🔄 Preview: docs: comprehensive FIPS 140-3 compliance page by buger · Pull Request #1844 · TykTechnologies/tyk-docs

buger · 2026-04-08T17:58:32Z

🔗 Auto-generated mirror PR for Mintlify preview

Original PR: #1843
Author: @buger

Purpose

This PR provides a Mintlify preview link for reviewing documentation changes.

Preview Link

The Mintlify preview will be available once this PR is processed.

⚠️ Important Notes

Do not merge this PR directly
This PR will be auto-merged when the original PR [TT-16951] docs: comprehensive FIPS 140-3 compliance page #1843 is merged
Make all comments and reviews on the original PR [TT-16951] docs: comprehensive FIPS 140-3 compliance page #1843

Changes

Summary

Complete rewrite of the FIPS compliance documentation page at to reflect the migration to Go 1.24+ native FIPS 140-3 and Docker Hardened Images.

Key changes from the previous version:

FIPS 140-2 → FIPS 140-3: updated to reflect the migration from (BoringCrypto C library) to (Go native FIPS module)
Full product coverage: added Tyk Dashboard and MDCB (previously only Gateway and Pump)
Docker Hardened Images: documented the DHI base image, its attestations (FIPS, SBOM, SLSA provenance, VEX, STIG), and how to verify them
Verification guide: step-by-step commands for verifying FIPS compliance in binaries and Docker images using , , and
VEX documentation: three methods for vulnerability filtering (Docker Scout, trivy OCI, trivy VEX repo)
Legal clarity: explicit compliance scope and limitations section with clear disclaimers about what is and isn't covered

Related PRs

[TT-16946][TT-16950][TT-16951] feat: use FIPS base image for EE and FIPS Docker builds gromit#444 (build infrastructure)
[TT-16950][TT-16951] feat(ci): use tykio/dhi-busybox:1.37-fips as base image tyk#7768 (gateway master)
[TT-16946][TT-16951] feat(ci): FIPS base image for EE/FIPS Docker builds (release-5.12) tyk#7977 (gateway release-5.12)
TykTechnologies/tyk-analytics#5417 (dashboard release-5.12)
TykTechnologies/tyk-analytics#5421 (dashboard master)

🤖 Generated with Claude Code

Revert "rewrite summary (#387)" This reverts commit 1c4402d.

* add version * change the folder name --------- Co-authored-by: itachi sasuke <8012032+Keithwachira@users.noreply.github.com>

Revert "Update tyk-stack.mdx (#425)" This reverts commit 115f944.

Co-authored-by: itachi sasuke <8012032+Keithwachira@users.noreply.github.com>

* fix-description * remove empty descriptions --------- Co-authored-by: itachi sasuke <8012032+Keithwachira@users.noreply.github.com>

Revert "Update tyk-stack.mdx (#450)" This reverts commit d441dbf.

Revert "Update branches-config.json (#475)" This reverts commit c22650f.

https://mintlify.com/docs/ai-ingestion#enabling-the-contextual-menu

Co-authored-by: itachi sasuke <8012032+Keithwachira@users.noreply.github.com>

* add sidebar * add contexual * return sidebar to top * add tag above sidetitle * addtags below front matter * add title --------- Co-authored-by: itachi sasuke <8012032+Keithwachira@users.noreply.github.com>

* add change text color to white * remove reduddant * remove reduddant --------- Co-authored-by: itachi sasuke <8012032+Keithwachira@users.noreply.github.com>

Co-authored-by: itachi sasuke <8012032+Keithwachira@users.noreply.github.com>

* docs: add TYK_DB_LOGLEVEL and log_level config support * DX-2357: Update to use TYK_LOGLEVEL instead of TYK_DB_LOGLEVEL * docs: add note about TYK_LOGLEVEL priority * docs: add note about TYK_DB_ prefix for TYK_LOGLEVEL * docs: add note about TYK_LOGFORMAT priority * ci: remove --no-deps from pip install requests * Apply suggestions from code review Co-authored-by: Master <sharadregoti15@gmail.com> * Update upgrade recommendations for production environments Removed reference to Tyk Operator for production upgrades. --------- Co-authored-by: Leonid Bugaev <leonsbox@gmail.com> Co-authored-by: Master <sharadregoti15@gmail.com>

…chor fragments (#1865) * DX-2361: Add GitHub Actions to validate external URLs and internal anchors - Extend validate_mintlify_docs.py with --check-anchors flag that extracts GFM-slugified heading anchors, {#custom-id} syntax, and <a id/name> elements from target MDX files and verifies every internal #fragment resolves - Update validate-docs.yml to run anchor check on every PR - Add check-external-links.yml workflow: weekly scheduled (Mon 07:00 UTC) and manual-trigger run that HEAD-checks all external HTTP/HTTPS URLs Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * DX-2361: Run external link check on every pull request Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * DX-2361: Fix exit code not failing on broken external links External link failures were reported but never factored into the exit code, so CI was passing despite 404s. Added has_broken_external check and a summary line for external link results. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * DX-2361: Switch external link checker to lychee Replace sequential Python/requests approach with lycheeverse/lychee-action. Lychee runs checks in parallel, has built-in retry logic, and is purpose-built for link checking — much faster on a repo with 1500+ external URLs. Add lychee.toml to exclude tyk-owned domains, localhost, placeholder URLs, and sites known to block bots (LinkedIn, Facebook). Accept 429 as non-broken to handle rate-limited responses gracefully. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * Fix mirror-pr workflow failing on PR bodies with special characters GitHub Actions expands ${{ }} expressions before the shell runs, so backticks and $ signs in PR bodies were injected raw into the script and interpreted as shell command substitution. Fix: write static content via a single-quoted heredoc (no shell expansion), then append the PR body via printf with an env var ($PR_BODY). Shell variables accessed as "$VAR" are never re-interpreted, making any PR body content safe. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * Fix lychee checking internal/relative links Add scheme = ["https", "http"] to lychee.toml so lychee only attempts to check http/https URLs. Without this, lychee tries to resolve root-relative paths (/img/..., /page/...) as file URIs and fails. Internal links are already validated by validate-docs.yml. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * Fix lychee erroring on root-relative paths scheme = ["https", "http"] didn't help because lychee fails to build the URL before the scheme filter runs. Set base = "https://tyk.io" so root-relative paths (/img/..., /page/...) are resolved to https://tyk.io/... and then silently skipped by the existing tyk.io exclude rule, rather than producing "cannot convert path to URI" errors. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * Fix lychee config: base -> base_url Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

#1872) * docs: add container support guide (Podman, containerd, CRI-O) * docs(DX-2363): restructure container runtimes guide and add cross-references - Rewrite containers.mdx as a proper Tyk docs page: clean frontmatter, active voice, no numbered headings, FAQ as AccordionGroup, no em dashes - Move page from tyk-self-managed/install/containers to deployment-and-operations/container-runtimes - Update docs.json: remove old nav entry, add new entry under Configuration group after planning-for-production - Add Container Runtimes cross-reference Note (after Prerequisites) to 7 install pages: tyk-self-managed docker/k8s, portal docker/k8s, ai-studio docker/k8s, tyk-governance installation Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: Leonid Bugaev <leonsbox@gmail.com> Co-authored-by: Sharad Regoti <sharadregoti15@gmail.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Rewrite the FIPS documentation to cover: - Migration from GOEXPERIMENT=boringcrypto (FIPS 140-2) to GOFIPS140=v1.0.0 (FIPS 140-3, Go 1.24+ native) - Docker Hardened Images (DHI) base with FIPS attestation - Full product matrix (Gateway, Dashboard, Pump, MDCB) - Step-by-step binary and image verification guide - VEX vulnerability management (Docker Scout, trivy OCI, trivy repo) - Base image transparency and attestation inspection - Clear compliance scope, limitations, and legal disclaimers - Configuration guide for FIPS mode - References to Go, Docker, and NIST documentation Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

yurisasuke and others added 30 commits July 1, 2025 14:47

Revert "rewrite summary" (#393)

312f403

Revert "rewrite summary (#387)" This reverts commit 1c4402d.

add version (#400)

50752d1

* add version * change the folder name --------- Co-authored-by: itachi sasuke <8012032+Keithwachira@users.noreply.github.com>

Update merge_docs_configs.py (#406)

5f8f6d3

Update trigger-docs-deploy.yml (#414)

92c099e

Update deploy-docs.yml (#420)

dec2c88

Update tyk-stack.mdx (#425)

115f944

Revert "Update tyk-stack.mdx" (#432)

e984ad6

Revert "Update tyk-stack.mdx (#425)" This reverts commit 115f944.

add snippets fix (#438)

5fa0898

Co-authored-by: itachi sasuke <8012032+Keithwachira@users.noreply.github.com>

fix-description (#444)

65dd5e9

* fix-description * remove empty descriptions --------- Co-authored-by: itachi sasuke <8012032+Keithwachira@users.noreply.github.com>

Update tyk-stack.mdx (#450)

d441dbf

Revert "Update tyk-stack.mdx" (#456)

8bc119d

Revert "Update tyk-stack.mdx (#450)" This reverts commit d441dbf.

Update apim.mdx (#466)

2a46764

Update tyk-cloud.mdx (#472)

d6bd188

Update branches-config.json (#475)

c22650f

Revert "Update branches-config.json" (#479)

8beea38

Revert "Update branches-config.json (#475)" This reverts commit c22650f.

Enabling the contextual menu in docs.json (#482)

787da0b

https://mintlify.com/docs/ai-ingestion#enabling-the-contextual-menu

add dark mode (#486)

b8c98fb

Co-authored-by: itachi sasuke <8012032+Keithwachira@users.noreply.github.com>

Update tyk-cloud.mdx (#494)

750717b

Update merge_docs_configs.py (#496)

d1f3487

add add more options to docs.json (#500)

8bc1d8d

Co-authored-by: itachi sasuke <8012032+Keithwachira@users.noreply.github.com>

add sidebar (#504)

a503954

* add sidebar * add contexual * return sidebar to top * add tag above sidetitle * addtags below front matter * add title --------- Co-authored-by: itachi sasuke <8012032+Keithwachira@users.noreply.github.com>

add change text color to white (#509)

6a3ea1d

* add change text color to white * remove reduddant * remove reduddant --------- Co-authored-by: itachi sasuke <8012032+Keithwachira@users.noreply.github.com>

add sec (#514)

dff88c8

Co-authored-by: itachi sasuke <8012032+Keithwachira@users.noreply.github.com>

remove border (#519)

497e00b

Co-authored-by: itachi sasuke <8012032+Keithwachira@users.noreply.github.com>

Update branches-config.json (#529)

cf7d0bd

Update branches-config.json (#541)

102d74e

Update branches-config.json (#552)

a8115ac

Update branches-config.json (#563)

aa61be7

remove comment (#570)

1132e8d

Co-authored-by: itachi sasuke <8012032+Keithwachira@users.noreply.github.com>

addpr-id-that-caused-a deployment (#575)

8cf8678

Co-authored-by: itachi sasuke <8012032+Keithwachira@users.noreply.github.com>

buger force-pushed the feat/fips-compliance-docs branch from 7085b38 to d1b2931 Compare April 8, 2026 18:59

mintlify bot deployed to staging April 8, 2026 19:01 View deployment

docs: fix JWT verification key type (#1837)

0924a2c

mintlify bot deployed to staging April 9, 2026 07:24 View deployment

buger force-pushed the feat/fips-compliance-docs branch from 3244d37 to de0f5c7 Compare April 9, 2026 18:58

mintlify bot deployed to staging April 9, 2026 19:00 View deployment

buger force-pushed the feat/fips-compliance-docs branch from de0f5c7 to b55e86c Compare April 9, 2026 20:34

mintlify bot deployed to staging April 9, 2026 20:36 View deployment

mintlify bot deployed to staging April 10, 2026 15:43 View deployment

fix: commit cherry-pick conflicts to avoid skipping (#1857)

f3b6642

mintlify bot deployed to staging April 10, 2026 16:01 View deployment

docs: document dashboard License Statistics page (DX-2328) (#1861)

7de8894

mintlify bot deployed to staging April 10, 2026 17:09 View deployment

mintlify bot deployed to staging April 11, 2026 09:39 View deployment

DX-2362: Fix 163 broken internal anchor fragment links 2 (#1867)

3722786

mintlify bot deployed to staging April 13, 2026 09:10 View deployment

mintlify bot deployed to staging April 13, 2026 09:11 View deployment

mintlify bot deployed to staging April 13, 2026 09:57 View deployment

probelabs bot and others added 5 commits April 16, 2026 14:11

Update developer-support/release-types/fips-release.mdx

e4b6819

Update developer-support/release-types/fips-release.mdx

7446506

Refine FIPS compliance documentation for clarity and accuracy

45e27ac

sharadregoti force-pushed the feat/fips-compliance-docs branch from 00c53c2 to 45e27ac Compare April 16, 2026 08:54

mintlify bot deployed to staging April 16, 2026 08:59 View deployment

probelabs bot and others added 2 commits April 16, 2026 14:39

[DX-2269] docs: remove references to Tyk Cloud Classic (#1871)

957a64e

Merge main into feat/fips-compliance-docs

504890a

mintlify bot deployed to staging April 16, 2026 09:14 View deployment

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

🔄 Preview: docs: comprehensive FIPS 140-3 compliance page#1844

🔄 Preview: docs: comprehensive FIPS 140-3 compliance page#1844
buger wants to merge 317 commits intoproductionfrom
feat/fips-compliance-docs

buger commented Apr 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

13 participants

Conversation

buger commented Apr 8, 2026

Purpose

Preview Link

⚠️ Important Notes

Changes

Summary

Key changes from the previous version:

Related PRs

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

13 participants