// Module included in the following assemblies:
//
// assembly-using-the-cluster-operator.adoc

[id='proc-configuring-fips-mode-cluster-operator-{context}']
= Configuring FIPS mode in the Cluster Operator

[role="_abstract"]
Federal Information Processing Standards (FIPS) are standards for computer security and interoperability.
When running Strimzi on a FIPS-enabled Kubernetes cluster, the OpenJDK used in Strimzi container images will automatically switch to FIPS mode.
This prevents Strimzi from running on the cluster.
When you deploy Strimzi to the cluster, you will see errors similar to the following:

[source%nowrap]
----
Exception in thread "main" io.fabric8.kubernetes.client.KubernetesClientException: An error has occurred.
	...
Caused by: java.security.KeyStoreException: sun.security.pkcs11.wrapper.PKCS11Exception: CKR_SESSION_READ_ONLY
	...
Caused by: sun.security.pkcs11.wrapper.PKCS11Exception: CKR_SESSION_READ_ONLY
	...
----

If you want to run Strimzi on your FIPS-enabled cluster, you can disable the OpenJDK FIPS mode by setting the `FIPS_MODE` environment variable to `disabled` in the deployment configuration for the Cluster Operator.
The Strimzi deployment won't be FIPS compliant, but the Strimzi operators as well as all its operands will be able to run on the FIPS-enabled Kubernetes cluster.

.Procedure

. To disable the FIPS mode in the Cluster Operator, update its `Deployment` configuration (`install/cluster-operator/060-Deployment-strimzi-cluster-operator.yaml`) and add the `FIPS_MODE` environment variable.
+
--
.Example FIPS configuration for the Cluster Operator
[source,yaml,subs="+quotes,attributes"]
----
apiVersion: apps/v1
kind: Deployment
spec:
  # ...
  template:
    spec:
      serviceAccountName: strimzi-cluster-operator
      containers:
        # ...
        env:
        # ...
        - name: "FIPS_MODE"
          value: "disabled" # <1>
  # ...
----
<1> Disables the FIPS mode.
--
+
Alternatively, edit the `Deployment` directly:
+
[source,shell,subs=+quotes]
----
kubectl edit deployment strimzi-cluster-operator
----

. If you updated the YAML file instead of editing the `Deployment` directly, apply the changes:
+
[source,shell,subs=+quotes]
----
kubectl apply -f install/cluster-operator/060-Deployment-strimzi-cluster-operator.yaml
----

[role="_additional-resources"]
.Additional resources

* link:https://www.nist.gov/standardsgov/compliance-faqs-federal-information-processing-standards-fips[What are Federal Information Processing Standards (FIPS)^]
