FIPS mode + manager.env.ssl=false causes Manager to error out.

[irgama]

Environment
Platform: EKS
Kubernetes/Platform Version(s): 1.31

Describe the bug
Upon upgrading to v5.4.2 the manager container crashes during initialization. Error log below:
FIPS mode detected (via /proc/sys/crypto/fips_enabled). 2025-01-22 15:01:09,594|INFO |MANAGER|apache.pekko.event.slf4j.Slf4jLogger(applyOrElse:117): Slf4jLogger started Exception in thread "main" java.lang.ExceptionInInitializerError at org.apache.pekko.http.scaladsl.HttpExt.sslTlsStage(Http.scala:858) at org.apache.pekko.http.scaladsl.HttpExt.sslTlsServerStage(Http.scala:845) at org.apache.pekko.http.scaladsl.HttpExt.fuseServerBidiFlow(Http.scala:114) at org.apache.pekko.http.scaladsl.HttpExt.bindAndHandle(Http.scala:253) at org.apache.pekko.http.scaladsl.HttpExt.bindAndHandleImpl(Http.scala:309) at org.apache.pekko.http.scaladsl.HttpExt.bindAndHandleAsync(Http.scala:374) at org.apache.pekko.http.scaladsl.HttpExt.bindAndHandleAsyncImpl(Http.scala:387) at org.apache.pekko.http.scaladsl.ServerBuilder$Impl.bind(ServerBuilder.scala:160) at com.neu.core.BootedCore.$init$(Core.scala:35) at com.neu.web.Rest$.<clinit>(Rest.scala:8) at com.neu.web.Rest.main(Rest.scala) Caused by: java.security.NoSuchAlgorithmException: Default SSLContext not available at java.base/sun.security.jca.GetInstance.getInstance(GetInstance.java:159) at java.base/javax.net.ssl.SSLContext.getInstance(SSLContext.java:185) at java.base/javax.net.ssl.SSLContext.getDefault(SSLContext.java:110) at org.apache.pekko.stream.scaladsl.TLSPlacebo$.<clinit>(TLS.scala:232) ... 11 more

To Reproduce
Steps to reproduce the behavior:

1. Enabled FIPS mode.
2. Disable Manager SSL. (This is done because we have a LB in front of it that handles SSL)
3. Use 5.4.2 image.
   Expected behavior
   Manager to be able to run without SSL enabled (i.e. as http) in order to allow our LB to handle SSL into/out of the cluster.

[irgama]

dea1377

Tracked down the change thats actually causing this to break at the above. It looks like in 5.4.1 FIPS was essentially ignored when starting Java. Now it detects if FIPS is enabled, and then uses the correct java security policy.

[irgama]

manager:
image:
repository: ironbank/neuvector/neuvector/manager
env:
ssl: false

This is what I mean by "Disable Manager SSL". Its values.yaml of the helm chart

[xingzhang-suse]

@irgama Please let me know if this issue is still reproducible.