FIPS-Compliant Images

FIPS 140-3 compliant container images for the Portkey Enterprise Gateway and Data Service

FIPS-compliant images are available on the Enterprise plan. Contact your Portkey representative or [e-mail] to receive access to the FIPS image registry.

Portkey publishes FIPS-compliant container image variants for the Enterprise Gateway and the Data Service for customers operating under FIPS 140-3 / FedRAMP requirements. The FIPS images are functionally identical to the standard images, with the following differences:

• The container runs Node.js with the OpenSSL FIPS provider enabled.
• Cryptographic primitives used internally (e.g. SHA-256 for AWS request signing) are routed through FIPS-validated providers — the Data Service uses @smithy/hash-node instead of the default JS hashing path.
• The base image and dependencies are pinned to FIPS-validated versions.

Components with FIPS images

Component	First available in	Notes
Data Service	v1.7.1	Separate FIPS Dockerfile; FIPS-validated SHA-256 used for AWS signing
Enterprise Gateway	Available on request	FIPS image variant published alongside the standard release

Deploying via Helm

The standard Portkey Helm chart accepts the FIPS image references through the existing *Image.repository / *Image.tag values — point them at the FIPS image registry provided by Portkey:

images:
  gatewayImage:
    repository: "<FIPS_REGISTRY>/gateway-enterprise"
    tag: "<FIPS_TAG>"
  dataserviceImage:
    repository: "<FIPS_REGISTRY>/data-service"
    tag: "<FIPS_TAG>"

No other chart values need to change. Existing LOG_STORE, virtual-key, config, and observability settings continue to apply.

Verifying FIPS mode

After deploying, you can confirm FIPS mode is active by checking the OpenSSL providers loaded inside the container:

kubectl exec -n portkey deploy/portkey-gateway -- node -e "console.log(crypto.getFips())"

A return value of 1 indicates FIPS is enabled.

Support

For access to the FIPS image registry, validation reports, or compliance documentation, reach out to the Portkey team at [e-mail].