FIPS 140-2 compliant Kernel

[Luke Hinds]

Operators are often required to run a FIPS 140-2 compliant kernel that is needed for AES-NI crypto operations.

This requires some new packages including dracut-fips, dracut-fips-aesni and a new additional argument passed to grub `fips=1`

Full manual steps are outlined here: https://lukehinds.github.io/static/fips-kernel.html

It is expected that this will be achieved using tripleo-heat-templates, puppet-modules, although some steps may require cross project work with disc-imagebuilder.

[Steven Hardy (shardy)]

I think the steps for TripleO may look a little different, e.g we want the changes to files to happen inside the image, then we want Ironic to deploy the required kernel (ideally we really don't want to install a new kernel and reboot after the initial deploy as this can be really slow on some bare-metal platforms)

[Yolanda Robla (yolanda.robla)]

It is blocked because OpenStack does not work with FIPS enabled

[Yolanda Robla (yolanda.robla)]

Blocked by https://bugs.launchpad.net/tripleo/+bug/1641556

[Emilien Macchi (emilienm)]

There are no currently open reviews on this bug, changing the status back to the previous state and unassigning. If there are active reviews related to this bug, please include links in comments.

[Alex Schultz (alex-schultz)]

I've set https://bugs.launchpad.net/tripleo/+bug/1641556 to incomplete as we've upgraded to puppet 4.8.2 which is what seemed to be the last problem. Is this bug still blocked?

[Emilien Macchi (emilienm)]

This is an automated cleanup. This bug report has been closed because it
is older than 18 months and there is no open code change to fix this.
After this time it is unlikely that the circumstances which lead to
the observed issue can be reproduced.

If you can reproduce the bug, please:
* reopen the bug report (set to status "New")
* AND add the detailed steps to reproduce the issue (if applicable)
* AND leave a comment "CONFIRMED FOR: <RELEASE_NAME>"
  Only still supported release names are valid (FUTURE, PIKE, QUEENS, ROCKY, STEIN).
  Valid example: CONFIRMED FOR: FUTURE