FIPS, or Federal Information Processing Standards, are basically a set of rules created by the U.S. government to make sure technology systems are secure and consistent. Think of them as official guidelines that help organizations protect sensitive data and keep their computer systems reliable.

This blog explains how FIPS can be enabled on OCP along with FIPS Wall support, which primarily ensures FIPS compliance for BAW on containers. FIPS mode can also be enabled in non-OCP clusters, such as on RHEL machines, allowing deployments to run with FIPS mode enabled even though this does not equate to full FIPS compliance. In addition, BAW containers can be deployed into a FIPS-enabled cluster, providing an added layer of security for workloads running in that environment.

Enabling FIPS on OCP clusters.

1. FIPS needs to be enabled at the cluster level for OCP.

2. Configure FIPS WALL in OCP clusters. Create a file name FIPS_Wall.sh and run this script to configure FIPS_Wall

#!/bin/bash
clear
echo -e "\033[33m#### Enabling FIPS WALL on to the given OCP. This will take about 30 minutes to complete #### \n\n \033[0m"
FIPS_STATUS=$(cat /root/install-config.yaml.bu | grep fips | cut -d " " -f 2 | tr -d '[:space:]')
NETWORK_TYPE=$(cat /root/install-config.yaml.bu | grep networkType | cut -d ":" -f 2 | tr -d '[:space:]')
NODES=$(oc get nodes --no-headers | awk '{print $1}')

if [[ $FIPS_STATUS == "true" ]];
then
    echo -e "\033[32mThe Current OCP is FIPS Enabled\033[0m"
    echo -e "\033[32mContinuing with the further steps.... \n \n\033[0m"
else
    echo -e "\031[31mThe Current OCP is FIPS Enabled\033[0m"
    exit 1
fi

if [[ $NETWORK_TYPE == "OVNKubernetes" ]];
then
    echo -e "\033[32mnetworkType is set to OVNKubernetes already\033[0m"
    echo -e "\033[32mContinuing with the further steps.... \n \n\033[0m"
else
    echo -e "\033[33mnetworkType is not set to OVNKubernetes. Hence Setting the same\033[0m"
    sed -i "/networkType:/c\  networkType: OVNKubernetes" /root/install-config.yaml.bu
    echo -e "\033[32mContinuing with the further steps.... \n \n\033[0m"
fi

echo ""

echo -e "\033[33mVerifying if all the nodes are FIPS enabled or not\033[0m"

for node in $NODES
do
    echo -e "\033[36mVerifying FIPS for node - $node\033[0m"
    isFipsEnabled=$(oc debug node/$node -- cat /proc/sys/crypto/fips_enabled)
    if [[ $isFipsEnabled -eq 1 ]];
    then
        echo -e "\033[32m$node is FIPS ENABLED\033[0m"
    else
        echo -e "\033[31m$node is FIPS DISABLED\033[0m"
    fi
    echo "----"
    echo "----"
done

echo ""
echo ""

echo -e "\033[33m#### Configuring IPSec Tunnels on the OCP ####\033[0m"
echo -e "\033[32mEnabling IPSec Encrytion ... \033[0m"

oc patch networks.operator.openshift.io cluster --type=merge -p '{ "spec":{ "defaultNetwork":{ "ovnKubernetesConfig":{ "ipsecConfig":{ "mode":"Full" }}}}}'

CURRENT_PODS=$(oc get pods -n openshift-ovn-kubernetes -l=app=ovnkube-node --no-headers -o custom-columns=":metadata.name")
CURRENT_PODS_COUNT=$(echo "$CURRENT_PODS" | wc -l)

echo -e "\033[32m$CURRENT_PODS\033[0m"
echo -e "\033[33mPOD Replacement can take upto 20 minutes\033[0m"

echo "$CURRENT_PODS_COUNT"

while [ $CURRENT_PODS_COUNT != "0" ];
do
    for pod in $CURRENT_PODS;
    do
        if oc get pod $pod -n openshift-ovn-kubernetes --no-headers &>/dev/null;
        then
            echo -e "Waiting for pod replacement - \033[33m$pod\033[0m ........"
            echo ""
            sleep 5
        else
            echo -e "\033[36m$pod\033[0m have been replaced now"
            
            delete=$pod
            echo ${CURRENT_PODS[@]/$delete}
            CURRENT_PODS=${CURRENT_PODS[@]/$delete}

            NEW_COUNT=$(expr $CURRENT_PODS_COUNT - 1)
            CURRENT_PODS_COUNT=$NEW_COUNT

            if [[ $NEW_COUNT == "0" ]];
            then
                echo "ARRAY is EMPTY"
                break
            else
                echo "$NEW_COUNT"
                echo "ARRAY is not empty"
            fi
        fi
    done
done

NEW_PODS=$(oc get pods -n openshift-ovn-kubernetes -l=app=ovnkube-node --no-headers -o custom-columns=":metadata.name")

for newpod in $NEW_PODS;
do
    IPSEC=$(oc -n openshift-ovn-kubernetes rsh $newpod ovn-nbctl --no-leader-only get nb_global . ipsec)
    echo $IPSEC
    if [[ $IPSEC == *"true"* ]];
    then
        echo -e "\033[32mIPSEC is enabled in pod - $newpod\033[0m"
    else
        echo -e "\033[31mIPSEC is not enabled in pod - $newpod\033[31m"
    fi
    echo "----------"
done

echo ""
echo ""

echo -e "\033[33mEnabling etcd encryption with AES-CBC\033[31m"


kubectl patch apiserver $(oc get apiserver | grep cluster | cut -d " " -f 1) --type=json -p '[
   {
      "op":"add",
      "path": "/spec",
      "value": {encryption: {type: aescbc}}
   },
]'

echo ""
echo ""

echo -e "\033[31mNOTE : Depending on the size of your cluster, it can take 20 minutes or longer for the encryption process to complete.\033[31m"

until [[ $(oc get openshiftapiserver -o=jsonpath='{range .items[0].status.conditions[?(@.type=="Encrypted")]}{.reason}{"\n"}{.message}{"\n"}' | grep En) == "EncryptionCompleted" && $(oc get kubeapiserver -o=jsonpath='{range .items[0].status.conditions[?(@.type=="Encrypted")]}{.reason}{"\n"}{.message}{"\n"}' | grep En) == "EncryptionCompleted" && $(oc get authentication.operator.openshift.io -o=jsonpath='{range .items[0].status.conditions[?(@.type=="Encrypted")]}{.reason}{"\n"}{.message}{"\n"}' | grep En) == "EncryptionCompleted" ]]
do
    echo -e "\033[36m Waiting for the Encryption to be completed ... \033[31m"
    sleep 2
    echo ""
done
echo ""
echo -e "\033[32m#### FIPS WALL is enabled successfully on to this OCP ####\033[0m"

3. When we run baw-clusteradmin.sh script, script checks whether cluster is enabled with FIPS as below

4. Post checking whether cluster enabled with FIPS, it will create a config-map which saves the fips status

5. When we run baw-prerequisite.sh script, it will give us a message to make sure that FIPS_Wall also needed to be created to achieve FIPS compliance.

6. In property file baw_user_profile.property , entry related to FIPS needed to be filled as below. By default value will be false.

7. Finally when CR gets generated, value for “enable_fips : “ should be set as true automatically.

Enabling FIPS on non-OCP clusters (RHEL machine)

1. Enable FIPS mode:

• To enable FIPS mode in cluster run : sudo fips-mode-setup --enable

• This will add fips=1 to the kernel boot arguments

• Will configure the system for FIPS mode

2. System needed to be rebooted:

• To reboot run : sudo reboot

3. Verify after reboot

• To verify after rebooting, run : fips-mode-setup --check

• cat /proc/sys/crypto/fips_enabled => Here value should see as 1

4. In baw_user_profile.property, entry for FIPS should be made as true.

5. During validation, make sure all databases are getting connected and supported with FIPS. For Oracle external Database, ciphers needed to be changed which support FIPS.

6. Finally in generated Custom Resource, FIPS parameter should be enabled as edited in property file.

Useful links:

Documentation : https://ibmdocs-test.dcs.ibm.com/docs/en/baw_25.0.1_test?topic=overview-fips-compliance

FIPS Semeru Documentation : FIPS 140-3 cryptography in IBM Semeru Runtimes

Acknowledgment :  My Sincere thanks to @Jens Engelke who helped me in adding more inputs, correcting and Reviewing this blog.