STIGQter: STIG Summary: Red Hat OpenShift Container Platform 4.x Security Technical Implementation Guide Version: 2 Release: 6 Benchmark Date: 01 Jul 2026:

OpenShift must protect authenticity of communications sessions with the use of FIPS-validated 140-2 or 140-3 validated cryptography.

DISA Rule

SV-257546r1043178_rule

Vulnerability Number

V-257546

Group Title

SRG-APP-000219-CTR-000550

Rule Version

CNTR-OS-000510

Severity

CAT I

CCI(s)

• CCI-001184 - Protect the authenticity of communications sessions.
• CCI-001350 - Implement cryptographic mechanisms to protect the integrity of audit information.
• CCI-002450 - Implement organization-defined types of cryptography for each specified cryptography use.
• CCI-002890 - Implement organization-defined cryptographic mechanisms to protect the integrity of nonlocal maintenance and diagnostic communications.
• CCI-003123 - Implement organization-defined cryptographic mechanisms to protect the confidentiality of nonlocal maintenance and diagnostic communications.

Weight

10

Fix Recommendation

Reinstall the OpenShift cluster in FIPS mode. The file install-config.yaml has a top-level key that enables FIPS mode for all nodes and the cluster platform layer. If the install-config.yaml was not backed up prior to consumption as part of the installation, recreate it. An example install-config.yaml with some sections trimmed out for brevity, and the "fips: true" key applied at the top level is shown below:

apiVersion: v1
baseDomain: example.com
controlPlane:
name: master
platform:
aws:
[...]
replicas: 3
compute:
- name: worker
platform:
aws:
replicas: 3
metadata:
name: fips-cluster
networking:
[...]
platform:
aws:
[...]
sshKey: ssh-ed25519 AAAA...
pullSecret: '{"auths": ...}'
fips: true

Once the install-config.yaml is saved with corresponding correct information for the installation infrastructure, run the installer to create a cluster that uses FIPS Validated/Modules in Process cryptographic libraries. The command to install a cluster and consume the install-config.yaml is:
> ./openshift-install create cluster --dir=<installation_directory> --log-level=info
Where <installation_directory> is the directory that contains install-config.yaml

Additional details can be found here: https://docs.openshift.com/container-platform/4.8/installing/installing-fips.html

Check Contents

To validate the OpenShift cluster is running with FIPS enabled on each node by executing the following:

for node in $(oc get node -oname); do oc debug $node -- chroot /host /bin/bash -c 'echo -n "$HOSTNAME "; sysctl crypto.fips_enabled' 2>/dev/null; done

If any lines of output end in anything other than 1, this is a finding.

Vulnerability Number

V-257546

Documentable

False

Rule Version

CNTR-OS-000510

Severity Override Guidance

To validate the OpenShift cluster is running with FIPS enabled on each node by executing the following:

for node in $(oc get node -oname); do oc debug $node -- chroot /host /bin/bash -c 'echo -n "$HOSTNAME "; sysctl crypto.fips_enabled' 2>/dev/null; done

If any lines of output end in anything other than 1, this is a finding.

Check Content Reference

M

Target Key

5547