You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
* xref:redpanda-cloud:get-started:cloud-overview.adoc#redpanda-cloud-vs-self-managed-feature-compatibility[Redpanda Cloud vs Self-Managed feature compatibility]
9
9
10
+
== FIPS 140-3 validation and FIPS Docker image
11
+
12
+
Redpanda's cryptographic module has been upgraded from FIPS 140-2 to https://csrc.nist.gov/pubs/fips/140-3/final[FIPS 140-3^] validation. Additionally, Redpanda now provides a FIPS-specific Docker image (`docker.redpanda.com/redpandadata/redpanda:<version>-fips`) for `amd64` and `arm64` architectures, with the required OpenSSL FIPS module pre-configured.
13
+
14
+
NOTE: If you are upgrading with FIPS mode enabled, ensure all SASL/SCRAM user passwords are at least 14 characters before upgrading. FIPS 140-3 enforces stricter HMAC key size requirements.
15
+
16
+
See xref:manage:security/fips-compliance.adoc[] for configuration details.
17
+
10
18
== Iceberg: Expanded JSON Schema support
11
19
12
20
Redpanda now supports additional JSON Schema patterns when translating to Iceberg tables:
:description: Configure Redpanda to operate in FIPS compliance mode.
1
+
= Configure Redpanda for FIPS
2
+
:description: Configure Redpanda to operate in FIPS-compliant mode.
3
3
:page-aliases: security:fips-compliance.adoc
4
+
:page-topic-type: how-to
5
+
:personas: platform_operator
6
+
:learning-objective-1: Configure a Redpanda broker to run in FIPS-compliant mode
7
+
:learning-objective-2: Set the required OpenSSL properties for FIPS mode
8
+
:learning-objective-3: Deploy Redpanda in FIPS-compliant mode using Docker
4
9
5
-
Redpanda provides FIPS-compliant cipher enforcement for brokers using OpenSSL 3.0.9, which is https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/4282[validated^] for https://csrc.nist.gov/pubs/fips/140-2/upd2/final[140-2^] and is undergoing validation by NIST for https://csrc.nist.gov/pubs/fips/140-3/final[140-3^]. Both Redpanda and `rpk` leverage validated OpenSSL libraries for all security-related cryptography operations.
10
+
Redpanda provides Federal Information Processing Standards (FIPS)-compliant cipher enforcement for brokers using a https://csrc.nist.gov/pubs/fips/140-3/final[FIPS 140-3^]-validated OpenSSL cryptographic module. Redpanda and `rpk` both use the OpenSSL library for security-related cryptographic operations.
11
+
12
+
After reading this page, you will be able to:
13
+
14
+
* [ ] {learning-objective-1}
15
+
* [ ] {learning-objective-2}
16
+
* [ ] {learning-objective-3}
6
17
7
18
[NOTE]
8
19
====
@@ -18,19 +29,27 @@ rpk cluster license info
18
29
19
30
== Prerequisites
20
31
21
-
Before configuring brokers to run in FIPS compliance mode (FIPS mode), check to make sure the `redpanda-rpk-fips` and `redpanda-fips` packages are xref:deploy:deployment-option/self-hosted/manual/production/production-deployment.adoc#install-redpanda-for-fips-compliance[installed]. These packages are required by both the `redpanda` and `redpanda-tuner` install packages.
32
+
Before configuring brokers to run in FIPS mode on Linux, install the `redpanda-rpk-fips` and `redpanda-fips` xref:deploy:redpanda/manual/production/production-deployment.adoc#install-redpanda-for-fips-compliance[packages].
33
+
34
+
For Docker deployments, use the FIPS-specific image instead: `docker.redpanda.com/redpandadata/redpanda:<version>-fips`.
35
+
36
+
[WARNING]
37
+
====
38
+
Before upgrading to Redpanda 26.1 with FIPS mode enabled, change any SASL/SCRAM user passwords shorter than 14 characters to at least 14 characters. FIPS 140-3 enforces stricter HMAC key size requirements than FIPS 140-2. Because Redpanda stores passwords in encrypted form, it cannot check the length of existing passwords. Clients with passwords shorter than 14 characters will fail to authenticate after the upgrade.
39
+
====
22
40
23
41
== Limitations
24
42
25
-
- Redpanda is not fully FIPS-compliant when used with the Redpanda Helm chart and Operator in a Kubernetes deployment.
43
+
- Redpanda FIPS mode requires a FIPS-enabled host when deployed with the Redpanda Helm chart or Operator.
26
44
- Redpanda Console is not FIPS-compliant.
27
-
- PKCS#12 keys for xref:manage:security/encryption.adoc[TLS encryption] are not supported when FIPS mode is enabled in Redpanda. The PKCS12KDF algorithm used in PKCS#12 is not FIPS-compliant. To use Redpanda in FIPS mode with TLS enabled, configure your certificates and keys in PEM format instead.
45
+
- Redpanda does not support PKCS#12 keys for xref:manage:security/encryption.adoc[TLS encryption] when FIPS mode is enabled. The PKCS12KDF algorithm used in PKCS#12 is not FIPS-compliant. To use Redpanda in FIPS mode with TLS enabled, configure your certificates and keys in PEM format instead.
46
+
- When FIPS mode is `enabled` or `permissive`, SASL/SCRAM passwords must be at least 14 characters.
28
47
29
48
== Configure FIPS mode
30
49
31
50
When you configure a broker to run in FIPS mode:
32
51
33
-
* FIPS compliance is enforced _immediately_ upon the startup of Redpanda.
52
+
* Redpanda enforces FIPS compliance _immediately_ on startup.
34
53
35
54
* Redpanda and its dependencies only use FIPS-validated cryptographic modules for all cryptographic algorithms used in a security context.
36
55
@@ -42,43 +61,100 @@ Redpanda logs an error and exits immediately if:
42
61
43
62
* It cannot detect a FIPS-validated library.
44
63
45
-
To place a broker in FIPS compliance mode, enable xref:reference:properties/broker-properties.adoc#fips_mode[`fips_mode`] in the Redpanda broker configuration file (typically located in `/etc/redpanda/redpanda.yaml`). All fields are within the `redpanda` object:
64
+
To place a broker in FIPS-compliant mode, enable xref:reference:properties/broker-properties.adoc#fips_mode[`fips_mode`] in the Redpanda broker configuration file (typically located in `/etc/redpanda/redpanda.yaml`). All fields are within the `redpanda` object:
46
65
47
-
```yaml
66
+
[,yaml]
67
+
----
48
68
redpanda:
49
69
# ....
50
70
fips_mode: enabled
51
-
```
71
+
----
52
72
53
73
Available `fips_mode` values are:
54
74
55
-
* `disabled`: Redpanda is not running in FIPS compliance mode.
75
+
* `disabled`: Redpanda is not running in FIPS-compliant mode.
56
76
57
77
* `enabled`: When Redpanda starts up, it looks for a value of `1` in the file `/proc/sys/crypto/fips_enabled`. If the file doesn't exist or doesn't contain `1`, Redpanda logs an error and exits immediately.
58
78
59
-
* `permissive`: This setting is a safety value option only, and _should not be used in a production environment_. If specified, Redpanda logs a WARNING, but continues operations even if the underlying operating system is not configured for FIPS. If set, your Redpanda instance is _not_ running in FIPS compliance mode.
79
+
* `permissive`: This setting is a safety value option only. Do not use it in a production environment. If specified, Redpanda logs a WARNING, but continues operations even if the underlying operating system is not configured for FIPS. If set, your Redpanda instance is _not_ running in FIPS-compliant mode.
80
+
81
+
You must also configure OpenSSL properties for FIPS mode.
60
82
61
83
=== FIPS OpenSSL configuration
62
84
63
-
You must specify the following SSL configurations for brokers you want to run in FIPS compliance mode:
85
+
You must specify the following SSL configurations for brokers you want to run in FIPS-compliant mode:
64
86
65
-
* xref:reference:properties/broker-properties.adoc#openssl_config_file[`openssl_config_file`]: Specifies the path to the OpenSSL configuration file that was created as part of the `redpanda-fips` package installation. This file is used when OpenSSL is initialized to find the `fipsmodule.cnf` file that was created by the `openssl fipsinstall` command. Typically, this value should be `/opt/redpanda/openssl/openssl.cnf`.
87
+
* xref:reference:properties/broker-properties.adoc#openssl_config_file[`openssl_config_file`]: Specifies the path to the OpenSSL configuration file created during `redpanda-fips` package installation. OpenSSL uses this file during initialization to find the `fipsmodule.cnf` file that `openssl fipsinstall` creates. Typically, this value is `/opt/redpanda/openssl/openssl.cnf`.
66
88
67
-
* xref:reference:properties/broker-properties.adoc#openssl_module_directory[`openssl_module_directory`]: Specifies the path to the directory that contains the `fips.so` cryptographic provider. Typically, this value should be: `/opt/redpanda/lib/ossl-modules/`.
89
+
* xref:reference:properties/broker-properties.adoc#openssl_module_directory[`openssl_module_directory`]: Specifies the path to the directory that contains the `fips.so` cryptographic provider. Typically, this value is: `/opt/redpanda/lib/ossl-modules/`.
68
90
+
69
-
The following configuration starts Redpanda in FIPS mode:
91
+
The following configuration starts Redpanda in FIPS mode:
* xref:deploy:deployment-option/self-hosted/manual/production/production-deployment.adoc#install-redpanda-for-fips-compliance[Install Redpanda for FIPS Compliance]
82
-
* https://github.com/openssl/openssl/blob/openssl-3.0.9/README-FIPS.md[OpenSSL FIPS Readme^]
* https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp4282.pdf[OpenSSL FIPS Security Policy^]
100
+
----
101
+
102
+
== Configure FIPS mode with Docker
103
+
104
+
The Redpanda FIPS Docker image (`docker.redpanda.com/redpandadata/redpanda:<version>-fips`) is available for `amd64` and `arm64` architectures. The image includes the required OpenSSL files, pre-configured.
105
+
106
+
Pass the FIPS broker configuration to the container the same way as any other Redpanda Docker deployment: either by mounting a configuration file or by passing settings as flags.
107
+
108
+
[tabs]
109
+
======
110
+
Mount a configuration file::
111
+
+
112
+
--
113
+
. Create a `redpanda.yaml` with the required FIPS settings:
0 commit comments