[Build] Add FIPS docker image for GovCloud

[breskeby]

• Adds docker image based on chainguard base fips image
• x86 only for now as the base image is x86b only

The fips image is shipped with:

• org.bouncycastle:bc-fips:1.0.2.5 and org.bouncycastle:bctls-fips:1.0.19 in Elasticsearch libs folder
• config/jvm.options.d/fips.options for fips specific JVM options
• fips_java.security file
• fips_java.policy

Todo:
Add packaging test coverage (part of later PR as we want to provide that image for testing early and packaging tests require more general restructuring for support fips scenarios)

[elasticsearchmachine]

Pinging @elastic/es-delivery (Team:Delivery)

[jakelandis]

we need to base the image from: chainguard-base-fips

while the majority of the FIPS compliant for ES is from the JDK/app level, the container itself must also be FIPS compliant.
(EDIT: or is that already the case here ? ...if so, for my own education, how are the tags defined across base and base-fips?)

[breskeby]

we transitively base this on chainguard-base as cloud-ess is based on our es-wolfi image and this is based on chainguard-base. @jakelandis you say this must be chainguard-base-fips instead?

This is coded into distribution/docker/build.gradle

[breskeby]

I need to do more tweaking as but you can test this from the branch by running:

./gradlew buildAarch64FipsDockerImage

# start image directly
docker run elasticsearch-fips:aarch64

# inspect image 
docker run -it --entrypoint /bin/bash elasticsearch-fips:aarch64 

[breskeby]

@jakelandis With the latest WIP I configure a hardcoded password for the keystore (as it must be >12 characters) Strictly speaking that's fips compliant as I get it, but how is that safe enough if we bake that password into the image itself? each image would have the same keystone password basically public.

It seems we should instead have the ability in ES to ensure we generate dynamically a keystore with fips compliant password without explicitly declaring it?

[jakelandis]

you say this must be chainguard-base-fips instead?

Yes, the base image, for this purpose, must also be FIPS compliant.

but how is that safe enough if we bake that password into the image itself? each image would have the same keystone password basically public.

This probably warrants it's own discussion, there is likely some cloud level config needed here.

[breskeby]

@jakelandis I changed the base image to be chainguard-base-fips. One side effect here is that aarch64 is not supported anymore. You can test this with

./gradlew buildFipsDockerImage

# start image directly
docker run elasticsearch-fips:x86_64

# inspect image 
docker run -it --entrypoint /bin/bash elasticsearch-fips:x86_64 

[xnox]

these keys will work for netty; but not for BCJSSE in approved only mode.

Was this tested or solved?

[breskeby]

this has been removed

[xnox]

ah, that's how incompatibility is fixed by turning off xpack.security ssl.