Obtaining a FIPS-capable installation program using oc adm extract

You must get a FIPS-capable installation binary to install a Red Hat OpenShift Container Platform cluster in FIPS mode. Extract the binary from the release image by using the OpenShift CLI (oc). After you get the binary, you must proceed with the cluster installation, replacing all instances of the openshift-install command with openshift-install-fips.

Prerequisites

  • You have installed the OpenShift CLI (oc) with version 4.16 or newer.

Procedure

  1. Extract the FIPS-capable binary from the installation program by running the following command:

    $ oc adm release extract --registry-config "${pullsecret_file}" --command=openshift-install-fips --to "${extract_dir}" ${RELEASE_IMAGE}

    where:

    <pullsecret_file>

    Specifies the name of a file that contains your pull secret.

    <extract_dir>

    Specifies the directory where you want to extract the binary.

    <RELEASE_IMAGE>

    Specifies the Quay.io URL of the Red Hat OpenShift Container Platform release you are using. For more information on finding the release image, see Extracting the Red Hat OpenShift Container Platform installation program.

  2. Proceed with cluster installation, replacing all instances of the openshift-install command with openshift-install-fips.

↑ Up: Enable FIPS mode on your nodes | ⌂ Home: Red Hat OpenShift Container Platform | Next: Obtaining a FIPS-capable installation program using the public OpenShift mirror →