[JIRA: SAPBTPCFS-28335] fips and update libs (#592)

Author: I065450

Dockerfile

@@ -17,8 +17,10 @@ COPY internal/ internal/
 COPY client/ client/
 
 ARG TARGETOS TARGETARCH
+ARG GOFIPS140
+
 # Build
-RUN CGO_ENABLED=0 GOOS=$TARGETOS GOARCH=$TARGETARCH GO111MODULE=on go build -a -o manager main.go
+RUN CGO_ENABLED=0 GOFIPS140=v1.0.0 GOOS=$TARGETOS GOARCH=$TARGETARCH GO111MODULE=on go build -a -o manager main.go
 
 
 FROM alpine:3.23
@@ -27,4 +29,6 @@ WORKDIR /
 COPY --from=builder /workspace/manager .
 USER 65534:65534
 
+ENV GODEBUG="fips140=on"
+
 ENTRYPOINT ["/manager"]

api/v1/serviceinstance_types.go

@@ -17,7 +17,7 @@ limitations under the License.
 package v1
 
 import (
-	"crypto/md5"
+	"crypto/sha256"
 	"encoding/hex"
 	"encoding/json"
 
@@ -228,6 +228,6 @@ func (si *ServiceInstance) GetSpecHash() string {
 	spec.Shared = ptr.To(false)
 	specBytes, _ := json.Marshal(spec)
 	s := string(specBytes)
-	hash := md5.Sum([]byte(s))
+	hash := sha256.Sum256([]byte(s))
 	return hex.EncodeToString(hash[:])
 }

api/v1/serviceinstance_types_test.go

@@ -1,7 +1,7 @@
 package v1
 
 import (
-	"crypto/md5"
+	"crypto/sha256"
 	"encoding/hex"
 	"encoding/json"
 
@@ -139,7 +139,7 @@ var _ = Describe("Service Instance Type Test", func() {
 		spec := instance.Spec
 		spec.Shared = ptr.To(false)
 		specBytes, _ := json.Marshal(spec)
-		hash := md5.Sum(specBytes)
+		hash := sha256.Sum256(specBytes)
 		expectedHash := hex.EncodeToString(hash[:])
 
 		// Get actual hash

controllers/serviceinstance_controller.go

@@ -95,6 +95,16 @@ func (r *ServiceInstanceReconciler) Reconcile(ctx context.Context, req ctrl.Requ
 		}
 	}
 
+	// If stored hash is MD5 (32 chars) and we're now using SHA256 (64 chars),
+	// perform one-time migration by updating the stored hash without triggering update
+	if len(serviceInstance.Status.HashedSpec) == 32 {
+		// This is likely an MD5->SHA256 migration, update the stored hash silently
+		// to prevent unnecessary service updates during FIPS migration
+		log.Info(fmt.Sprintf("updated hashing for instance '%s' (id=%s)", serviceInstance.Name, serviceInstance.Status.InstanceID))
+		updateHashedSpecValue(serviceInstance)
+		return ctrl.Result{}, utils.UpdateStatus(ctx, r.Client, serviceInstance)
+	}
+
 	if len(serviceInstance.Status.OperationURL) > 0 {
 		// ongoing operation - poll status from SM
 		return r.poll(ctx, serviceInstance)
@@ -137,7 +147,6 @@ func (r *ServiceInstanceReconciler) Reconcile(ctx context.Context, req ctrl.Requ
 		return r.createInstance(ctx, smClient, serviceInstance)
 	}
 
-	// Update
 	if updateRequired(serviceInstance) {
 		return r.updateInstance(ctx, smClient, serviceInstance)
 	}

controllers/serviceinstance_controller_test.go

@@ -628,6 +628,40 @@ var _ = Describe("ServiceInstance controller", func() {
 				Expect(err.Error()).To(ContainSubstring("modifying spec.userInfo is not allowed"))
 			})
 		})
+
+		When("hash spec is md5", func() {
+			When("updateRequired returned true", func() {
+				BeforeEach(func() {
+					serviceInstance.Status.HashedSpec = "6dbc872739e7571d1bbf5d7b82537fa0"
+					serviceInstance.Status.ForceReconcile = true
+					Expect(k8sClient.Status().Update(ctx, serviceInstance)).Should(Succeed())
+					fakeClient.UpdateInstanceReturns(nil, "", nil)
+				})
+
+				It("instance should be updated", func() {
+					newExternalName := "my-new-external-name" + uuid.New().String()
+					serviceInstance.Spec.ExternalName = newExternalName
+					serviceInstance = updateInstance(ctx, serviceInstance)
+					Expect(serviceInstance.Spec.ExternalName).To(Equal(newExternalName))
+					Expect(fakeClient.UpdateInstanceCallCount()).To(Equal(1))
+				})
+			})
+
+			When("updateRequired returned false", func() {
+				BeforeEach(func() {
+					serviceInstance.Status.HashedSpec = "6dbc872739e7571d1bbf5d7b82537fa0"
+					Expect(k8sClient.Status().Update(ctx, serviceInstance)).Should(Succeed())
+					fakeClient.UpdateInstanceReturns(nil, "", nil)
+				})
+				It("should not update the instance in SM", func() {
+					newExternalName := "my-new-external-name" + uuid.New().String()
+					serviceInstance.Spec.ExternalName = newExternalName
+					serviceInstance = updateInstance(ctx, serviceInstance)
+					Expect(serviceInstance.Spec.ExternalName).To(Equal(newExternalName))
+					Expect(fakeClient.UpdateInstanceCallCount()).To(Equal(0))
+				})
+			})
+		})
 	})
 
 	Describe("Delete", func() {

go.mod

@@ -10,14 +10,14 @@ require (
 	github.com/kelseyhightower/envconfig v1.4.0
 	github.com/lithammer/dedent v1.1.0
 	github.com/onsi/ginkgo v1.16.5
-	github.com/onsi/gomega v1.38.0
+	github.com/onsi/gomega v1.38.3
 	github.com/pkg/errors v0.9.1
-	golang.org/x/oauth2 v0.30.0
-	k8s.io/api v0.33.0
-	k8s.io/apimachinery v0.33.0
-	k8s.io/client-go v0.33.0
-	k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738
-	sigs.k8s.io/controller-runtime v0.21.0
+	golang.org/x/oauth2 v0.34.0
+	k8s.io/api v0.35.0
+	k8s.io/apimachinery v0.35.0
+	k8s.io/client-go v0.35.0
+	k8s.io/utils v0.0.0-20251222233032-718f0e51e6d2
+	sigs.k8s.io/controller-runtime v0.22.4
 	sigs.k8s.io/yaml v1.6.0
 )
 
@@ -26,19 +26,18 @@ require (
 	github.com/Masterminds/goutils v1.1.1 // indirect
 	github.com/Masterminds/semver/v3 v3.4.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
-	github.com/blang/semver/v4 v4.0.0 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
-	github.com/emicklei/go-restful/v3 v3.11.0 // indirect
-	github.com/fsnotify/fsnotify v1.7.0 // indirect
-	github.com/fxamacker/cbor/v2 v2.7.0 // indirect
+	github.com/emicklei/go-restful/v3 v3.12.2 // indirect
+	github.com/fsnotify/fsnotify v1.9.0 // indirect
+	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
 	github.com/go-logr/zapr v1.3.0 // indirect
 	github.com/go-openapi/jsonpointer v0.21.0 // indirect
 	github.com/go-openapi/jsonreference v0.20.2 // indirect
 	github.com/go-openapi/swag v0.23.0 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/google/btree v1.1.3 // indirect
-	github.com/google/gnostic-models v0.6.9 // indirect
+	github.com/google/gnostic-models v0.7.0 // indirect
 	github.com/google/go-cmp v0.7.0 // indirect
 	github.com/huandu/xstrings v1.5.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
@@ -47,37 +46,39 @@ require (
 	github.com/mitchellh/copystructure v1.2.0 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
-	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/nxadm/tail v1.4.8 // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/prometheus/client_golang v1.22.0 // indirect
 	github.com/prometheus/client_model v0.6.1 // indirect
 	github.com/prometheus/common v0.62.0 // indirect
 	github.com/prometheus/procfs v0.15.1 // indirect
 	github.com/shopspring/decimal v1.4.0 // indirect
 	github.com/spf13/cast v1.7.0 // indirect
-	github.com/spf13/pflag v1.0.5 // indirect
+	github.com/spf13/pflag v1.0.9 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.27.0 // indirect
-	go.yaml.in/yaml/v2 v2.4.2 // indirect
-	golang.org/x/crypto v0.45.0 // indirect
+	go.yaml.in/yaml/v2 v2.4.3 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
+	golang.org/x/crypto v0.46.0 // indirect
 	golang.org/x/net v0.47.0 // indirect
-	golang.org/x/sync v0.18.0 // indirect
-	golang.org/x/sys v0.38.0 // indirect
-	golang.org/x/term v0.37.0 // indirect
-	golang.org/x/text v0.31.0 // indirect
+	golang.org/x/sync v0.19.0 // indirect
+	golang.org/x/sys v0.39.0 // indirect
+	golang.org/x/term v0.38.0 // indirect
+	golang.org/x/text v0.32.0 // indirect
 	golang.org/x/time v0.9.0 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
-	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
+	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	k8s.io/apiextensions-apiserver v0.33.0 // indirect
+	k8s.io/apiextensions-apiserver v0.34.1 // indirect
 	k8s.io/klog/v2 v2.130.1 // indirect
-	k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff // indirect
-	sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 // indirect
+	k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 // indirect
+	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
 	sigs.k8s.io/randfill v1.0.0 // indirect
-	sigs.k8s.io/structured-merge-diff/v4 v4.6.0 // indirect
+	sigs.k8s.io/structured-merge-diff/v6 v6.3.0 // indirect
 )