仓库指标
- 星标
- (27,997 个星标)
- PR 合并指标
- (平均合并 8天) (30 天内合并 378 个 PR)
描述
Title: Publish official FIPS-enabled Docker image variant
Description:
The Envoy build system already supports FIPS via --config=boringssl-fips and
--config=aws-lc-fips. The ask is to publish an additional image variant built
with one of those flags as part of the standard release pipeline — no codebase
changes required.
Desired behavior:
A -fips tagged image published alongside each standard release, e.g.:
envoyproxy/envoy:distroless-fips-v1.X.Y
Built with --config=aws-lc-fips (preferred — broader architecture support than
--config=boringssl-fips, which is Linux x86_64 only).
Scenario it enables:
Organizations with FIPS 140 compliance requirements currently have no official
path to a FIPS-enabled Envoy image. Existing options are either EOL (AWS App Mesh
prod-fips, discontinued September 2026), commercial-only (Tetrate, Solo.io), or
require teams to own and maintain a self-build pipeline.
Relevant links:
- FIPS build documentation: https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/security/ssl
- AWS App Mesh FIPS EOL: https://docs.aws.amazon.com/app-mesh/latest/userguide/envoy.html