Skip to main content

FIPS-compliant installation

Last updated on

FIPS-compliant mode configures Istio components to enforce FIPS cryptographic standards. This is required for deployments in regulated environments.

This topic covers how you enable FIPS mode with either helm or clustermgr, and how you override the default compliance policy.

Review both constraints before you enable FIPS
  • Istio ingress is mandatory: FIPS mode requires Istio as the ingress type. The default nginx ingress controller does not support FIPS-compliant operation.
  • Enablement is permanent: Once FIPS mode is enabled (fips: true), reverting it to false is not supported.

Enabling FIPS Mode​

Enable FIPS mode at install time by setting the ingress type to Istio and turning on the fips input.

FIPS mode requires Istio ingress. Reuse the same Istio scenario files from Install with Istio, and add FIPS in your base override.yaml:

cluster:
  tfi:
    ingressType: istio
    fips: true

When Istio is deployed by the Harness SMP Operator, this sets the COMPLIANCE_POLICY environment variable on both istiod (pilot) and istio-ingressgateway pods. The default compliance policy is fips-140-2.

Overriding the Compliance Policy​

If your environment requires a standard other than the fips-140-2 default, set the compliance policy explicitly.

Set a different compliance policy in values.yaml:

cluster:
  tfi:
    fipsCompliancePolicy: fips-140-3
InputHelm valueclustermgr inputDefaultDescription
fipscluster.tfi.fips-i fips=truefalseEnable FIPS-compliant mode
fipsCompliancePolicycluster.tfi.fipsCompliancePolicy-i fipsCompliancePolicy=<policy>fips-140-2FIPS compliance policy for Istio components

For more information on FIPS compliance in Harness, see Harness FIPS Overview.