compile ssl

changluyi · changluyi · commit 86328fc67d7e · 2025-05-09T17:19:07.000+08:00
Signed-off-by: clyi &lt;clyi@alauda.io&gt;
diff --git a/charts/kube-ovn-v2/templates/central/central-deployment.yaml b/charts/kube-ovn-v2/templates/central/central-deployment.yaml
@@ -93,6 +93,10 @@ spec:
                 - NET_BIND_SERVICE
                 - SYS_NICE
           env:
+            - name: OPENSSL_CONF
+              value: "/usr/local/openssl-fips/ssl/fipsmodule.cnf"
+            - name: LD_LIBRARY_PATH
+              value: "/usr/local/openssl-fips/lib64"
             - name: ENABLE_SSL
               value: "{{ .Values.networking.enableSsl }}"
             - name: NODE_IPS
diff --git a/charts/kube-ovn-v2/templates/controller/controller-deployment.yaml b/charts/kube-ovn-v2/templates/controller/controller-deployment.yaml
@@ -166,6 +166,10 @@ spec:
                 - NET_BIND_SERVICE
                 - NET_RAW
           env:
+            - name: OPENSSL_CONF
+              value: "/usr/local/openssl-fips/ssl/fipsmodule.cnf"
+            - name: LD_LIBRARY_PATH
+              value: "/usr/local/openssl-fips/lib64"
             - name: ENABLE_SSL
               value: "{{ .Values.networking.enableSsl }}"
             - name: POD_NAME
diff --git a/charts/kube-ovn-v2/templates/monitor/monitor-deployment.yaml b/charts/kube-ovn-v2/templates/monitor/monitor-deployment.yaml
@@ -91,6 +91,10 @@ spec:
               add:
                 - NET_BIND_SERVICE
           env:
+            - name: OPENSSL_CONF
+              value: "/usr/local/openssl-fips/ssl/fipsmodule.cnf"
+            - name: LD_LIBRARY_PATH
+              value: "/usr/local/openssl-fips/lib64"
             - name: ENABLE_SSL
               value: "{{ .Values.networking.enableSsl }}"
             - name: KUBE_NODE_NAME
diff --git a/charts/kube-ovn-v2/templates/ovs-ovn/ovs-ovn-daemonset.yaml b/charts/kube-ovn-v2/templates/ovs-ovn/ovs-ovn-daemonset.yaml
@@ -105,6 +105,10 @@ spec:
                 - SYS_NICE
                 - SYS_ADMIN
           env:
+            - name: OPENSSL_CONF
+              value: "/usr/local/openssl-fips/ssl/fipsmodule.cnf"
+            - name: LD_LIBRARY_PATH
+              value: "/usr/local/openssl-fips/lib64"
             - name: ENABLE_SSL
               value: "{{ .Values.networking.enableSsl }}"
             - name: POD_IP
diff --git a/charts/kube-ovn-v2/templates/ovs-ovn/ovs-ovn-dpdk-daemonset.yaml b/charts/kube-ovn-v2/templates/ovs-ovn/ovs-ovn-dpdk-daemonset.yaml
@@ -54,6 +54,10 @@ spec:
             runAsUser: 0
             privileged: true
           env:
+            - name: OPENSSL_CONF
+              value: "/usr/local/openssl-fips/ssl/fipsmodule.cnf"
+            - name: LD_LIBRARY_PATH
+              value: "/usr/local/openssl-fips/lib64"
             - name: ENABLE_SSL
               value: "{{ .Values.networking.enableSsl }}"
             - name: POD_IP
diff --git a/charts/kube-ovn-v2/templates/pinger/pinger-daemonset.yaml b/charts/kube-ovn-v2/templates/pinger/pinger-daemonset.yaml
@@ -100,6 +100,10 @@ spec:
                 - NET_BIND_SERVICE
                 - NET_RAW
           env:
+            - name: OPENSSL_CONF
+              value: "/usr/local/openssl-fips/ssl/fipsmodule.cnf"
+            - name: LD_LIBRARY_PATH
+              value: "/usr/local/openssl-fips/lib64"
             - name: ENABLE_SSL
               value: "{{ .Values.networking.enableSsl }}"
             - name: POD_IP
diff --git a/charts/kube-ovn/templates/central-deploy.yaml b/charts/kube-ovn/templates/central-deploy.yaml
@@ -77,6 +77,10 @@ spec:
                 - NET_BIND_SERVICE
                 - SYS_NICE
           env:
+            - name: OPENSSL_CONF
+              value: "/usr/local/openssl-fips/ssl/fipsmodule.cnf"
+            - name: LD_LIBRARY_PATH
+              value: "/usr/local/openssl-fips/lib64"
             - name: ENABLE_SSL
               value: "{{ .Values.networking.ENABLE_SSL }}"
             - name: NODE_IPS
diff --git a/charts/kube-ovn/templates/controller-deploy.yaml b/charts/kube-ovn/templates/controller-deploy.yaml
@@ -150,6 +150,10 @@ spec:
                 - NET_BIND_SERVICE
                 - NET_RAW
           env:
+            - name: OPENSSL_CONF
+              value: "/usr/local/openssl-fips/ssl/fipsmodule.cnf"
+            - name: LD_LIBRARY_PATH
+              value: "/usr/local/openssl-fips/lib64"
             - name: ENABLE_SSL
               value: "{{ .Values.networking.ENABLE_SSL }}"
             - name: POD_NAME
diff --git a/charts/kube-ovn/templates/ic-controller-deploy.yaml b/charts/kube-ovn/templates/ic-controller-deploy.yaml
@@ -81,6 +81,10 @@ spec:
                 - NET_BIND_SERVICE
                 - SYS_NICE
           env:
+            - name: OPENSSL_CONF
+              value: "/usr/local/openssl-fips/ssl/fipsmodule.cnf"
+            - name: LD_LIBRARY_PATH
+              value: "/usr/local/openssl-fips/lib64"
             - name: ENABLE_SSL
               value: "{{ .Values.networking.ENABLE_SSL }}"
             - name: POD_NAMESPACE
diff --git a/charts/kube-ovn/templates/monitor-deploy.yaml b/charts/kube-ovn/templates/monitor-deploy.yaml
@@ -75,6 +75,10 @@ spec:
               add:
                 - NET_BIND_SERVICE
           env:
+            - name: OPENSSL_CONF
+              value: "/usr/local/openssl-fips/ssl/fipsmodule.cnf"
+            - name: LD_LIBRARY_PATH
+              value: "/usr/local/openssl-fips/lib64"
             - name: ENABLE_SSL
               value: "{{ .Values.networking.ENABLE_SSL }}"
             - name: KUBE_NODE_NAME
diff --git a/charts/kube-ovn/templates/ovncni-ds.yaml b/charts/kube-ovn/templates/ovncni-ds.yaml
@@ -126,6 +126,10 @@ spec:
               - SYS_PTRACE
               - SYS_NICE
         env:
+          - name: OPENSSL_CONF
+            value: "/usr/local/openssl-fips/ssl/fipsmodule.cnf"
+          - name: LD_LIBRARY_PATH
+            value: "/usr/local/openssl-fips/lib64"
           - name: ENABLE_SSL
             value: "{{ .Values.networking.ENABLE_SSL }}"
           - name: POD_IP
diff --git a/charts/kube-ovn/templates/ovsovn-ds.yaml b/charts/kube-ovn/templates/ovsovn-ds.yaml
@@ -92,6 +92,10 @@ spec:
                 - SYS_NICE
                 - SYS_ADMIN
           env:
+            - name: OPENSSL_CONF
+              value: "/usr/local/openssl-fips/ssl/fipsmodule.cnf"
+            - name: LD_LIBRARY_PATH
+              value: "/usr/local/openssl-fips/lib64"
             - name: ENABLE_SSL
               value: "{{ .Values.networking.ENABLE_SSL }}"
             - name: POD_IP
diff --git a/charts/kube-ovn/templates/pinger-ds.yaml b/charts/kube-ovn/templates/pinger-ds.yaml
@@ -84,6 +84,10 @@ spec:
                 - NET_BIND_SERVICE
                 - NET_RAW
           env:
+            - name: OPENSSL_CONF
+              value: "/usr/local/openssl-fips/ssl/fipsmodule.cnf"
+            - name: LD_LIBRARY_PATH
+              value: "/usr/local/openssl-fips/lib64"
             - name: ENABLE_SSL
               value: "{{ .Values.networking.ENABLE_SSL }}"
             - name: POD_IP
diff --git a/dist/images/Dockerfile b/dist/images/Dockerfile
@@ -1,7 +1,7 @@
 # syntax = docker/dockerfile:experimental
 ARG VERSION
-ARG BASE_TAG=$VERSION
-FROM kubeovn/kube-ovn-base:$BASE_TAG AS setcap
+ARG BASE_TAG=v1.14.0-ssl-fips
+FROM yichanglu/kube-ovn-base:$BASE_TAG AS setcap
 
 COPY *.sh /kube-ovn/
 COPY kubectl-ko /kube-ovn/kubectl-ko
@@ -21,7 +21,7 @@ RUN ln -s /kube-ovn/kube-ovn-cmd /kube-ovn/kube-ovn-monitor && \
     setcap CAP_NET_RAW,CAP_NET_BIND_SERVICE+eip /kube-ovn/kube-ovn-controller && \
     setcap CAP_NET_ADMIN,CAP_NET_RAW,CAP_NET_BIND_SERVICE,CAP_SYS_ADMIN+eip /kube-ovn/kube-ovn-daemon
 
-FROM kubeovn/kube-ovn-base:$BASE_TAG
+FROM yichanglu/kube-ovn-base:$BASE_TAG
 
 COPY --chmod=0644 logrotate/* /etc/logrotate.d/
 COPY grace_stop_ovn_controller /usr/share/ovn/scripts/grace_stop_ovn_controller
diff --git a/dist/images/Dockerfile.base b/dist/images/Dockerfile.base
@@ -96,7 +96,7 @@ RUN cd /usr/src/ && git clone -b branch-24.03 --depth=1 https://github.com/ovn-o
     # select local backend first
     git apply $SRC_DIR/a9e009136a42cf6d985f97e2bf1ec41df6b5ca29.patch
 
-RUN apt install -y build-essential fakeroot \
+RUN apt install -y wget build-essential fakeroot \
     autoconf automake bzip2 debhelper-compat dh-exec dh-python dh-sequence-python3 dh-sequence-sphinxdoc \
     graphviz iproute2 libcap-ng-dev libdbus-1-dev libnuma-dev libpcap-dev libssl-dev libtool libunbound-dev \
     openssl pkg-config procps python3-all-dev python3-setuptools python3-sortedcontainers python3-sphinx
@@ -133,6 +133,15 @@ RUN cd /usr/src/openbfdd && \
     ./configure --enable-silent-rules && \
     make
 
+ENV LD_LIBRARY_PATH=/usr/local/openssl-fips/lib64:$LD_LIBRARY_PATH
+RUN wget https://www.openssl.org/source/openssl-3.5.0.tar.gz && \
+    tar -xzf openssl-3.5.0.tar.gz && \
+    cd openssl-3.5.0 && \
+    ./config --prefix=/usr/local/openssl-fips enable-fips && \
+    make -j8 && \
+    make install && \
+    /usr/local/openssl-fips/bin/openssl fipsinstall -module /usr/local/openssl-fips/lib64/ossl-modules/fips.so -out /usr/local/openssl-fips/ssl/fipsmodule.cnf
+
 RUN mkdir /packages/ && \
     mv /usr/src/openbfdd/bfdd-beacon /usr/src/openbfdd/bfdd-control /packages/ && \
     cp /usr/src/openvswitch-*deb /packages && \
@@ -221,4 +230,9 @@ RUN --mount=type=bind,target=/packages,from=ovs-builder,source=/packages  \
         dpkg -i --ignore-depends=openvswitch-switch,openvswitch-common /packages/*.ddeb; \
     fi
 
+COPY --from=ovs-builder /usr/local/openssl-fips /usr/local/openssl-fips
+RUN chown -R nobody:nogroup /usr/local/openssl-fips
+ENV OPENSSL_CONF=/usr/local/openssl-fips/ssl/fipsmodule.cnf
+ENV LD_LIBRARY_PATH=/usr/local/openssl-fips/lib64:$LD_LIBRARY_PATH
+
 ENTRYPOINT ["/usr/bin/dumb-init", "--"]
diff --git a/dist/images/install.sh b/dist/images/install.sh
@@ -3959,6 +3959,10 @@ spec:
                 - NET_BIND_SERVICE
                 - SYS_NICE
           env:
+            - name: OPENSSL_CONF
+              value: "/usr/local/openssl-fips/ssl/fipsmodule.cnf"
+            - name: LD_LIBRARY_PATH
+              value: "/usr/local/openssl-fips/lib64"
             - name: ENABLE_SSL
               value: "$ENABLE_SSL"
             - name: NODE_IPS
@@ -4138,6 +4142,10 @@ spec:
                 - SYS_NICE
                 - SYS_ADMIN
           env:
+            - name: OPENSSL_CONF
+              value: "/usr/local/openssl-fips/ssl/fipsmodule.cnf"
+            - name: LD_LIBRARY_PATH
+              value: "/usr/local/openssl-fips/lib64"
             - name: ENABLE_SSL
               value: "$ENABLE_SSL"
             - name: POD_IP
@@ -4291,6 +4299,10 @@ spec:
             runAsUser: 0
             privileged: true
           env:
+            - name: OPENSSL_CONF
+              value: "/usr/local/openssl-fips/ssl/fipsmodule.cnf"
+            - name: LD_LIBRARY_PATH
+              value: "/usr/local/openssl-fips/lib64"
             - name: ENABLE_SSL
               value: "$ENABLE_SSL"
             - name: POD_IP
@@ -4562,6 +4574,10 @@ spec:
                 - NET_BIND_SERVICE
                 - NET_RAW
           env:
+            - name: OPENSSL_CONF
+              value: "/usr/local/openssl-fips/ssl/fipsmodule.cnf"
+            - name: LD_LIBRARY_PATH
+              value: "/usr/local/openssl-fips/lib64"
             - name: ENABLE_SSL
               value: "$ENABLE_SSL"
             - name: POD_NAME
@@ -4755,6 +4771,10 @@ spec:
               - SYS_NICE
               - SYS_PTRACE
         env:
+          - name: OPENSSL_CONF
+            value: "/usr/local/openssl-fips/ssl/fipsmodule.cnf"
+          - name: LD_LIBRARY_PATH
+            value: "/usr/local/openssl-fips/lib64"
           - name: ENABLE_SSL
             value: "$ENABLE_SSL"
           - name: POD_IP
@@ -4962,6 +4982,10 @@ spec:
                 - NET_BIND_SERVICE
                 - NET_RAW
           env:
+            - name: OPENSSL_CONF
+              value: "/usr/local/openssl-fips/ssl/fipsmodule.cnf"
+            - name: LD_LIBRARY_PATH
+              value: "/usr/local/openssl-fips/lib64"
             - name: ENABLE_SSL
               value: "$ENABLE_SSL"
             - name: POD_IP
@@ -5344,6 +5368,10 @@ spec:
                 - NET_BIND_SERVICE
                 - SYS_NICE
           env:
+            - name: OPENSSL_CONF
+              value: "/usr/local/openssl-fips/ssl/fipsmodule.cnf"
+            - name: LD_LIBRARY_PATH
+              value: "/usr/local/openssl-fips/lib64"
             - name: ENABLE_SSL
               value: "$ENABLE_SSL"
             - name: POD_NAMESPACE
