Is Strimzi FIPS compliant?

[johnatannvmd]

Hello,

Is Strimzi uses JRE for Kafka with FIPS compliance enabled? How can we enable this if not? By FIPS I mean:
https://docs.oracle.com/middleware/1213/wls/SECMG/fips.htm#SECMG771
https://en.wikipedia.org/wiki/FIPS_140-2

[scholzj]

We use OpenJDK and not Oracle JDK. So I'm not sure how much the link applies or whether it is different. I do not think we did anything special with regards to FIPS. But if you explain how should it work and be set up, we can see if this is something what could be done easily or not.

[johnatannvmd]

Looks like that is enough to configure JRE to use Bouncy Castle FIPS JSSE Security Provider (BCFKS)(Apache Software License, Version 1.1) as a Keystore to pass FIPS compliance checks.
https://docs.confluent.io/platform/current/security/compliance.html#confluent-platform-fips-140-2

Also, look like elasticsearch done this for testing with some parameters: https://github.com/elastic/elasticsearch/pull/48378/files

I'm deeply sorry, I'm not a Java guy and just do not know how it's done for the Java world.

If this impossible or we should do this by configuration, please point me to the docs. Maybe I missed something.

[scholzj]

Confluent Platform is not the same as Apache Kafka. So it is not clear if that so easy to use also in regular Kafka or if they have some private improvements. So I guess this would need to be looked into a bit more.

[scholzj]

If you want, feel free to open an issue to have it tracked.