Use non-crypto rand for audit IDs to avoid FIPS overhead

[sdodson]

Summary

• In FIPS mode, uuid.New() calls crypto/rand.Read() which routes through the FIPS-validated OpenSSL DRBG and getrandom() syscall on every API request. Audit IDs are correlation tokens with no security properties, so this cryptographic strength is unnecessary and expensive.
• Replaces with uuid.NewRandomFromReader() backed by math/rand/v2, which uses a lock-free ChaCha8 source. This preserves the UUID v4 format for backward compatibility while eliminating the FIPS crypto overhead.

I've since found out that this approach is proposed upstream in google/uuid#206 and in addition to not being subject to FIPS mode implementation from golang-fips/go it's 10x faster in general than even the non FIPS implementation. The author there notes that their path is actually cryptographically secure, but I'm still not sure we require that in the first place.

Additional detail, this should be safe in Go 1.22 and later which adds math/rand/v2.

Test plan

• Existing TestWithAuditID tests pass
• Full staging/src/k8s.io/apiserver/pkg/endpoints/filters/ test suite passes
• Verify reduced getrandom() syscall frequency under FIPS mode with strace

🤖 Generated with Claude Code

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[openshift-ci-robot]

@sdodson: the contents of this pull request could not be automatically validated.

The following commits could not be validated and must be approved by a top-level approver:

• bbfc33f|UPSTREAM: : Use non-crypto rand for audit IDs to avoid FIPS overhead: does not specify an upstream backport in the commit message

Comment /validate-backports to re-evaluate validity of the upstream PRs, for example when they are merged upstream.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: sdodson
Once this PR has been reviewed and has the lgtm label, please assign p0lyn0mial for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• DOWNSTREAM_OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 42c06536-43c6-400a-9d0f-18d040b518fe

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• ✅ Review completed - (🔄 Check again to review again)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci-robot]

@sdodson: the contents of this pull request could not be automatically validated.

The following commits could not be validated and must be approved by a top-level approver:

• 18df988|UPSTREAM: : Add test verifying audit ID is a valid UUID v4: does not specify an upstream backport in the commit message
• bbfc33f|UPSTREAM: : Use non-crypto rand for audit IDs to avoid FIPS overhead: does not specify an upstream backport in the commit message

Comment /validate-backports to re-evaluate validity of the upstream PRs, for example when they are merged upstream.