Document FIPS 140-3 images of the self-hosted Elastic Package Registry by vishaangelova · Pull Request #9212 · elastic/docs-content

vishaangelova · 2026-11-04T16:06:11Z

Summary

Contributes to docs-content-internal#2097. Follows up on docs-content#9163.

Adds a FIPS 140-3 images section to Host your own Elastic Package Registry: the -fips image tags, that packages and configuration match the regular images, the opt-in strict mode (GODEBUG=fips140=only), and the TLS 1.2 minimum. Based on the package-registry FIPS docs and Teresa's notes on the tracking issue.
Adds a pointer from the FIPS compliance overview, and one-line pointers from the self-managed air-gapped, ECK Package Registry, and Security prebuilt rules pages.

Version scoping

The images are tagged ga 9.6+, per Nima's comment.

Generative AI disclosure

Did you use a generative AI (GenAI) tool to assist in creating this contribution?

Yes
No

Tool(s) and model(s) used: Cursor with Claude

Add a FIPS 140-3 images section to Host your own Elastic Package Registry on the air-gapped page: the -fips image tags, that packages and configuration are the same as the regular images, the opt-in strict mode (GODEBUG=fips140=only), and the TLS 1.2 minimum. Add a bullet to the FIPS compliance overview pointing to it. Part of elastic/docs-content-internal#2097 Co-authored-by: Cursor <cursoragent@cursor.com>

github-actions · 2026-11-04T16:25:10Z

Elastic Docs AI PR menu

Check the box to run an AI review for this pull request.

Review docs changes (docs-review). Status: not started.

Powered by GitHub Agentic Workflows and docs-actions. For more information, reach out to the docs team.

github-actions · 2026-11-04T16:26:32Z

🔍 Preview links for changed docs

github-actions · 2026-11-04T16:26:38Z

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

github-actions · 2026-11-04T16:32:03Z

Docs review summary

Action required

reference/fleet/air-gapped.md, FIPS 140-3 images section: the sentence naming the Go Cryptographic Module and the "FIPS-enabled Wolfi base image from Chainguard rather than a UBI base image" describes build internals. Readers don't need them to choose or run the image, and the base image can change without notice. Keep the supported platforms and the link to the Go FIPS page. Drop the base image detail, or move it to the source repo docs. (Scope discipline)
reference/fleet/air-gapped.md, distribution list: the new FIPS: bullet isn't a distribution like the others in that list. It is a variant of each one. Consider moving it out of the list into the lead-in paragraph or a short sentence after the list, so the list stays parallel. (Formatting)

Issue satisfaction

I couldn't read the parent issue, https://github.com/elastic/docs-content-internal/issues/2097, because it is in a private repository, so I did not assess whether this PR satisfies it.

Review coverage

Content type: reference and how-to additions to an existing air-gapped how-to page, plus an overview bullet. The structure fits the surrounding pages.
Checked: user focus, applicability, maintainability, language, and style. Existing Vale findings aren't repeated.
Not checked: technical accuracy of the image tags, GODEBUG=fips140=only behavior, and the TLS 1.2 minimum. I didn't verify them against the elastic/package-registry source or the published docs, so an SME needs to confirm them. The applies_to version scoping is raised as an open question in the PR description and is left to the reviewers it names.

Generated from Docs review agent · ◷

Was this review helpful? When the PR closes, add the label ai-review:helpful or ai-review:unhelpful to it.

shainaraskas

perhaps I am missing some context, but hoping you can clarify for me whether there's a chance that fips version of the package registry might need to be documented in the other air-gapped docs as well - see other comments

Co-authored-by: Cursor <cursoragent@cursor.com>

vishaangelova · 2026-11-04T22:45:56Z

Thanks @shainaraskas! The whole registry is FIPS-compliant and every distribution has a -fips image with the same packages. I updated the docs in f1c8121:

I broadened the FIPS overview bullet so it isn't Fleet-specific.
I also added one-line pointers to the FIPS section from the self-managed air-gapped, ECK Package Registry, and Security prebuilt rules pages. I skipped ECE because fips.md (L31) says it isn't officially supported there.

Could you add an SME reviewer for the new FIPS section on the ECK Package Registry page?

nimarezainia · 2026-11-04T23:36:41Z

My preference is to show everything as available from 9.6 onwards.

teresaromero

lgtm

Co-authored-by: Cursor <cursoragent@cursor.com>

shainaraskas · 2026-11-05T14:15:12Z

@vishaangelova ty 🙏 added ECK stakeholders - will circle back with admin review shortly

shainaraskas

thanks for these fixes. I think we can likely defer the big one, which is that the core air gapped package registry docs are buried in the fleet docs :/

shainaraskas · 2026-11-06T19:57:42Z

+stack: ga 9.6+
+```
+
+If your environment requires FIPS 140-3 validated cryptography, set `spec.image` to a `-fips` distribution tag. This example uses the `lite` distribution, which is what ECK deploys by default. For all packages, use `docker.elastic.co/package-registry/distribution:<version>-fips` instead. For details on the FIPS images, refer to [FIPS 140-3 images](/reference/fleet/air-gapped.md#air-gapped-diy-epr-fips). To also run the operator itself in FIPS mode, refer to [](/deploy-manage/deploy/cloud-on-k8s/deploy-fips-compatible-version-of-eck.md).


I don't think that linking deep into the fleet docs makes sense long term. I see that this has been a problem for a while, e.g. https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/9212/deploy-manage/deploy/self-managed/air-gapped-install#air-gapped-elastic-package-registry - maybe we can log a bug

I agree, maybe the whole Host your own Elastic Package Registry section could be moved out of that doc to a better place? I'll open a follow-up issue to discuss where it would fit better.

Here's the issue: #9263. Feel free to edit/add to the description as needed (I wasn't sure about the labels..)

shainaraskas · 2026-11-06T20:20:46Z

+stack: ga 9.6+
+```
+
+If your environment requires FIPS 140-3 validated cryptography, set `spec.image` to a `-fips` distribution tag. This example uses the `lite` distribution, which is what ECK deploys by default. For all packages, use `docker.elastic.co/package-registry/distribution:<version>-fips` instead. For details on the FIPS images, refer to [FIPS 140-3 images](/reference/fleet/air-gapped.md#air-gapped-diy-epr-fips). To also run the operator itself in FIPS mode, refer to [](/deploy-manage/deploy/cloud-on-k8s/deploy-fips-compatible-version-of-eck.md).


--ubi-only gives ECK users a UBI registry image, but that isn’t documented anywhere, and the FIPS registry images are Wolfi-based with no UBI variant. If a user with --ubi-only sets a -fips image, they lose UBI with no warning. Is that an expectation we should be setting in the docs? prob a question for ECK operator folks @moukoublen @barkbay

vishaangelova marked this pull request as ready for review November 4, 2026 16:11

vishaangelova requested review from a team as code owners November 4, 2026 16:11

vishaangelova requested review from nimarezainia, teresaromero and younginseattle November 4, 2026 16:11

vishaangelova force-pushed the fips-9.6-registry-images branch from 27de5c4 to 302225f Compare November 4, 2026 16:23

github-actions Bot deployed to docs-preview November 4, 2026 16:29

View deployment

shainaraskas reviewed Nov 4, 2026

View reviewed changes

Comment thread deploy-manage/security/fips.md Resolved

Comment thread reference/fleet/air-gapped.md Resolved

Point to FIPS registry images from other air-gapped docs

f1c8121

Co-authored-by: Cursor <cursoragent@cursor.com>

github-actions Bot deployed to docs-preview November 4, 2026 22:33

View deployment

vishaangelova changed the title ~~Document FIPS 140-3 images of the self-hosted Elastic Package Registry~~ Document FIPS 140-3 registry images and Managed integrations on FedRAMP Moderate Nov 5, 2026

vishaangelova force-pushed the fips-9.6-registry-images branch from ae73ed7 to f1c8121 Compare November 5, 2026 12:41

vishaangelova changed the title ~~Document FIPS 140-3 registry images and Managed integrations on FedRAMP Moderate~~ Document FIPS 140-3 images of the self-hosted Elastic Package Registry Nov 5, 2026

vishaangelova mentioned this pull request Nov 5, 2026

Document Managed integrations availability in FedRAMP Moderate #9233

Open

1 of 2 tasks

github-actions Bot deployed to docs-preview November 5, 2026 12:47

View deployment

teresaromero approved these changes Nov 5, 2026

View reviewed changes

Comment thread deploy-manage/deploy/cloud-on-k8s/package-registry.md Resolved

vishaangelova force-pushed the fips-9.6-registry-images branch from ba7b5b0 to 4eb92fb Compare November 5, 2026 13:54

Clarify that the example uses the lite distribution

24e81c1

Co-authored-by: Cursor <cursoragent@cursor.com>

vishaangelova force-pushed the fips-9.6-registry-images branch from 4eb92fb to 24e81c1 Compare November 5, 2026 13:58

github-actions Bot deployed to docs-preview November 5, 2026 14:05

View deployment

shainaraskas requested review from a team and removed request for a team November 5, 2026 14:14

shainaraskas requested review from barkbay and moukoublen November 5, 2026 14:14

shainaraskas approved these changes Nov 6, 2026

View reviewed changes

shainaraskas mentioned this pull request Nov 6, 2026

Refresh EPR section on the Air gapped install page #9261

Open

1 of 2 tasks

github-actions Bot deployed to docs-preview November 7, 2026 13:38

View deployment

vishaangelova force-pushed the fips-9.6-registry-images branch from 30bee6c to 30f1d93 Compare November 7, 2026 13:54

Move the FIPS section under Deploy and fix the note fences

53aaf32

vishaangelova force-pushed the fips-9.6-registry-images branch from 30f1d93 to 53aaf32 Compare November 7, 2026 13:55

github-actions Bot deployed to docs-preview November 7, 2026 14:05

View deployment

vishaangelova mentioned this pull request Nov 7, 2026

Move the "Host your own EPR" docs outside the Fleet reference #9263

Open

Conversation

vishaangelova commented Nov 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Version scoping

Generative AI disclosure

Uh oh!

github-actions Bot commented Nov 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Elastic Docs AI PR menu

Uh oh!

github-actions Bot commented Nov 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔍 Preview links for changed docs

Uh oh!

github-actions Bot commented Nov 4, 2026

✅ Elastic Docs Style Checker (Vale)

Uh oh!

github-actions Bot commented Nov 4, 2026

Docs review summary

Action required

Issue satisfaction

Uh oh!

shainaraskas left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

vishaangelova commented Nov 4, 2026

Uh oh!

nimarezainia commented Nov 4, 2026

Uh oh!

teresaromero left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

shainaraskas commented Nov 5, 2026

Uh oh!

shainaraskas left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

shainaraskas Nov 6, 2026

Choose a reason for hiding this comment

Uh oh!

vishaangelova Nov 7, 2026

Choose a reason for hiding this comment

Uh oh!

vishaangelova Nov 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

shainaraskas Nov 6, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

vishaangelova commented Nov 4, 2026 •

edited

Loading

github-actions Bot commented Nov 4, 2026 •

edited

Loading

github-actions Bot commented Nov 4, 2026 •

edited

Loading

vishaangelova Nov 7, 2026 •

edited

Loading