Chapter 6. Federal Information Processing Standard on Red Hat OpenStack Services on OpenShift The Federal Information Processing Standards (FIPS) is a set of security requirements developed by the National Institute of Standards and Technology (NIST). In Red Hat Enterprise Linux 9, the supported standard is FIPS publication 140-3: Security Requirements for Cryptographic Modules . For details about the supported standard, see the Federal Information Processing Standards Publication 140-3 . FIPS 140-3 validated cryptographic modules are cryptographic libraries that have completed the NIST CMVP process and have received a certificate from NIST. For current information on Red Hat FIPS 140 validated modules, see Compliance Activities and Government Standards . FIPS is enabled by default in Red Hat OpenStack Services on OpenShift (RHOSO) when RHOSO is installed on a FIPS enabled Red Hat OpenShift Container Platform (RHOCP) cluster. You must enable FIPS on the initial install of RHOCP. For more information on installing a RHOCP cluster in FIPS mode, see Installing a cluster in FIPS mode . When you use the system-wide cryptographic policy, FIPS 140 mode , RHEL and CoreOS are designed to restrict the use of core cryptographic modules and libraries to those that have been FIPS-validated. Paramiko however, implements cryptographic functions in code, and has not been FIPS-validated. RHOSO core components use the RHEL cryptographic libraries submitted to NIST for FIPS validation unless they call paramiko. 6.1. Preparing to install a FIPS enabled Red Hat OpenStack Services on OpenShift control plane Before you install the Red Hat OpenStack Services on OpenShift (RHOSO) control plane, you must modify iscsi.conf to remove MD5 and SHA1. The iSCSId configuration for the control plane is not handled by RHOSO operators, so you must complete this step on the Red Hat OpenShift Container Platform (RHOCP) cluster. Prerequisites You have a pre-existing RHOCP cluster with FIPS enabled. For more information about FIPS on RHOCP, see Support for FIPS cryptography . Procedure On each of your nodes, ensure that the value of node.session.auth.chap_algs in the /etc/iscsi/iscsi.conf file is set to SHA3-256,SHA256 . 6.2. Verification of FIPS status You can check the FIPS status of RHOCP or deployed worker nodes. Procedure Log in to your Red Hat OpenShift Container Platform (RHOCP) cluster with an account with cluster-admin privileges. Get a list of the nodes in the cluster: Example output: Open a debug pod on one of the nodes shown in the output of the step: Example output: Check for fips_enabled in /proc Example output. 1 is displayed for enabled, 0 for disabled: For more information about installing Red Hat OpenShift Cluster Platform in FIPS mode, see Support for FIPS cryptography in the RHOCP Installing guide.

Commands:
oc get nodes
NAME STATUS ROLES AGE VERSION master1 Ready control-plane,master 7d1h v1.28.6+6216ea1 master2 Ready control-plane,master 7d1h v1.28.6+6216ea1 master3 Ready control-plane,master 7d1h v1.28.6+6216ea1 worker1 Ready worker 7d1h v1.28.6+6216ea1 worker2 Ready worker 7d1h v1.28.6+6216ea1 worker3 Ready worker
oc debug node/worker2
Temporary namespace openshift-debug-rq2m8 is created for debugging node Starting pod/worker2-debug-5shqt To use host binaries, run `chroot /host` Pod IP: 192.168.50.112 If you don't see a command prompt, try pressing enter. sh-5.1#
sh-5.1# cat /proc/sys/crypto/fips_enabled
1