fix: swap MD5 with SHA256 for TLS to work with FIPS operator image #1710
+3
−4
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary:
This PR updates the MongoDB Kubernetes Operator to support FIPS-compliant environments by replacing the MD5 hash algorithm with SHA-256 during SCRAM credential generation.
The motivation behind this change is a runtime panic triggered by OpenSSL when MD5 is used in environments with FIPS mode enabled. The crash occurs specifically during SCRAM credential creation, with errors like:
To address this, the patch swaps MD5 with SHA-256, a FIPS-approved algorithm that works seamlessly in the same context.
I validated this by deploying a TLS-secured
MongoDBCommunity
ReplicaSet using a patched FIPS-compatible MongoDB image and a Helm-based setup that includescert-manager
for issuing certs. The change allows the operator to successfully create SCRAM credentials without triggering FIPS-related crashes.All Submissions:
closes #XXXX
in your comment to auto-close the issue that your PR fixes (if such).