New Ory Agent Security is now live! Claim your complimentary test drive. Get Started!

Skip to main content

v26.4.1

v26.4.1​

The Kratos FIPS build requires its secrets​

The Kratos FIPS build now refuses to start unless secrets.default, secrets.cookie, and secrets.pagination are set, like the Kratos OSS FIPS build and Hydra. The migrate commands are exempt.

Breaking changes​

Earlier Kratos FIPS builds started without these secrets. If you run the Kratos FIPS build, set all three secrets before you upgrade. The standard build is not affected.

FIPS 140-3 container images and Helm chart support for Kratos, Hydra, and Polis​

Every Ory Enterprise License release now publishes FIPS 140-3 images of Ory Kratos, Ory Hydra, and Ory Polis next to the standard images, with the same tags:

  • europe-docker.pkg.dev/ory-artifacts/ory-enterprise-kratos/kratos-oel-fips
  • europe-docker.pkg.dev/ory-artifacts/ory-enterprise/hydra-oel-fips, also on us-docker.pkg.dev
  • europe-docker.pkg.dev/ory-artifacts/ory-enterprise-polis/polis-oel-fips

The images support linux/amd64 and linux/arm64. Kratos and Hydra are built with the Go Cryptographic Module v1.0.0, NIST CMVP certificate #5247. Polis uses Red Hat's update stream of the Red Hat Enterprise Linux 9 OpenSSL FIPS Provider, NIST CMVP certificate #4857. That certificate lists no arm64 operating environment, and Red Hat supports the compliance claim only when the host kernel runs in FIPS mode.

To deploy a FIPS image, set the image repository in the OEL Helm chart: oss.image.repository in kratos-oel and hydra-oel, and image.repository in polis-oel.

In FIPS mode, Kratos refuses to start unless secrets.default, secrets.cookie, and secrets.pagination are set. Hydra refuses to start unless secrets.system, secrets.cookie, and secrets.pagination are set, each with its own first value. The charts do not map secrets.pagination, so pass it through oss.deployment.extraEnv.

The Polis FIPS image derives datastore keys with SHA-256 instead of RIPEMD-160, so it cannot read a database that the standard image wrote. Choose the image when you create a deployment, and do not switch an existing one. The Polis FIPS image does not support Microsoft SQL Server.

Signatures and SBOM and CBOM attestations for OEL images​

Ory now signs every OEL image and publishes each signature next to its image, on the enterprise registries and on Cloudsmith. All OEL images except the debug variants also carry two signed attestations: a Software Bill of Materials in SPDX format, and a CycloneDX document with the Software Bill of Materials and the Cryptography Bill of Materials.