as elliptic curves) that are used during the TLS handshake. The order of the groups represents a suggested preference, with the most preferred group first. Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. Operators may remove entries their operands do not support.\n\nWhen omitted, this means no opinion and the platform is left to choose reasonable defaults which are subject to change over time and may be different per platform component depending on the underlying TLS libraries they use. If specified, the list must contain at least one and at most 7 groups, and each group must be unique.\n\nFor example, to use X25519 and secp256r1 (yaml):\n\n groups:\n - X25519\n - secp256r1", + "type": "array", + "items": { + "type": "string", + "default": "" + }, + "x-kubernetes-list-type": "set" + }, "minTLSVersion": { "description": "minTLSVersion is used to specify the minimal version of the TLS protocol that is negotiated during the TLS handshake. For example, to use TLS versions 1.1, 1.2 and 1.3 (yaml):\n\n minTLSVersion: VersionTLS11", "type": "string", @@ -23075,6 +23084,15 @@ }, "x-kubernetes-list-type": "atomic" }, + "groups": { + "description": "groups is an optional, ordered field used to specify the supported groups (formerly known as elliptic curves) that are used during the TLS handshake. The order of the groups represents a suggested preference, with the most preferred group first. Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. Operators may remove entries their operands do not support.\n\nWhen omitted, this means no opinion and the platform is left to choose reasonable defaults which are subject to change over time and may be different per platform component depending on the underlying TLS libraries they use. If specified, the list must contain at least one and at most 7 groups, and each group must be unique.\n\nFor example, to use X25519 and secp256r1 (yaml):\n\n groups:\n - X25519\n - secp256r1", + "type": "array", + "items": { + "type": "string", + "default": "" + }, + "x-kubernetes-list-type": "set" + }, "minTLSVersion": { "description": "minTLSVersion is used to specify the minimal version of the TLS protocol that is negotiated during the TLS handshake. For example, to use TLS versions 1.1, 1.2 and 1.3 (yaml):\n\n minTLSVersion: VersionTLS11", "type": "string", @@ -23087,23 +23105,23 @@ "type": "object", "properties": { "custom": { - "description": "custom is a user-defined TLS security profile. Be extremely careful using a custom profile as invalid configurations can be catastrophic. An example custom profile looks like this:\n\n minTLSVersion: VersionTLS11\n ciphers:\n - ECDHE-ECDSA-CHACHA20-POLY1305\n - ECDHE-RSA-CHACHA20-POLY1305\n - ECDHE-RSA-AES128-GCM-SHA256\n - ECDHE-ECDSA-AES128-GCM-SHA256", + "description": "custom is a user-defined TLS security profile. Be extremely careful using a custom profile as invalid configurations can be catastrophic.\n\nThe supported groups list for this profile is empty by default.\n\nAn example custom profile looks like this:\n\n minTLSVersion: VersionTLS11\n ciphers:\n - ECDHE-ECDSA-CHACHA20-POLY1305\n - ECDHE-RSA-CHACHA20-POLY1305\n - ECDHE-RSA-AES128-GCM-SHA256\n - ECDHE-ECDSA-AES128-GCM-SHA256", "$ref": "#/definitions/com.github.openshift.api.config.v1.CustomTLSProfile" }, "intermediate": { - "description": "intermediate is a TLS profile for use when you do not need compatibility with legacy clients and want to remain highly secure while being compatible with most clients currently in use.\n\nThis profile is equivalent to a Custom profile specified as:\n minTLSVersion: VersionTLS12\n ciphers:\n - TLS_AES_128_GCM_SHA256\n - TLS_AES_256_GCM_SHA384\n - TLS_CHACHA20_POLY1305_SHA256\n - ECDHE-ECDSA-AES128-GCM-SHA256\n - ECDHE-RSA-AES128-GCM-SHA256\n - ECDHE-ECDSA-AES256-GCM-SHA384\n - ECDHE-RSA-AES256-GCM-SHA384\n - ECDHE-ECDSA-CHACHA20-POLY1305\n - ECDHE-RSA-CHACHA20-POLY1305", + "description": "intermediate is a TLS profile for use when you do not need compatibility with legacy clients and want to remain highly secure while being compatible with most clients currently in use.\n\nThe supported groups list includes by default the following groups in suggested preference order (ordering may not be honored by all implementations): X25519MLKEM768, X25519, secp256r1, secp384r1.\n\nThis profile is equivalent to a Custom profile specified as:\n minTLSVersion: VersionTLS12\n ciphers:\n - TLS_AES_128_GCM_SHA256\n - TLS_AES_256_GCM_SHA384\n - TLS_CHACHA20_POLY1305_SHA256\n - ECDHE-ECDSA-AES128-GCM-SHA256\n - ECDHE-RSA-AES128-GCM-SHA256\n - ECDHE-ECDSA-AES256-GCM-SHA384\n - ECDHE-RSA-AES256-GCM-SHA384\n - ECDHE-ECDSA-CHACHA20-POLY1305\n - ECDHE-RSA-CHACHA20-POLY1305", "$ref": "#/definitions/com.github.openshift.api.config.v1.IntermediateTLSProfile" }, "modern": { - "description": "modern is a TLS security profile for use with clients that support TLS 1.3 and do not need backward compatibility for older clients.\n\nThis profile is equivalent to a Custom profile specified as:\n minTLSVersion: VersionTLS13\n ciphers:\n - TLS_AES_128_GCM_SHA256\n - TLS_AES_256_GCM_SHA384\n - TLS_CHACHA20_POLY1305_SHA256", + "description": "modern is a TLS security profile for use with clients that support TLS 1.3 and do not need backward compatibility for older clients. The supported groups list includes by default the following groups in suggested preference order (ordering may not be honored by all implementations): X25519MLKEM768, X25519, secp256r1, secp384r1. This profile is equivalent to a Custom profile specified as:\n minTLSVersion: VersionTLS13\n ciphers:\n - TLS_AES_128_GCM_SHA256\n - TLS_AES_256_GCM_SHA384\n - TLS_CHACHA20_POLY1305_SHA256", "$ref": "#/definitions/com.github.openshift.api.config.v1.ModernTLSProfile" }, "old": { - "description": "old is a TLS profile for use when services need to be accessed by very old clients or libraries and should be used only as a last resort.\n\nThis profile is equivalent to a Custom profile specified as:\n minTLSVersion: VersionTLS10\n ciphers:\n - TLS_AES_128_GCM_SHA256\n - TLS_AES_256_GCM_SHA384\n - TLS_CHACHA20_POLY1305_SHA256\n - ECDHE-ECDSA-AES128-GCM-SHA256\n - ECDHE-RSA-AES128-GCM-SHA256\n - ECDHE-ECDSA-AES256-GCM-SHA384\n - ECDHE-RSA-AES256-GCM-SHA384\n - ECDHE-ECDSA-CHACHA20-POLY1305\n - ECDHE-RSA-CHACHA20-POLY1305\n - ECDHE-ECDSA-AES128-SHA256\n - ECDHE-RSA-AES128-SHA256\n - ECDHE-ECDSA-AES128-SHA\n - ECDHE-RSA-AES128-SHA\n - ECDHE-ECDSA-AES256-SHA\n - ECDHE-RSA-AES256-SHA\n - AES128-GCM-SHA256\n - AES256-GCM-SHA384\n - AES128-SHA256\n - AES128-SHA\n - AES256-SHA\n - DES-CBC3-SHA", + "description": "old is a TLS profile for use when services need to be accessed by very old clients or libraries and should be used only as a last resort.\n\nThe supported groups list includes by default the following groups in suggested preference order (ordering may not be honored by all implementations): X25519MLKEM768, X25519, secp256r1, secp384r1.\n\nThis profile is equivalent to a Custom profile specified as:\n minTLSVersion: VersionTLS10\n ciphers:\n - TLS_AES_128_GCM_SHA256\n - TLS_AES_256_GCM_SHA384\n - TLS_CHACHA20_POLY1305_SHA256\n - ECDHE-ECDSA-AES128-GCM-SHA256\n - ECDHE-RSA-AES128-GCM-SHA256\n - ECDHE-ECDSA-AES256-GCM-SHA384\n - ECDHE-RSA-AES256-GCM-SHA384\n - ECDHE-ECDSA-CHACHA20-POLY1305\n - ECDHE-RSA-CHACHA20-POLY1305\n - ECDHE-ECDSA-AES128-SHA256\n - ECDHE-RSA-AES128-SHA256\n - ECDHE-ECDSA-AES128-SHA\n - ECDHE-RSA-AES128-SHA\n - ECDHE-ECDSA-AES256-SHA384\n - ECDHE-RSA-AES256-SHA384\n - ECDHE-ECDSA-AES256-SHA\n - ECDHE-RSA-AES256-SHA\n - AES128-GCM-SHA256\n - AES256-GCM-SHA384\n - AES128-SHA256\n - AES256-SHA256\n - AES128-SHA\n - AES256-SHA\n - DES-CBC3-SHA", "$ref": "#/definitions/com.github.openshift.api.config.v1.OldTLSProfile" }, "type": { - "description": "type is one of Old, Intermediate, Modern or Custom. Custom provides the ability to specify individual TLS security profile parameters.\n\nThe profiles are based on version 5.7 of the Mozilla Server Side TLS configuration guidelines. The cipher lists consist of the configuration's \"ciphersuites\" followed by the Go-specific \"ciphers\" from the guidelines. See: https://ssl-config.mozilla.org/guidelines/5.7.json\n\nThe profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on precisely which ciphers are available to a process, the list may be reduced.", + "description": "type is one of Old, Intermediate, Modern or Custom. Custom provides the ability to specify individual TLS security profile parameters.\n\nThe cipher and groups lists in these profiles are based on version 5.8 of the Mozilla Server Side TLS configuration guidelines. See: https://ssl-config.mozilla.org/guidelines/5.8.json\n\nThe groups are listed in suggested preference order, with the most preferred group first. Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not FIPS-approved and are ignored by components running in FIPS mode.\n\nThe profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on precisely which ciphers are available to a process, the list may be reduced.", "type": "string", "default": "" } @@ -24850,7 +24868,7 @@ "type": "object", "properties": { "additionalResourceLabels": { - "description": "additionalResourceLabels defines additional Kubernetes resource labels to expose as metrics in kube-state-metrics, in addition to the default set. Currently, only \"Jobs\" and \"CronJobs\" resources are supported due to cardinality concerns. Each entry specifies a resource name and a list of Kubernetes label names to expose. Use \"*\" in the labels list to expose all labels for a given resource. additionalResourceLabels is optional. When omitted, only the default set of resource labels is exposed. Maximum length for this list is 2. Minimum length for this list is 1. Each resource name must be unique within this list.", + "description": "additionalResourceLabels defines additional Kubernetes resource labels to expose as metrics in kube-state-metrics. Currently, only \"Job\" and \"CronJob\" resources are supported due to cardinality concerns. Each entry specifies a resource name and a list of Kubernetes label names to expose. Use \"*\" in the labels list to expose all labels for a given resource. additionalResourceLabels is optional. When omitted, no additional Kubernetes object labels are exposed as metrics by kube-state-metrics beyond its built-in metric labels (e.g. namespace, job_name). Use this field to opt in to exposing specific Kubernetes labels as metric labels for the supported resource types. Minimum length for this list is 1. Maximum length for this list is 2. Each resource name must be unique within this list.", "type": "array", "items": { "default": {}, @@ -24870,7 +24888,7 @@ } }, "resources": { - "description": "resources defines the compute resource requests and limits for the kube-state-metrics container. This includes CPU, memory and HugePages constraints to help control scheduling and resource usage. When not specified, defaults are used by the platform. Requests cannot exceed limits. This field is optional. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ This is a simplified API that maps to Kubernetes ResourceRequirements. The current default values are:\n resources:\n - name: cpu\n request: 4m\n - name: memory\n request: 40Mi\nMaximum length for this list is 5. Minimum length for this list is 1. Each resource name must be unique within this list.", + "description": "resources defines the compute resource requests and limits for the kube-state-metrics container. This includes CPU, memory and HugePages constraints to help control scheduling and resource usage. When not specified, defaults are used by the platform. Requests cannot exceed limits. This field is optional. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ This is a simplified API that maps to Kubernetes ResourceRequirements. The current default values are:\n resources:\n - name: cpu\n request: 4m\n limit: null\n - name: memory\n request: 40Mi\n limit: null\nMaximum length for this list is 5. Minimum length for this list is 1. Each resource name must be unique within this list.", "type": "array", "items": { "default": {}, @@ -24882,7 +24900,7 @@ "x-kubernetes-list-type": "map" }, "tolerations": { - "description": "tolerations defines tolerations for the pods. tolerations is optional.\n\nWhen omitted, this means the user has no opinion and the platform is left to choose reasonable defaults. These defaults are subject to change over time. Defaults are empty/unset. When specified, tolerations must contain at least 1 entry and must not contain more than 10 entries.", + "description": "tolerations defines tolerations for the pods. tolerations is optional.\n\nWhen omitted, no tolerations are applied. This default is subject to change over time. When specified, tolerations must contain at least 1 entry and must not contain more than 10 entries. Each toleration's operator, when specified, must be either \"Exists\" or \"Equal\". Each toleration's effect, when specified, must be one of \"NoSchedule\", \"PreferNoSchedule\", or \"NoExecute\". An empty or unset effect means match all effects.", "type": "array", "items": { "default": {}, @@ -24891,7 +24909,7 @@ "x-kubernetes-list-type": "atomic" }, "topologySpreadConstraints": { - "description": "topologySpreadConstraints defines rules for how kube-state-metrics Pods should be distributed across topology domains such as zones, nodes, or other user-defined labels. topologySpreadConstraints is optional. This helps improve high availability and resource efficiency by avoiding placing too many replicas in the same failure domain.\n\nWhen omitted, this means no opinion and the platform is left to choose a default, which is subject to change over time. This field maps directly to the `topologySpreadConstraints` field in the Pod spec. Defaults are empty/unset. When specified, topologySpreadConstraints must contain at least 1 entry and must not contain more than 10 entries. Entries must have unique topologyKey and whenUnsatisfiable pairs.", + "description": "topologySpreadConstraints defines rules for how kube-state-metrics Pods should be distributed across topology domains such as zones, nodes, or other user-defined labels. topologySpreadConstraints is optional. This helps improve high availability and resource efficiency by avoiding placing too many replicas in the same failure domain.\n\nThis field maps directly to the `topologySpreadConstraints` field in the Pod spec. When omitted, no topology spread constraints are applied. This default is subject to change over time. When specified, topologySpreadConstraints must contain at least 1 entry and must not contain more than 10 entries. Entries must have unique topologyKey and whenUnsatisfiable pairs. Each entry's whenUnsatisfiable must be either \"DoNotSchedule\" or \"ScheduleAnyway\". Each entry's maxSkew must be at least 1. When minDomains is specified, it must be at least 1 and whenUnsatisfiable must be \"DoNotSchedule\".", "type": "array", "items": { "default": {}, @@ -24914,7 +24932,7 @@ ], "properties": { "labels": { - "description": "labels is the list of Kubernetes label names to expose as metrics for this resource. Use \"*\" to expose all labels for the specified resource. This field is required. Each label name must be unique within this list. Minimum length for this list is 1. Maximum length for this list is 50.", + "description": "labels is the list of Kubernetes label names to expose as metrics for this resource. Use \"*\" to expose all labels for the specified resource. When \"*\" is specified, it must be the only entry in the list; mixing \"*\" with specific label names is not allowed. This field is required. Each label name must be unique within this list. Minimum length for this list is 1. Maximum length for this list is 50.", "type": "array", "items": { "type": "string", @@ -24923,7 +24941,7 @@ "x-kubernetes-list-type": "set" }, "resource": { - "description": "resource is the Kubernetes resource name whose labels should be exposed as metrics. Currently, only \"Jobs\" and \"CronJobs\" are supported due to cardinality concerns. Valid values are \"Jobs\" and \"CronJobs\". This field is required.", + "description": "resource is the Kubernetes resource name whose labels should be exposed as metrics. Currently, only \"Job\" and \"CronJob\" are supported due to cardinality concerns. Valid values are \"Job\" and \"CronJob\". This field is required.", "type": "string" } } diff --git a/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-CustomNoUpgrade.crd.yaml b/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-CustomNoUpgrade.crd.yaml index bc5f0147d9a..cae788f3206 100644 --- a/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-CustomNoUpgrade.crd.yaml +++ b/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-CustomNoUpgrade.crd.yaml @@ -2047,8 +2047,10 @@ spec: There is a one-to-one mapping between these names and the group IDs defined in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. enum: - X25519 - secp256r1 @@ -2166,8 +2168,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on @@ -3373,8 +3377,10 @@ spec: There is a one-to-one mapping between these names and the group IDs defined in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. enum: - X25519 - secp256r1 diff --git a/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-Default.crd.yaml b/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-Default.crd.yaml index 914cfb48e04..1155720ce86 100644 --- a/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-Default.crd.yaml +++ b/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-Default.crd.yaml @@ -2126,8 +2126,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-DevPreviewNoUpgrade.crd.yaml b/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-DevPreviewNoUpgrade.crd.yaml index 25e3ed651a8..52d87bc79ff 100644 --- a/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-DevPreviewNoUpgrade.crd.yaml +++ b/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-DevPreviewNoUpgrade.crd.yaml @@ -2047,8 +2047,10 @@ spec: There is a one-to-one mapping between these names and the group IDs defined in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. enum: - X25519 - secp256r1 @@ -2166,8 +2168,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on @@ -3373,8 +3377,10 @@ spec: There is a one-to-one mapping between these names and the group IDs defined in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. enum: - X25519 - secp256r1 diff --git a/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-OKD.crd.yaml b/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-OKD.crd.yaml index ec1366e6c60..5083e8bd6a7 100644 --- a/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-OKD.crd.yaml +++ b/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-OKD.crd.yaml @@ -2126,8 +2126,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-TechPreviewNoUpgrade.crd.yaml b/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-TechPreviewNoUpgrade.crd.yaml index 8b8156f5375..5e6e7774e76 100644 --- a/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-TechPreviewNoUpgrade.crd.yaml +++ b/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-TechPreviewNoUpgrade.crd.yaml @@ -2047,8 +2047,10 @@ spec: There is a one-to-one mapping between these names and the group IDs defined in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. enum: - X25519 - secp256r1 @@ -2166,8 +2168,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on @@ -3373,8 +3377,10 @@ spec: There is a one-to-one mapping between these names and the group IDs defined in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. enum: - X25519 - secp256r1 diff --git a/operator/v1/zz_generated.featuregated-crd-manifests/ingresscontrollers.operator.openshift.io/AAA_ungated.yaml b/operator/v1/zz_generated.featuregated-crd-manifests/ingresscontrollers.operator.openshift.io/AAA_ungated.yaml index fcfa0be56cc..5aca30d0314 100644 --- a/operator/v1/zz_generated.featuregated-crd-manifests/ingresscontrollers.operator.openshift.io/AAA_ungated.yaml +++ b/operator/v1/zz_generated.featuregated-crd-manifests/ingresscontrollers.operator.openshift.io/AAA_ungated.yaml @@ -2119,8 +2119,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/operator/v1/zz_generated.featuregated-crd-manifests/ingresscontrollers.operator.openshift.io/IngressControllerDynamicConfigurationManager.yaml b/operator/v1/zz_generated.featuregated-crd-manifests/ingresscontrollers.operator.openshift.io/IngressControllerDynamicConfigurationManager.yaml index fafa086c7df..2f86aebd391 100644 --- a/operator/v1/zz_generated.featuregated-crd-manifests/ingresscontrollers.operator.openshift.io/IngressControllerDynamicConfigurationManager.yaml +++ b/operator/v1/zz_generated.featuregated-crd-manifests/ingresscontrollers.operator.openshift.io/IngressControllerDynamicConfigurationManager.yaml @@ -2119,8 +2119,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/operator/v1/zz_generated.featuregated-crd-manifests/ingresscontrollers.operator.openshift.io/TLSGroupPreferences.yaml b/operator/v1/zz_generated.featuregated-crd-manifests/ingresscontrollers.operator.openshift.io/TLSGroupPreferences.yaml index 073048e5ee4..8138a71eb9c 100644 --- a/operator/v1/zz_generated.featuregated-crd-manifests/ingresscontrollers.operator.openshift.io/TLSGroupPreferences.yaml +++ b/operator/v1/zz_generated.featuregated-crd-manifests/ingresscontrollers.operator.openshift.io/TLSGroupPreferences.yaml @@ -2040,8 +2040,10 @@ spec: There is a one-to-one mapping between these names and the group IDs defined in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. enum: - X25519 - secp256r1 @@ -2159,8 +2161,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on @@ -3324,8 +3328,10 @@ spec: There is a one-to-one mapping between these names and the group IDs defined in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. enum: - X25519 - secp256r1 diff --git a/payload-manifests/crds/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml b/payload-manifests/crds/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml index b18ea746404..2c5b19ca1a3 100644 --- a/payload-manifests/crds/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml +++ b/payload-manifests/crds/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml @@ -600,8 +600,10 @@ spec: There is a one-to-one mapping between these names and the group IDs defined in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. enum: - X25519 - secp256r1 @@ -719,8 +721,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/payload-manifests/crds/0000_10_config-operator_01_apiservers-Default.crd.yaml b/payload-manifests/crds/0000_10_config-operator_01_apiservers-Default.crd.yaml index ef855e38741..5fdb2bb9e58 100644 --- a/payload-manifests/crds/0000_10_config-operator_01_apiservers-Default.crd.yaml +++ b/payload-manifests/crds/0000_10_config-operator_01_apiservers-Default.crd.yaml @@ -366,8 +366,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/payload-manifests/crds/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml b/payload-manifests/crds/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml index b8700ff3f16..5afc7467ec6 100644 --- a/payload-manifests/crds/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml +++ b/payload-manifests/crds/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml @@ -600,8 +600,10 @@ spec: There is a one-to-one mapping between these names and the group IDs defined in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. enum: - X25519 - secp256r1 @@ -719,8 +721,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/payload-manifests/crds/0000_10_config-operator_01_apiservers-OKD.crd.yaml b/payload-manifests/crds/0000_10_config-operator_01_apiservers-OKD.crd.yaml index 99c093b2176..9731e5b4bb9 100644 --- a/payload-manifests/crds/0000_10_config-operator_01_apiservers-OKD.crd.yaml +++ b/payload-manifests/crds/0000_10_config-operator_01_apiservers-OKD.crd.yaml @@ -366,8 +366,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/payload-manifests/crds/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml b/payload-manifests/crds/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml index 6728a62ef56..ce13280ce41 100644 --- a/payload-manifests/crds/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml +++ b/payload-manifests/crds/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml @@ -600,8 +600,10 @@ spec: There is a one-to-one mapping between these names and the group IDs defined in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. enum: - X25519 - secp256r1 @@ -719,8 +721,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/payload-manifests/crds/0000_80_machine-config_01_kubeletconfigs-CustomNoUpgrade.crd.yaml b/payload-manifests/crds/0000_80_machine-config_01_kubeletconfigs-CustomNoUpgrade.crd.yaml index a3e3f4ba1d5..4305da605ad 100644 --- a/payload-manifests/crds/0000_80_machine-config_01_kubeletconfigs-CustomNoUpgrade.crd.yaml +++ b/payload-manifests/crds/0000_80_machine-config_01_kubeletconfigs-CustomNoUpgrade.crd.yaml @@ -186,8 +186,10 @@ spec: There is a one-to-one mapping between these names and the group IDs defined in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. enum: - X25519 - secp256r1 @@ -305,8 +307,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/payload-manifests/crds/0000_80_machine-config_01_kubeletconfigs-Default.crd.yaml b/payload-manifests/crds/0000_80_machine-config_01_kubeletconfigs-Default.crd.yaml index a28b15e4f22..87528646106 100644 --- a/payload-manifests/crds/0000_80_machine-config_01_kubeletconfigs-Default.crd.yaml +++ b/payload-manifests/crds/0000_80_machine-config_01_kubeletconfigs-Default.crd.yaml @@ -265,8 +265,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/payload-manifests/crds/0000_80_machine-config_01_kubeletconfigs-DevPreviewNoUpgrade.crd.yaml b/payload-manifests/crds/0000_80_machine-config_01_kubeletconfigs-DevPreviewNoUpgrade.crd.yaml index 5f76118f194..db8fbda4d2f 100644 --- a/payload-manifests/crds/0000_80_machine-config_01_kubeletconfigs-DevPreviewNoUpgrade.crd.yaml +++ b/payload-manifests/crds/0000_80_machine-config_01_kubeletconfigs-DevPreviewNoUpgrade.crd.yaml @@ -186,8 +186,10 @@ spec: There is a one-to-one mapping between these names and the group IDs defined in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. enum: - X25519 - secp256r1 @@ -305,8 +307,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/payload-manifests/crds/0000_80_machine-config_01_kubeletconfigs-OKD.crd.yaml b/payload-manifests/crds/0000_80_machine-config_01_kubeletconfigs-OKD.crd.yaml index f15a54fc3ad..b0ecbbe1330 100644 --- a/payload-manifests/crds/0000_80_machine-config_01_kubeletconfigs-OKD.crd.yaml +++ b/payload-manifests/crds/0000_80_machine-config_01_kubeletconfigs-OKD.crd.yaml @@ -265,8 +265,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on diff --git a/payload-manifests/crds/0000_80_machine-config_01_kubeletconfigs-TechPreviewNoUpgrade.crd.yaml b/payload-manifests/crds/0000_80_machine-config_01_kubeletconfigs-TechPreviewNoUpgrade.crd.yaml index af17f6f69b1..ed34e85021a 100644 --- a/payload-manifests/crds/0000_80_machine-config_01_kubeletconfigs-TechPreviewNoUpgrade.crd.yaml +++ b/payload-manifests/crds/0000_80_machine-config_01_kubeletconfigs-TechPreviewNoUpgrade.crd.yaml @@ -186,8 +186,10 @@ spec: There is a one-to-one mapping between these names and the group IDs defined in Go's crypto/tls package based on IANA's "TLS Supported Groups" registry: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. enum: - X25519 - secp256r1 @@ -305,8 +307,10 @@ spec: Note that not all platform components honor the ordering: Go-based components use Go's internal preference order and treat this list as a filter of allowed groups rather than an ordered preference. - Note that X25519MLKEM768 is a post-quantum hybrid group that is not - FIPS-approved and should be ignored by components running in FIPS mode. + Note that only the NIST P-curves (secp256r1, secp384r1, secp521r1) are + FIPS-approved. X25519 and the ML-KEM post-quantum hybrid groups + (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024) are not + FIPS-approved and are ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on