FIPS mode

​

What changes

• Every Thoras image tag gets a -fips suffix: thorasVersion 4.132.0 pulls services:4.132.0-fips. A per-component imageTag override gets the same suffix. A tag that already ends in -fips is used as is, and a tag with a digest fails the render, because a digest cannot take the suffix.
• The Go binaries (the services image and oauth2-proxy) run with GODEBUG=fips140=on and use the Go Cryptographic Module v1.0.0 (CMVP certificate 5247).
• The forecast worker image uses the UBI 9 system OpenSSL with the Red Hat FIPS provider enforced.
• The oauth2-proxy sidecar uses thorasDashboard.auth.fipsImageTag.

​

Requirements

• An external database. The bundled TimescaleDB has no FIPS build. Set externalTimescale and run the database on your own FIPS platform. The DSN must contain sslmode=verify-full exactly once, and the database password must be at least 14 bytes, because FIPS mode rejects shorter HMAC keys. See External TimescaleDB.
• No htpasswd dashboard sign-in. It checks a bcrypt hash, which is not FIPS approved. Use OIDC (thorasDashboard.auth.mode: oidc), turn dashboard auth off and put your own in front, or turn the dashboard off. See Dashboard authentication.
• cert-manager for the webhook certificates (thorasOperator.webhookCertGen.certManager.enabled: true). The kube-webhook-certgen Jobs are not used.

​

Example values

fips:
  enabled: true
externalTimescale:
  secretRefName: thoras-timescale-dsn
  secretRefKey: dsn # postgres://...?sslmode=verify-full
thorasOperator:
  webhookCertGen:
    certManager:
      enabled: true
thorasDashboard:
  auth:
    mode: oidc
    oidc:
      issuerURL: https://idp.example.com
      redirectURL: https://thoras.example.com/oauth2/callback
      existingSecret:
        secretName: oauth2-proxy-secrets

​

Further reading

• FIPS mode in the chart README for the exact render-time checks.