Red Hat SummitQuesto contenuto non è disponibile nella lingua selezionata.
Chapter 6. Federal Information Processing Standard on Red Hat OpenStack Services on OpenShift
The Federal Information Processing Standards (FIPS) is a set of security requirements developed by the National Institute of Standards and Technology (NIST). FIPS is enabled by default in Red Hat OpenStack Services on OpenShift (RHOSO) when you install RHOSO on a FIPS enabled Red Hat OpenShift Container Platform (RHOCP) cluster. Therefore, you must enable FIPS on the initial install of RHOCP.
In Red Hat Enterprise Linux 9, the supported standard is FIPS publication 140-3: Security Requirements for Cryptographic Modules. FIPS 140-3 validated cryptographic modules are cryptographic libraries that have completed the NIST CMVP process and have received a certificate from NIST.
When you use the system-wide cryptographic policy, FIPS 140 mode, RHEL and CoreOS are designed to restrict the use of core cryptographic modules and libraries to those that have been FIPS-validated. Nowever, Paramiko implements cryptographic functions in code and has not been FIPS-validated. RHOSO core components use the RHEL cryptographic libraries submitted to NIST for FIPS validation unless they call Paramiko.
6.1. Checking FIPS status on RHOCP
You can check the FIPS status of Red Hat OpenShift Container Platform (RHOCP) or deployed worker nodes.
Procedure
-
Log in to your Red Hat OpenShift Container Platform (RHOCP) cluster as a user with
cluster-adminprivileges. Get a list of the nodes in the cluster:
$ oc get nodesFor example:
NAME STATUS ROLES AGE VERSION master1 Ready control-plane,master 7d1h v1.28.6+6216ea1 master2 Ready control-plane,master 7d1h v1.28.6+6216ea1 master3 Ready control-plane,master 7d1h v1.28.6+6216ea1 worker1 Ready worker 7d1h v1.28.6+6216ea1 worker2 Ready worker 7d1h v1.28.6+6216ea1 worker3 Ready workerOpen a debug pod on one of the nodes shown in the output of the previous step:
$ oc debug node/worker2For example:
Temporary namespace openshift-debug-rq2m8 is created for debugging node... Starting pod/worker2-debug-5shqt ... To use host binaries, run `chroot /host` Pod IP: 192.168.50.112 If you don't see a command prompt, try pressing enter. sh-5.1#Check for
fips_enabledin/procsh-5.1# cat /proc/sys/crypto/fips_enabled1is displayed for enabled,0for disabled:
6.2. Preparing to install a FIPS enabled Red Hat OpenStack Services on OpenShift control plane
You must modify iscsi.conf on the Red Hat OpenShift Container Platform (RHOCP) cluster to remove MD5 and SHA1 because the iSCSId configuration for the control plane is not handled by the Red Hat OpenStack Services on OpenShift (RHOSO) Operators.
Prerequisites
- Your RHOCP cluster has FIPS enabled. For information about how to check if FIPS is enabled on RHOCP, see Checking FIPS status on RHOCP.
Procedure
-
On each of your nodes, ensure that the value of
node.session.auth.chap_algsin the/etc/iscsi/iscsi.conffile is set toSHA3-256,SHA256.
'%20d='M201.5%20305.5c-13.8%200-24.9-11.1-24.9-24.6%200-13.8%2011.1-24.9%2024.9-24.9%2013.6%200%2024.6%2011.1%2024.6%2024.9%200%2013.6-11.1%2024.6-24.6%2024.6zM504%20256c0%20137-111%20248-248%20248S8%20393%208%20256%20119%208%20256%208s248%20111%20248%20248zm-132.3-41.2c-9.4%200-17.7%203.9-23.8%2010-22.4-15.5-52.6-25.5-86.1-26.6l17.4-78.3%2055.4%2012.5c0%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.3%2024.9-24.9s-11.1-24.9-24.9-24.9c-9.7%200-18%205.8-22.1%2013.8l-61.2-13.6c-3-.8-6.1%201.4-6.9%204.4l-19.1%2086.4c-33.2%201.4-63.1%2011.3-85.5%2026.8-6.1-6.4-14.7-10.2-24.1-10.2-34.9%200-46.3%2046.9-14.4%2062.8-1.1%205-1.7%2010.2-1.7%2015.5%200%2052.6%2059.2%2095.2%20132%2095.2%2073.1%200%20132.3-42.6%20132.3-95.2%200-5.3-.6-10.8-1.9-15.8%2031.3-16%2019.8-62.5-14.9-62.5zM302.8%20331c-18.2%2018.2-76.1%2017.9-93.6%200-2.2-2.2-6.1-2.2-8.3%200-2.5%202.5-2.5%206.4%200%208.6%2022.8%2022.8%2087.3%2022.8%20110.2%200%202.5-2.2%202.5-6.1%200-8.6-2.2-2.2-6.1-2.2-8.3%200zm7.7-75c-13.6%200-24.6%2011.1-24.6%2024.9%200%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.1%2024.9-24.6%200-13.8-11-24.9-24.9-24.9z'/%3e%3c/svg%3e){kind=small}