fips 140-2 compliance

[outro56]

Hello 👋 I am researching options for using a service mesh and one of my requirements is having full . Wondering is linkerd fips 140-2 compliant? I couldn't find much information on how to run linkerd in a fips compliant manner. Can someone point me in the right direction or some documentation I could read up on?

these are some references that I found so far

• Initial work for introducing openssl/boringssl as a TLS provider linkerd2-proxy#956
• meshtls: Add a boring backend linkerd2-proxy#1351

[wmorgan]

There was some initial work done on building a FIPS-140 compatible mode for Linkerd, but it did not conclude in a releasable feature. If a commercial solution would work for you, I would encourage you to inquire about this with Buoyant.

[wmorgan]

Buoyant now provides a FIPS-compliant Linkerd distribution. https://docs.buoyant.io/buoyant-enterprise-linkerd/latest/features/fips/

[LyraHarring]

Linkerd’s open-source version is not FIPS 140-2 compliant by default. However, Buoyant offers Buoyant Enterprise for Linkerd, which includes support for running with FIPS-validated cryptographic modules. This ensures all mesh traffic (control plane and data plane) can operate in a FIPS-compliant manner. For compliance programs like FedRAMP or NIST 800-171, you should request Buoyant’s documentation and CMVP certificate details to confirm the validated modules in use. Hope it helps!