Enable FIPS compliance

Federal Information Processing Standards (FIPS) ensures that cryptographic modules meet NIST security requirements. FIPS is enabled by default when installed on a FIPS-enabled Red Hat OpenShift Container Platform (RHOCP) cluster.

In Red Hat Enterprise Linux (RHEL) 9, the supported standard is FIPS publication 140-3: Security Requirements for Cryptographic Modules. FIPS 140-3 validated cryptographic modules are cryptographic libraries that have completed the NIST CMVP process and have received a certificate from NIST.

When you use the system-wide cryptographic policy, FIPS 140 mode, RHEL and CoreOS are designed to restrict the use of core cryptographic modules and libraries to those that have been FIPS-validated. However, Paramiko implements cryptographic functions in code and has not been FIPS-validated. RHOSO core components use the RHEL cryptographic libraries submitted to NIST for FIPS validation unless they call Paramiko.

Verify FIPS compliance on RHOCP nodes
Copy link

You can check the FIPS status of Red Hat OpenShift Container Platform (RHOCP) or deployed worker nodes.

Procedure
Copy link

  1. Log in to your Red Hat OpenShift Container Platform (RHOCP) cluster as a user with cluster-admin privileges.
  2. Get a list of the nodes in the cluster: 
    $ oc get nodes

    For example:

    NAME  	STATUS   ROLES              	AGE	VERSION
master1   Ready	control-plane,master   7d1h   v1.28.6+6216ea1
master2   Ready	control-plane,master   7d1h   v1.28.6+6216ea1
master3   Ready	control-plane,master   7d1h   v1.28.6+6216ea1
worker1   Ready	worker             	7d1h   v1.28.6+6216ea1
worker2   Ready	worker             	7d1h   v1.28.6+6216ea1
worker3   Ready	worker
  3. Open a debug pod on one of the nodes shown in the output of the previous step: 
    $ oc debug node/worker2

    For example:

    Temporary namespace openshift-debug-rq2m8 is created for debugging node...
Starting pod/worker2-debug-5shqt ...
To use host binaries, run `chroot /host`
Pod IP: 192.168.50.112
If you don't see a command prompt, try pressing enter.
sh-5.1#
  4. Check for fips_enabled in /proc 
    sh-5.1# cat /proc/sys/crypto/fips_enabled

    1 is displayed for enabled, 0 for disabled:

Configure FIPS-compliant iSCSI on the control plane
Copy link

You must modify iscsi.conf on the Red Hat OpenShift Container Platform (RHOCP) cluster to remove MD5 and SHA1 because the iSCSId configuration for the control plane is not handled by the Operators.

Before you begin
Copy link

Procedure
Copy link

On each of your nodes, ensure that the value of node.session.auth.chap_algs in the /etc/iscsi/iscsi.conf file is set to SHA3-256,SHA256.