Skip to content

agent-installer-configuring-fips-compliance.adoc

Latest commit

 

History

History
51 lines (41 loc) · 1.8 KB

agent-installer-configuring-fips-compliance.adoc

File metadata and controls

51 lines (41 loc) · 1.8 KB

Configuring FIPS through the Agent-based Installer

During a cluster deployment, the Federal Information Processing Standards (FIPS) change is applied when the Red Hat Enterprise Linux CoreOS (RHCOS) machines are deployed in your cluster. For Red Hat Enterprise Linux (RHEL) machines, you must enable FIPS mode when you install the operating system on the machines that you plan to use as worker machines.

Important

{product-title} requires the use of a FIPS-capable installation binary to install a cluster in FIPS mode.

You can enable FIPS mode through the preferred method of install-config.yaml and agent-config.yaml:

  1. You must set value of the fips field to true in the install-config.yaml file:

    Sample install-config.yaml.file
    apiVersion: v1
baseDomain: test.example.com
metadata:
  name: sno-cluster
fips: true
    Important

    To enable FIPS mode on {ibm-z-name} clusters, you must also enable FIPS in either the .parm file or using virt-install as outlined in the procedures for manually adding {ibm-z-name} agents.

  2. Optional: If you are using the {ztp} manifests, you must set the value of fips as true in the agent-install.openshift.io/install-config-overrides field in the agent-cluster-install.yaml file:

    Sample agent-cluster-install.yaml file
    apiVersion: extensions.hive.openshift.io/v1beta1
kind: AgentClusterInstall
metadata:
  annotations:
    agent-install.openshift.io/install-config-overrides: '{"fips":true}'
  name: sno-cluster
  namespace: sno-cluster-test