Add FIPS testing_manifest.yaml

Russell Huonder
2026-04-03T03:04:15Z

**ACTION REQUIRED by April 14th, 2025 to retain “fips” in the name of this repository. See instructions below.** **WHAT:** Ironbank now supports automated FIPS readiness testing in repo1 containers. The tests run automatically in the container pipeline. Any failure stops the pipeline and highlights the issue. The tests will be run on kernel hosts with FIPS enabled (see the section below for adding FIPS variables to the settings). Using FIPS-ready containers is the first step toward building fully compliant FIPS systems. Once running a full cluster, customers can do their own FIPS compliance testing with more confidence since they started with FIPS Ready containers from Ironbank. **WHEN:** FIPS readiness testing is live in Ironbank’s pipelines—you can enable it in your vendor repositories today. Repositories with 'fips' in the name must implement these tests by April 14, 2025. By doing so, the Ironbank repositories will be allowed to keep “-fips” in the name of the repository/image. In the near future, the Ironbank Frond End (IBFE) will mark images with successful FIPS testing as “FIPS Ready” to make it easy for customers to find them. **HOW:** Enable FIPS testing in two steps: **STEP 1:** Create or update `testing_manifest.yaml` in the repo root (next to `hardening_manifest.yaml`). This file defines the commands to verify FIPS is enabled in the container. Below is an example file which does two checks. You should use these two checks, and add any others to verify FIPS is configured and running as desired in the container. In the below example, the first test reads `/proc/cmdline` and checks for `fips=1` in the output. Part of the output is required to have `fips=1` in it, or the test will fail (expected output must appear somewhere in the output of the command being run). The second test checks `/proc/sys/crypto/fips_enabled` for a `1`. You can add other tests similar to this in order to verify FIPS is configured for your container, and is enabled. If you create a test script or program that checks FIPS, you can have it be part of the container, and run from here as well. NOTE that the output from these tests will appear in the pipeline logs under the Pipeline’s “scan” stage in “functional-testing-amd64-fips” and/or “functional-testing-arm64-fips”. ``` testing_manifest.yaml: docker: - name: cat /proc/cmdline description: See kernel cmdline parameters. Should see fips=1 commands: - command: cat /proc/cmdline timeout_seconds: 60 expected_output: "fips=1" - name: /proc/sys/crypto/fips_enabled description: checking for fips enabled. file should exist and contain a "1" commands: - command: cat /proc/sys/crypto/fips_enabled timeout_seconds: 60 expected_output: "1" ``` **Step 2:** Add pipeline variables to the repository. These variables instruct the Ironbank pipeline to use a FIPS-enabled kernel for testing. 2a) With permissions, go to the repository’s project -> Settings -> CI/CD -> Variables section, and Add Variable (you will do this once for each variable) 2b) Uncheck “Protect variable” so the testing will happen on all branches in the repo 2c) Key: 2d) Value: true 2e) Add variable (back to 2a for 2nd variable) ``` ENABLE_FUNCTIONAL_TEST_AMD64_FIPS true ENABLE_FUNCTIONAL_TEST_ARM64_FIPS true ``` Remove these existing variables if present: ``` ENABLE_FUNCTIONAL_TEST_AMD64 ENABLE_FUNCTIONAL_TEST_ARM64 ``` With the above successfully in place and committed to repo1, any time you run its pipeline, you will see results in the scan stage. As stated previously, the tests must pass, or all further parts of the pipeline will be skipped. This is the assurance that only images which pass the FIPS tests are uploaded during the ‘publish’ stage.