stackabletech / stackabletech/zookeeper-operator

Replace upstream "FIPS mode" with more fine-grained TLS hostname verification options

Open
#829 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Rust
Stars
37
Forks
11
Avg merge
1d 8h
Merged PRs (30d)
10

Description

https://github.com/stackabletech/zookeeper-operator/issues/760 was closed now that FIPS mode is on by default, disabling all ZK-specific TLS verification. That's a pretty blunt tool, so we opened https://github.com/apache/zookeeper/pull/2173 to add a more fine-grained option to control what we need. If that is merged then we should integrate it on our end.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

First check whether apache/zookeeper/pull/2173 has merged and read the fine-grained TLS hostname verification option it introduces. Then locate the operator's current FIPS-mode configuration and determine how that upstream option should be integrated; done means the blunt FIPS setting is replaced by the intended fine-grained control.

Written by the indexing model from the issue text.

Assessment

Tech stack
kubernetes, rust
Domain
infrastructure, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.