fix: swap MD5 with SHA256 for TLS to work with FIPS operator image #1710
  Add this suggestion to a batch that can be applied as a single commit.
  This suggestion is invalid because no changes were made to the code.
  Suggestions cannot be applied while the pull request is closed.
  Suggestions cannot be applied while viewing a subset of changes.
  Only one suggestion per line can be applied in a batch.
  Add this suggestion to a batch that can be applied as a single commit.
  Applying suggestions on deleted lines is not supported.
  You must change the existing code in this line in order to create a valid suggestion.
  Outdated suggestions cannot be applied.
  This suggestion has been applied or marked resolved.
  Suggestions cannot be applied from pending reviews.
  Suggestions cannot be applied on multi-line comments.
  Suggestions cannot be applied while the pull request is queued to merge.
  Suggestion cannot be applied right now. Please check back later.
  
    
  
    
Summary:
This PR updates the MongoDB Kubernetes Operator to support FIPS-compliant environments by replacing the MD5 hash algorithm with SHA-256 during SCRAM credential generation.
The motivation behind this change is a runtime panic triggered by OpenSSL when MD5 is used in environments with FIPS mode enabled. The crash occurs specifically during SCRAM credential creation, with errors like:
To address this, the patch swaps MD5 with SHA-256, a FIPS-approved algorithm that works seamlessly in the same context.
I validated this by deploying a TLS-secured
MongoDBCommunityReplicaSet using a patched FIPS-compatible MongoDB image and a Helm-based setup that includescert-managerfor issuing certs. The change allows the operator to successfully create SCRAM credentials without triggering FIPS-related crashes.All Submissions:
closes #XXXXin your comment to auto-close the issue that your PR fixes (if such).