# istio_fips.yaml
apiVersion: release-notes/v2
kind: bug-fix
area: security
issue:
- 49081

releaseNotes:
- |
  **Added** an environment variable `COMPLIANCE_POLICY` to Istio components for
  enforcing TLS restriction for compliance with FIPS. When set to `fips-140-2`
  on the Istiod container, the Istio Proxy container, and all other Istio
  components, TLS version is restricted to v1.2, the cipher suites to a subset
  of `ECDHE-ECDSA-AES128-GCM-SHA256`, `ECDHE-RSA-AES128-GCM-SHA256`,
  `ECDHE-ECDSA-AES256-GCM-SHA384`, `ECDHE-RSA-AES256-GCM-SHA384`, and ECDH
  curves to `P-256`. These restrictions apply on the following data paths:

  * mTLS communication between Envoy proxies;
  * regular TLS on the downstream and the upstream of Envoy proxies (e.g. gateway);
  * Google gRPC side requests from Envoy proxies (e.g. Stackdriver extensions);
  * Istiod xDS server;
  * Istiod injection and validation webhook servers.

  The restrictions are not applied on the following data paths:
  * Istiod to Kubernetes API server;
  * JWK fetch from Istiod;
  * Wasm image and URL fetch from Istio Proxy containers;
  * ztunnel.

  Note that Istio injector will propagate the value of COMPLIANCE_POLICY to the
  injected proxy container, when set.