POC improvements: CRD fixes, FIPS 140-3 migration, schema hardening

- Add "Unknown" to condition status enum in all CRDs per K8s metav1.ConditionStatus
- Add ClusterRoleBinding for admin ClusterRole
- Migrate Makefile from BoringCrypto/GOEXPERIMENT to Go 1.25 native FIPS 140-3 (GOFIPS140/GODEBUG)
- Add BearerAuth security requirement to buildCreateStatusOperation
- Fix silent constraint drops in CRD-to-OpenAPI schema conversion (handle []interface{}, float64, additionalProperties as object)
- Bump generation in Replace when spec changes
- Remove redundant value-type presenter registrations
- Fix getOwnerPlural fallback to use lowercase

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: ciaranRoche

Makefile

@@ -3,9 +3,12 @@
 # Include bingo-managed tool variables
 include .bingo/Variables.mk
 
-# CGO_ENABLED=0 is not FIPS compliant. large commercial vendors and FedRAMP require FIPS compliant crypto
-# Use ?= to allow Dockerfile to override (CGO_ENABLED=0 for Alpine-based dev images)
-CGO_ENABLED ?= 1
+# Go 1.25+ uses native FIPS 140-3 support (GOFIPS140) instead of BoringCrypto/GOEXPERIMENT.
+# CGO is no longer required for FIPS compliance. Set GOFIPS140=latest at build time and
+# GODEBUG=fips140=on at runtime to enable FIPS 140-3 mode.
+# Use ?= to allow Dockerfile to override
+CGO_ENABLED ?= 0
+GOFIPS140 ?= latest
 
 GO ?= go
 
@@ -136,21 +139,21 @@ generate-vendor: generate
 build: generate-all ## Build the hyperfleet-api binary
 	@mkdir -p bin
 	@echo "Building version: ${VERSION}"
-	CGO_ENABLED=$(CGO_ENABLED) GOEXPERIMENT=boringcrypto ${GO} build $(GOFLAGS) -ldflags="$(LDFLAGS)" -o bin/hyperfleet-api ./cmd/hyperfleet-api
+	CGO_ENABLED=$(CGO_ENABLED) GOFIPS140=$(GOFIPS140) ${GO} build $(GOFLAGS) -ldflags="$(LDFLAGS)" -o bin/hyperfleet-api ./cmd/hyperfleet-api
 
 .PHONY: install
 install: generate-all ## Build and install binary to GOPATH/bin
-	CGO_ENABLED=$(CGO_ENABLED) GOEXPERIMENT=boringcrypto ${GO} install $(GOFLAGS) -ldflags="$(LDFLAGS)" ./cmd/hyperfleet-api
+	CGO_ENABLED=$(CGO_ENABLED) GOFIPS140=$(GOFIPS140) ${GO} install $(GOFLAGS) -ldflags="$(LDFLAGS)" ./cmd/hyperfleet-api
 
 .PHONY: run
 run: build ## Run the application
-	./bin/hyperfleet-api migrate
-	CRD_PATH=$(PWD)/charts/crds ./bin/hyperfleet-api serve
+	GODEBUG=fips140=on ./bin/hyperfleet-api migrate
+	GODEBUG=fips140=on CRD_PATH=$(PWD)/charts/crds ./bin/hyperfleet-api serve
 
 .PHONY: run-no-auth
 run-no-auth: build ## Run the application without auth
-	./bin/hyperfleet-api migrate
-	CRD_PATH=$(PWD)/charts/crds ./bin/hyperfleet-api serve --enable-authz=false --enable-jwt=false
+	GODEBUG=fips140=on ./bin/hyperfleet-api migrate
+	GODEBUG=fips140=on CRD_PATH=$(PWD)/charts/crds ./bin/hyperfleet-api serve --enable-authz=false --enable-jwt=false
 
 .PHONY: run/docs
 run/docs: check-container-tool ## Run swagger and host the api spec
@@ -163,7 +166,7 @@ run/docs: check-container-tool ## Run swagger and host the api spec
 cmds: ## Build all binaries under cmd/
 	@mkdir -p bin
 	for cmd in $$(ls cmd); do \
-		CGO_ENABLED=$(CGO_ENABLED) GOEXPERIMENT=boringcrypto ${GO} build \
+		CGO_ENABLED=$(CGO_ENABLED) GOFIPS140=$(GOFIPS140) ${GO} build \
 			$(GOFLAGS) \
 			-ldflags="$(LDFLAGS)" \
 			-o "bin/$${cmd}" \
@@ -196,24 +199,24 @@ secrets: ## Initialize secrets directory with default values
 
 .PHONY: test
 test: install secrets $(GOTESTSUM) ## Run unit tests
-	OCM_ENV=unit_testing $(GOTESTSUM) --format $(TEST_SUMMARY_FORMAT) -- -p 1 -v $(TESTFLAGS) \
+	GODEBUG=fips140=on OCM_ENV=unit_testing $(GOTESTSUM) --format $(TEST_SUMMARY_FORMAT) -- -p 1 -v $(TESTFLAGS) \
 		./pkg/... \
 		./cmd/...
 
 .PHONY: ci-test-unit
 ci-test-unit: install secrets $(GOTESTSUM) ## Run unit tests with JSON output
-	OCM_ENV=unit_testing $(GOTESTSUM) --jsonfile-timing-events=$(unit_test_json_output) --format $(TEST_SUMMARY_FORMAT) -- -p 1 -v $(TESTFLAGS) \
+	GODEBUG=fips140=on OCM_ENV=unit_testing $(GOTESTSUM) --jsonfile-timing-events=$(unit_test_json_output) --format $(TEST_SUMMARY_FORMAT) -- -p 1 -v $(TESTFLAGS) \
 		./pkg/... \
 		./cmd/...
 
 .PHONY: test-integration
 test-integration: install secrets $(GOTESTSUM) ## Run integration tests
-	TESTCONTAINERS_RYUK_DISABLED=true OCM_ENV=integration_testing $(GOTESTSUM) --format $(TEST_SUMMARY_FORMAT) -- -p 1 -ldflags -s -v -timeout 1h $(TESTFLAGS) \
+	GODEBUG=fips140=on TESTCONTAINERS_RYUK_DISABLED=true OCM_ENV=integration_testing $(GOTESTSUM) --format $(TEST_SUMMARY_FORMAT) -- -p 1 -ldflags -s -v -timeout 1h $(TESTFLAGS) \
 			./test/integration
 
 .PHONY: ci-test-integration
 ci-test-integration: install secrets $(GOTESTSUM) ## Run integration tests with JSON output
-	TESTCONTAINERS_RYUK_DISABLED=true OCM_ENV=integration_testing $(GOTESTSUM) --jsonfile-timing-events=$(integration_test_json_output) --format $(TEST_SUMMARY_FORMAT) -- -p 1 -ldflags -s -v -timeout 1h $(TESTFLAGS) \
+	GODEBUG=fips140=on TESTCONTAINERS_RYUK_DISABLED=true OCM_ENV=integration_testing $(GOTESTSUM) --jsonfile-timing-events=$(integration_test_json_output) --format $(TEST_SUMMARY_FORMAT) -- -p 1 -ldflags -s -v -timeout 1h $(TESTFLAGS) \
 			./test/integration
 
 .PHONY: test-all

charts/crds/cluster-crd.yaml

@@ -62,6 +62,7 @@ spec:
                         enum:
                           - "True"
                           - "False"
+                          - "Unknown"
                       reason:
                         type: string
                         description: Machine-readable reason for the condition's last transition

charts/crds/idp-crd.yaml

@@ -78,6 +78,7 @@ spec:
                         enum:
                           - "True"
                           - "False"
+                          - "Unknown"
                       reason:
                         type: string
                         description: Machine-readable reason for the condition's last transition

charts/crds/nodepool-crd.yaml

@@ -68,6 +68,7 @@ spec:
                         enum:
                           - "True"
                           - "False"
+                          - "Unknown"
                       reason:
                         type: string
                         description: Machine-readable reason for the condition's last transition

charts/templates/rbac/clusterrolebinding-admin.yaml

@@ -0,0 +1,16 @@
+{{- if .Values.rbac.create -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "hyperfleet-api.fullname" . }}-admin
+  labels:
+    {{- include "hyperfleet-api.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ include "hyperfleet-api.fullname" . }}-admin
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "hyperfleet-api.serviceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+{{- end }}

pkg/openapi/paths.go

@@ -337,6 +337,7 @@ func buildCreateStatusOperation(def *api.ResourceDefinition, ownerDef *api.Resou
 			},
 		},
 		Responses: buildStatusCreateResponses(),
+		Security:  &openapi3.SecurityRequirements{{"BearerAuth": {}}},
 	}
 }
 

pkg/openapi/schemas.go

@@ -278,18 +278,13 @@ func applySchemaProperties(schema *openapi3.Schema, crdSchema map[string]interfa
 		}
 	}
 
-	if required, ok := crdSchema["required"].([]string); ok {
-		schema.Required = required
-	}
+	schema.Required = toStringSlice(crdSchema["required"])
 
 	if desc, ok := crdSchema["description"].(string); ok {
 		schema.Description = desc
 	}
 
-	// Handle additionalProperties
-	if addProps, ok := crdSchema["additionalProperties"].(bool); ok && addProps {
-		schema.AdditionalProperties = openapi3.AdditionalProperties{Has: boolPtr(true)}
-	}
+	applyAdditionalProperties(schema, crdSchema)
 }
 
 // convertCRDSchemaToOpenAPI converts a CRD schema map to an OpenAPI SchemaRef.
@@ -320,13 +315,12 @@ func convertCRDSchemaToOpenAPI(crdSchema map[string]interface{}) *openapi3.Schem
 		schema.Max = &max
 	}
 
-	if minLen, ok := crdSchema["minLength"].(int64); ok {
-		schema.MinLength = uint64(minLen)
+	if v, ok := toUint64(crdSchema["minLength"]); ok {
+		schema.MinLength = v
 	}
 
-	if maxLen, ok := crdSchema["maxLength"].(int64); ok {
-		uval := uint64(maxLen)
-		schema.MaxLength = &uval
+	if v, ok := toUint64(crdSchema["maxLength"]); ok {
+		schema.MaxLength = &v
 	}
 
 	if pattern, ok := crdSchema["pattern"].(string); ok {
@@ -346,15 +340,58 @@ func convertCRDSchemaToOpenAPI(crdSchema map[string]interface{}) *openapi3.Schem
 		schema.Items = convertCRDSchemaToOpenAPI(items)
 	}
 
-	if required, ok := crdSchema["required"].([]string); ok {
-		schema.Required = required
+	schema.Required = toStringSlice(crdSchema["required"])
+
+	applyAdditionalProperties(schema, crdSchema)
+
+	return &openapi3.SchemaRef{Value: schema}
+}
+
+// toStringSlice converts an interface{} (typically []interface{} from JSON/YAML unmarshal) to []string.
+// Returns nil if the value is nil or not convertible.
+func toStringSlice(v interface{}) []string {
+	switch val := v.(type) {
+	case []string:
+		return val
+	case []interface{}:
+		result := make([]string, 0, len(val))
+		for _, item := range val {
+			if s, ok := item.(string); ok {
+				result = append(result, s)
+			}
+		}
+		return result
 	}
+	return nil
+}
 
-	if addProps, ok := crdSchema["additionalProperties"].(bool); ok && addProps {
-		schema.AdditionalProperties = openapi3.AdditionalProperties{Has: boolPtr(true)}
+// toUint64 converts an interface{} (typically float64 or int from JSON/YAML unmarshal) to uint64.
+func toUint64(v interface{}) (uint64, bool) {
+	switch val := v.(type) {
+	case float64:
+		return uint64(val), true
+	case int:
+		return uint64(val), true
+	case int64:
+		return uint64(val), true
 	}
+	return 0, false
+}
 
-	return &openapi3.SchemaRef{Value: schema}
+// applyAdditionalProperties handles the additionalProperties field which can be a bool or an object.
+func applyAdditionalProperties(schema *openapi3.Schema, crdSchema map[string]interface{}) {
+	ap := crdSchema["additionalProperties"]
+	if ap == nil {
+		return
+	}
+	switch val := ap.(type) {
+	case bool:
+		schema.AdditionalProperties = openapi3.AdditionalProperties{Has: boolPtr(val)}
+	case map[string]interface{}:
+		schema.AdditionalProperties = openapi3.AdditionalProperties{
+			Schema: convertCRDSchemaToOpenAPI(val),
+		}
+	}
 }
 
 // uint64Ptr returns a pointer to a uint64 value.

pkg/services/resource.go

@@ -1,6 +1,7 @@
 package services
 
 import (
+	"bytes"
 	"context"
 	"encoding/json"
 	stderrors "errors"
@@ -109,7 +110,16 @@ func (s *sqlResourceService) Create(ctx context.Context, resource *api.Resource,
 }
 
 func (s *sqlResourceService) Replace(ctx context.Context, resource *api.Resource) (*api.Resource, *errors.ServiceError) {
-	resource, err := s.resourceDao.Replace(ctx, resource)
+	existing, err := s.resourceDao.GetByKindAndID(ctx, resource.Kind, resource.ID)
+	if err != nil {
+		return nil, handleGetError(resource.Kind, "id", resource.ID, err)
+	}
+
+	if !bytes.Equal(existing.Spec, resource.Spec) {
+		resource.Generation = existing.Generation + 1
+	}
+
+	resource, err = s.resourceDao.Replace(ctx, resource)
 	if err != nil {
 		return nil, handleUpdateError(resource.Kind, err)
 	}

plugins/resources/plugin.go

@@ -6,6 +6,7 @@ import (
 	"context"
 	"net/http"
 	"os"
+	"strings"
 
 	"github.com/gorilla/mux"
 	"github.com/openshift-hyperfleet/hyperfleet-api/cmd/hyperfleet-api/environments"
@@ -99,10 +100,8 @@ func init() {
 		}
 	})
 
-	// Presenter registration for Resource type
-	presenters.RegisterPath(api.Resource{}, "resources")
+	// Presenter registration for Resource type (pointer only)
 	presenters.RegisterPath(&api.Resource{}, "resources")
-	presenters.RegisterKind(api.Resource{}, "Resource")
 	presenters.RegisterKind(&api.Resource{}, "Resource")
 }
 
@@ -161,5 +160,5 @@ func getOwnerPlural(kind string) string {
 		return def.Plural
 	}
 	// Fallback: lowercase + "s"
-	return kind + "s"
+	return strings.ToLower(kind) + "s"
 }