agent-installer-configuring-fips-compliance.adoc

Configuring FIPS through the Agent-based Installer

During a cluster deployment, the Federal Information Processing Standards (FIPS) change is applied when the Red Hat Enterprise Linux CoreOS (RHCOS) machines are deployed in your cluster. For Red Hat Enterprise Linux (RHEL) machines, you must enable FIPS mode when you install the operating system on the machines that you plan to use as worker machines.

Important

{product-title} requires the use of a FIPS-capable installation binary to install a cluster in FIPS mode.

You can enable FIPS mode through the preferred method of install-config.yaml and agent-config.yaml:

1. You must set value of the fips field to true in the install-config.yaml file:

   Sample install-config.yaml.file

   apiVersion: v1
   baseDomain: test.example.com
   metadata:
     name: sno-cluster
   fips: true

   Important

   To enable FIPS mode on {ibm-z-name} clusters, you must also enable FIPS in either the .parm file or using virt-install as outlined in the procedures for manually adding {ibm-z-name} agents.

2. Optional: If you are using the {ztp} manifests, you must set the value of fips as true in the agent-install.openshift.io/install-config-overrides field in the agent-cluster-install.yaml file:

   Sample agent-cluster-install.yaml file

   apiVersion: extensions.hive.openshift.io/v1beta1
   kind: AgentClusterInstall
   metadata:
     annotations:
       agent-install.openshift.io/install-config-overrides: '{"fips": true}'
     name: sno-cluster
     namespace: sno-cluster-test