Enabling FIPS support for WebSphere Automation

Enabling FIPS support when installing Red Hat OpenShift Container Platform and storage

Enable FIPS support for your Red Hat OpenShift Container Platform cluster.

You must enable FIPS support on yourRed Hat OpenShift Container Platform cluster before you install WebSphere Automation. When you install WebSphere Automation, the installation process detects whether FIPS support is enabled on your Red Hat OpenShift Container Platform cluster. If FIPS is enabled on Red Hat OpenShift Container Platform, FIPS support is automatically enabled for WebSphere Automation.

Complete the following tasks while you install Red Hat OpenShift Container Platform:

1. Enable FIPS mode on all of your nodes. For more information, see the Red Hat OpenShift Container Platform documentation about Support for FIPS cryptography .
2. Install Red Hat OpenShift Container Platform in FIPS mode. For more information, see the Red Hat OpenShift Container Platform documentation about Installing a cluster in FIPS mode .
   Restriction: FIPS is supported only on x86_64 hardware.
3. Configure TLS protection for your node-to-node communication. Node-to-node communication must be TLS protected at all times.

   Configure IPSec tunnels for communication between nodes in your cluster. IPSec is the validated and recommended method for implementing security across nodes for WebSphere Automation. If you require a different method to secure your nodes, you can use your preferred method.

   With IPsec enabled, all network traffic between nodes on the OVN-Kubernetes Container Network Interface (CNI) cluster network travels through an encrypted tunnel. IPsec is disabled by default when you install OpenShift 4.x clusters. IPsec encryption can be enabled only during cluster installation and cannot be disabled after it is enabled.

   For more information about configuring IPsec encryption on Red Hat OpenShift Container Platform, see the Red Hat OpenShift Container Platform documentation about Configuring IPsec encryption .

Enabling FIPS support for your storage

If your deployment's storage must be FIPS compliant, enable any FIPS settings and support for your chosen storage. Refer to your storage provider's documentation to ensure that your storage meets this requirement.

Red Hat OpenShift Data Foundation and FIPS

Red Hat OpenShift Data Foundation uses FIPS 140-2 certified cryptographic modules. You must use cluster wide encryption, and not encrypt persistent volumes individually. This is because Red Hat OpenShift Data Foundation persistent volume encryption is only available for block storage, and one of the components of WebSphere Automation, Zen, requires file storage. For more information, see the topic Cluster-wide encryption in the Red Hat OpenShift Data Foundation documentation .

Portworx and FIPS

Portworx uses FIPS 140-2 certified cryptographic modules. Portworx can encrypt each of the persistent volumes individually, or can encrypt the whole storage cluster. For more information, see the topic Create encrypted PVCs in the Portworx documentation

Configuring etcd encryption

To enable etcd encryption with AES-CBC (that is, Advanced Encryption Standard Cipher Block Chaining), complete the following steps:

1. Modify the APIServer object.

   oc edit apiserver

2. Set the encryption field type to aescbc.

   spec:
     encryption:
       type: aescbc

3. Save the file to apply the changes. Depending on the size of your cluster, it can take 20 minutes or longer for the encryption process to complete.
4. Verify that the etcd encryption is successful.
   1. Review the Encrypted status condition for the OpenShift API server to verify that its resources were successfully encrypted by running the following command:

      oc get openshiftapiserver -o=jsonpath='{range .items[0].status.conditions[?(@.type=="Encrypted")]}{.reason}{"\n"}{.message}{"\n"}'

   The output shows EncryptionCompleted upon successful encryption:

   EncryptionCompleted
   All resources encrypted: routes.route.openshift.io

For more information, see Encrypting etcd data .

Enabling FIPS support when installing WebSphere Automation

With your storage configured, continue your installation of WebSphere Automation on your cluster.

Ensure that you complete the required installation tasks for compliance while you are installing WebSphere Automation. These tasks must be completed while you are initially installing WebSphere Automation.

For more information about, and instructions, for installing WebSphere Automation, see Installing WebSphere Automation.

Important: You must ensure that you have run the Verify the installation step for your chosen installation method, and that your deployment is healthy before you proceed.

Change Cloud Pak administration console certificates

It might also be necessary to change the certificates for the cp-console (the foundational service for the WebSphere Automation UI) in the ibm-common-services namespace to support FIPS. For more information, see Updating custom hostname and TLS secret by using a configmap.

Enable two-factor authentication (2FA)

To secure your environment with multi-factor authentication, you can configure single sign-on (SSO) between WebSphere Automation and an identity provider that supports 2FA, such as IBM Security Verify. The identity provider's 2FA mechanism can then be used to authenticate WebSphere Automation user login. Consult your chosen identity provider's documentation to setup 2FA.

For more information, see Configuring single sign-on.

For more information about IBM Security Verify, see IBM Security Verify.

Blog: A blog that provides an example of setting up single sign-on between a IBM Cloud Pak and IBM Security Verify is here: Tutorial: IBM Cloud Pak single sign-on (SSO) integration with IBM Security Verify .