fips-compliance
Installation
SKILL.md
FIPS Compliance
Guidance for enforcing Federal Information Processing Standards (FIPS) 140-2 and 140-3 across RHEL/RHCOS nodes, OpenShift clusters, Go applications, and container workloads. For general algorithm guidance and post-quantum readiness, see algorithm-selection. For TLS version and cipher suite enforcement on Kubernetes, see tls-compliance.
FIPS Mode Enforcement
| Layer | Mechanism | Validation Command |
|---|---|---|
| RHCOS/RHEL kernel | fips=1 boot parameter |
cat /proc/sys/crypto/fips_enabled returns 1 |
| RHEL crypto policy | update-crypto-policies --set FIPS |
update-crypto-policies --show returns FIPS |
| OpenShift cluster | fips: true in install-config.yaml |
oc get cm -n openshift-config -o jsonpath='{.items[*].data.install-config}' |
| etcd encryption | aescbc or aesgcm encryption type |
See etcd Encryption at Rest verification commands |
Critical: OpenShift FIPS mode must be enabled at install time — it cannot be enabled post-deployment. The installer must run from a RHEL host already in FIPS mode, using the
openshift-install-fipsbinary extracted from the release image.
SSH keys: Do not use ed25519 keys when installing a FIPS-enabled cluster. ed25519 is not FIPS-approved — use RSA instead.