FIPS-compliant installation

Configure Istio components to enforce FIPS cryptographic standards.

FIPS-compliant mode configures Istio components to enforce FIPS cryptographic standards. This is required for deployments in regulated environments.

This topic covers how you enable FIPS mode with either helm or clustermgr, and how you override the default compliance policy.

REVIEW BOTH CONSTRAINTS BEFORE YOU ENABLE FIPS

• Istio ingress is mandatory: FIPS mode requires Istio as the ingress type. The default nginx ingress controller does not support FIPS-compliant operation.

• Enablement is permanent: Once FIPS mode is enabled (fips: true), reverting it to false is not supported.

---

Enabling FIPS Mode

Enable FIPS mode at install time by setting the ingress type to Istio and turning on the fips input.

helm

FIPS mode requires Istio ingress. Reuse the same Istio scenario files from Install with Istio, and add FIPS in your base override.yaml:

cluster:
  tfi:
    ingressType: istio
    fips: true

clustermgr

FIPS mode requires Istio ingress. Reuse the same Istio scenario parameters from Install with Istio, and add -i fips=true:

./clustermgr install-pi \
  --dns <DNS> \
  --email <EMAIL> \
  --password '<PASSWORD>' \
  --version <WORKFLOW_VERSION> \
  -i ingressType=istio \
  -i fips=true

When Istio is deployed by the Harness SMP Operator, this sets the COMPLIANCE_POLICY environment variable on both istiod (pilot) and istio-ingressgateway pods. The default compliance policy is fips-140-2.

Overriding the Compliance Policy

If your environment requires a standard other than the fips-140-2 default, set the compliance policy explicitly.

helm

Set a different compliance policy in values.yaml:

cluster:
  tfi:
    fipsCompliancePolicy: fips-140-3

clustermgr

Pass the desired compliance policy:

-i fipsCompliancePolicy=fips-140-3

Input	Helm value	clustermgr input	Default	Description
fips	cluster.tfi.fips	-i fips=true	false	Enable FIPS-compliant mode
fipsCompliancePolicy	cluster.tfi.fipsCompliancePolicy	-i fipsCompliancePolicy=<policy>	fips-140-2	FIPS compliance policy for Istio components

For more information on FIPS compliance in Harness, see Harness FIPS Overview.