Skip to content

OCPSTRAT-3113: Set DEFAULT:PQ crypto-policies to RHEL9 base image #230

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
sdodson wants to merge 1 commit into
base: master
Choose a base branch
from
+11 −0
Open

OCPSTRAT-3113: Set DEFAULT:PQ crypto-policies to RHEL9 base image #230

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions base/Dockerfile.rhel9
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,16 @@
# Builder stage: Configure crypto-policies with post-quantum support
FROM registry.ci.openshift.org/ocp/4.22:base-rhel9 AS builder
Copy link
Copy Markdown
Contributor

@candita candita Apr 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Will this affect 4.22 images? I thought this was planned for 5.0?

Copy link
Copy Markdown
Member Author

@sdodson sdodson Apr 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No, that will only affect the inputs to the build, not the output. ART just hasn't done the image synchronization stuff that they normally do, I assume they'll update this in the near future. Since 4.22 and 5.0 both use UBI9 as the base this shouldn't affect any outcomes.


RUN dnf install -y --nodocs crypto-policies-scripts && \
update-crypto-policies --set DEFAULT:PQ && \
Copy link
Copy Markdown

@bentito bentito Apr 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So for RHEL 9 crypto-policies, the DEFAULT:PQ policy and FIPS mode are currently mutually exclusive, right? So are binaries built with this image shunted away from FIPS enabled cluster usage somehow?

Copy link
Copy Markdown
Member Author

@sdodson sdodson Apr 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't believe they are mutually exclusive in implementation only in audit policy.

Copy link
Copy Markdown

@bentito bentito Apr 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Okay so reading here: https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/security_hardening/using-the-system-wide-cryptographic-policies_security-hardening#post_quantum_cryptography

I think I understand that PQ is a subpolicy and in FIPS cluster, we'd likely see double (hybrid) encryption where the PQ crypto is wrapped by the compliant crypto, for now.

dnf clean all && rm -rf /var/cache/*

# Final stage: Base RHEL9 image with PQ crypto-policies
Copy link
Copy Markdown

@bentito bentito Apr 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not quite as good as building in CI, but I built locally, router with the PQ policy and it didn't die on start:

podman run --platform linux/amd64 --rm --entrypoint /usr/sbin/haproxy localhost/router:test-pq -c -f /var/lib/haproxy/conf/haproxy.config                               │
                                                                                                                                                                                  
Configuration file has no error but will not start (no listener) => exit(2)

I'll check coredns and CIO, CDO too

Copy link
Copy Markdown

@bentito bentito Apr 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I was running CIO's e2e on a dev cluster with the PQ build router, I saw:

=== NAME  TestAll/parallel/TestTLSSecurityProfile
    operator_test.go:1916: ingresscontroller status has unexpected security profile spec.
        expected:
        ciphers:
        - ECDHE-ECDSA-AES128-GCM-SHA256
        - ECDHE-ECDSA-AES256-GCM-SHA384
        - ECDHE-ECDSA-CHACHA20-POLY1305
        - ECDHE-RSA-AES128-GCM-SHA256
        - ECDHE-RSA-AES256-GCM-SHA384
        - ECDHE-RSA-CHACHA20-POLY1305
        - TLS_AES_128_GCM_SHA256
        - TLS_AES_256_GCM_SHA384
        - TLS_CHACHA20_POLY1305_SHA256
        mintlsversion: VersionTLS12

        got:
        ciphers:
        - DHE-RSA-AES128-GCM-SHA256
        - DHE-RSA-AES256-GCM-SHA384
        - ECDHE-ECDSA-AES128-GCM-SHA256
        - ECDHE-ECDSA-AES256-GCM-SHA384
        - ECDHE-ECDSA-CHACHA20-POLY1305
        - ECDHE-RSA-AES128-GCM-SHA256
        - ECDHE-RSA-AES256-GCM-SHA384
        - ECDHE-RSA-CHACHA20-POLY1305
        - TLS_AES_128_GCM_SHA256
        - TLS_AES_256_GCM_SHA384
        - TLS_CHACHA20_POLY1305_SHA256
        mintlsversion: VersionTLS12

so we have at least one e2e test to fix with this...

Copy link
Copy Markdown

@bentito bentito Apr 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Results for coredns and running cluster-dns-operator e2e: we can build with PQ image and e2e tests all run, except for one non-TLS related flake. I think we don't hard code a cipher suite test in the same way so this won't be a problem

FROM registry.ci.openshift.org/ocp/4.22:base-rhel9

# Copy crypto-policies configuration from builder stage
COPY --from=builder /etc/crypto-policies/ /etc/crypto-policies/
Comment thread
sdodson marked this conversation as resolved.

# A ubi9 image will expose python3 as /usr/bin/python. It does not contain
# python2. Subsequent layers should install if it needed.
#
Expand Down