FIPS compliance¶

Palo Alto Networks Kubernetes components are standard Go binaries that rely on the Go standard library for cryptography. Since the Go standard library is not FIPS-validated, we also offer FIPS-compliant versions of these components.

This topic explains how Palo Alto Networks builds FIPS-compliant components, how to confirm that a component is a FIPS build, and how to avoid non-compliant cryptography.

FIPS cryptographic modules by version¶

FIPS versions use upstream Go's native FIPS 140-3 support, which embeds the Go Cryptographic Module directly in each binary and carries Certificate #5247 (FIPS 140-3, Level 1). Because the module ships inside the binary, FIPS compliance doesn't depend on the host, the base image, or an external library such as OpenSSL.

Earlier FIPS builds used Microsoft's fork of Go to link against OpenSSL, which required a Red Hat UBI base image running in FIPS mode. Palo Alto Networks still supports these builds.

Each Palo Alto Networks FIPS build uses one of the following cryptographic modules:

Some very old FIPS builds used the BoringSSL module (Certificate #3678); none of those releases are supported today, so upgrade to a newer version. For more information on the OpenSSL module, see Red Hat's FIPS compliance page.

FIPS module by component¶

The following table shows which cryptographic module each component's FIPS builds use, by version.

Confirming FIPS compliance¶

Since the cryptographic module is compiled into each binary, Palo Alto Networks FIPS components are FIPS-compliant regardless of the host or base image. They do not require the underlying platform to run in FIPS mode, and they do not panic when run on a non-FIPS host.

There are two ways to confirm that a component is a FIPS build.

Check the compliance flag¶

All Palo Alto Networks FIPS binaries for these Kubernetes components include a hidden --venafi-fips-enabled flag. Run the binary or container with this flag as its only argument:

<binary> --venafi-fips-enabled

The exit code is the reliable check: 0 means FIPS mode is on, non-zero means it isn't. The command also prints Venafi FIPS: true or false to standard error (redirect with 2>&1 to read it).

A true result confirms FIPS mode is on but not which module provides it: both the validated module (v1.0.0) and a newer, unvalidated one report true. To confirm the validated module, use the next check.

Check the module recorded in the binary¶

FIPS builds are compiled with the Go Cryptographic Module, which is recorded in the binary's build information:

go version -m <binary> | grep GOFIPS140

Non-compliant cryptography¶

A FIPS-validated cryptographic module is not enough to be FIPS-compliant at runtime: you must also use only FIPS-approved algorithms. Some Palo Alto Networks FIPS-compliant components can use non-compliant algorithms if requested.

Whether a given algorithm is approved depends on the cryptographic module the component was built with, as described in FIPS cryptographic modules by version. The following guidance applies to builds that use the Go Cryptographic Module, Certificate #5247. To maintain FIPS compliance, avoid these algorithms.

Certificate algorithms¶

Distributed Issuer can issue certificates using the following algorithms:

Keystore output formats¶

cert-manager and Trust Manager can write to the following keystore formats:

PKCS#12 and JKS use these algorithms for backwards compatibility, not security. For more information, see the open-source documentation.

FIPS-only TLS¶

Palo Alto Networks FIPS-compliant binaries enforce FIPS-compliant TLS at runtime. In FIPS mode, TLS is restricted to FIPS-approved settings: TLS 1.0 and 1.1 are refused, and non-approved cipher suites — such as ChaCha20-Poly1305 and CBC suites — are unavailable. Only TLS 1.2 and 1.3 with approved cipher suites are allowed.

FIPS builds enable this by shipping with GODEBUG=fips140=on.

You can turn FIPS mode off by setting GODEBUG=fips140=off, which downgrades a FIPS image to standard cryptography. This is a deliberate operator action and makes the component non-compliant.

FIPS container images¶

Palo Alto Networks provides signed FIPS-compliant container images for its Kubernetes components. Images are single-arch (linux/amd64 only) and their names end with -fips.

Image names contain the -fips suffix, but some drop the cert-manager- prefix, for example csi-driver-fips.

Install a FIPS build¶

To install a component's FIPS build, use the FIPS variant of its Helm chart. For example, to install Trust Manager:

VERSION=v0.24.0
helm upgrade demo oci://registry.ngts.paloaltonetworks.com/charts/trust-manager-fips \
    --install \
    --wait \
    --create-namespace \
    --namespace venafi \
    --set global.imagePullSecret[0].name="ngts-image-pull-secret" \
    --version $VERSION

To confirm the correct build is running, check that the pod's container image has the -fips suffix.

Related links¶

• Container image signing
• Configuring Next-Gen Trust Security registry access