[ANSIENG-5777] Add FIPS mode configuration and kernel-level FIPS support #2394
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…pport - Add fips_mode variable to configure FIPS 140-2 or FIPS 140-3 - Add fips_kernel_level_enabled flag for kernel-level FIPS enforcement - Add fips_reboot_timeout variable for reboot timeout configuration - Add validation for fips_mode values (fips-140-2, fips-140-3) - Implement kernel-level FIPS setup with fips-mode-setup command - Add automatic reboot and wait logic when kernel FIPS is enabled - Configure enable.fips.mode property for kafka_controller and kafka_broker
…block Remove kernel-level FIPS setup that required system reboot and fips-mode-setup --enable command. This simplifies FIPS configuration by only managing crypto policies without kernel-level enforcement. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <[email protected]>
Updates FIPS molecule test scenarios to use LDAPS (ldaps://ldap1:636) instead of plain LDAP (ldap://ldap1:389) for enhanced security. Configures custom SSL certificates for LDAP server and updates verification tests accordingly.
…broker/controller to prevent cert overwrite
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
This PR adds support for configuring FIPS mode level (140-2 or 140-3) and kernel-level FIPS enforcement.
Changes
fips_modevariable to configure FIPS 140-2 or FIPS 140-3 (defaults to fips-140-3 for CP 8.2+)fips_kernel_level_enabledflag for kernel-level FIPS enforcement (defaults to false)fips_reboot_timeoutvariable for reboot timeout configuration (defaults to 600 seconds)fips_modevalues to ensure only valid values (fips-140-2, fips-140-3) are acceptedfips-mode-setup --enablecommandenable.fips.modeproperty for kafka_controller and kafka_brokerTesting
JIRA
https://confluentinc.atlassian.net/browse/ANSIENG-5777