> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/self-managed-enterprise-edition/use-self-managed-enterprise-edition/smp-installationupgrade/operator-installation/install/fips-compliant-installation.md).

# FIPS-compliant installation

FIPS-compliant mode configures Istio components to enforce FIPS cryptographic standards. This is required for deployments in regulated environments.

This topic covers how you enable FIPS mode with either helm or clustermgr, and how you override the default compliance policy.

{% hint style="warning" %}
**REVIEW BOTH CONSTRAINTS BEFORE YOU ENABLE FIPS**

* **Istio ingress is mandatory**: FIPS mode requires **Istio** as the ingress type. The default nginx ingress controller does not support FIPS-compliant operation.
* **Enablement is permanent**: Once FIPS mode is enabled (`fips: true`), reverting it to `false` is not supported.
  {% endhint %}

***

### Enabling FIPS Mode <a href="#enabling-fips-mode" id="enabling-fips-mode"></a>

Enable FIPS mode at install time by setting the ingress type to Istio and turning on the `fips` input.

{% tabs %}
{% tab title="helm" %}
FIPS mode requires **Istio** ingress. Reuse the same Istio scenario files from [Install with Istio](/self-managed-enterprise-edition/use-self-managed-enterprise-edition/smp-installationupgrade/operator-installation/install/install-with-smp-operator.md#install-with-istio), and add FIPS in your base `override.yaml`:

```yaml
cluster:
  tfi:
    ingressType: istio
    fips: true
```

{% endtab %}

{% tab title="clustermgr" %}
FIPS mode requires **Istio** ingress. Reuse the same Istio scenario parameters from [Install with Istio](/self-managed-enterprise-edition/use-self-managed-enterprise-edition/smp-installationupgrade/operator-installation/install/install-with-smp-operator.md#install-with-istio), and add `-i fips=true`:

```bash
./clustermgr install-pi \
  --dns <DNS> \
  --email <EMAIL> \
  --password '<PASSWORD>' \
  --version <WORKFLOW_VERSION> \
  -i ingressType=istio \
  -i fips=true
```

{% endtab %}
{% endtabs %}

When Istio is deployed by the Harness SMP Operator, this sets the `COMPLIANCE_POLICY` environment variable on both `istiod` (pilot) and `istio-ingressgateway` pods. The default compliance policy is `fips-140-2`.

#### Overriding the Compliance Policy <a href="#overriding-the-compliance-policy" id="overriding-the-compliance-policy"></a>

If your environment requires a standard other than the `fips-140-2` default, set the compliance policy explicitly.

{% tabs %}
{% tab title="helm" %}
Set a different compliance policy in `values.yaml`:

```yaml
cluster:
  tfi:
    fipsCompliancePolicy: fips-140-3
```

{% endtab %}

{% tab title="clustermgr" %}
Pass the desired compliance policy:

```bash
-i fipsCompliancePolicy=fips-140-3
```

{% endtab %}
{% endtabs %}

| Input                  | Helm value                         | clustermgr input                   | Default      | Description                                 |
| ---------------------- | ---------------------------------- | ---------------------------------- | ------------ | ------------------------------------------- |
| `fips`                 | `cluster.tfi.fips`                 | `-i fips=true`                     | `false`      | Enable FIPS-compliant mode                  |
| `fipsCompliancePolicy` | `cluster.tfi.fipsCompliancePolicy` | `-i fipsCompliancePolicy=<policy>` | `fips-140-2` | FIPS compliance policy for Istio components |

For more information on FIPS compliance in Harness, see [Harness FIPS Overview](/self-managed-enterprise-edition/use-self-managed-enterprise-edition/smp-fips-overview.md).