Skip to content

fix: swap MD5 with SHA256 for TLS to work with FIPS operator image #1710

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

tip226
Copy link

@tip226 tip226 commented Apr 16, 2025

Summary:

This PR updates the MongoDB Kubernetes Operator to support FIPS-compliant environments by replacing the MD5 hash algorithm with SHA-256 during SCRAM credential generation.

The motivation behind this change is a runtime panic triggered by OpenSSL when MD5 is used in environments with FIPS mode enabled. The crash occurs specifically during SCRAM credential creation, with errors like:

panic: EVP_DigestInit_ex
openssl error(s):
error:0308010C:digital envelope routines::unsupported
error:03000086:digital envelope routines::initialization error

goroutine 242 [running]:
...
github.com/mongodb/mongodb-kubernetes-operator/pkg/authentication/scramcredentials.md5Hex

To address this, the patch swaps MD5 with SHA-256, a FIPS-approved algorithm that works seamlessly in the same context.

I validated this by deploying a TLS-secured MongoDBCommunity ReplicaSet using a patched FIPS-compatible MongoDB image and a Helm-based setup that includes cert-manager for issuing certs. The change allows the operator to successfully create SCRAM credentials without triggering FIPS-related crashes.

All Submissions:

  • Have you opened an Issue before filing this PR?
  • Have you signed our CLA?
  • Have you checked to ensure there aren't other open Pull Requests for the same update/change?
  • Put closes #XXXX in your comment to auto-close the issue that your PR fixes (if such).

@tip226
Copy link
Author

tip226 commented Apr 16, 2025

Closes #1709

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant