// This module is included in the following assemblies:
//
// assembly-upgrade.adoc

[id='proc-reenabling-FIPS-mode-{context}']
= Switching to FIPS mode when upgrading Strimzi

[role="_abstract"]
Upgrade Strimzi to run in FIPS mode on FIPS-enabled Kubernetes clusters. 
Until Strimzi 0.33, running on FIPS-enabled Kubernetes clusters was possible only by disabling FIPS mode using the `FIPS_MODE` environment variable.
From release 0.33, Strimzi supports FIPS mode.
If you run Strimzi on a FIPS-enabled Kubernetes cluster with the `FIPS_MODE` set to `disabled`, you can enable it by following this procedure.

.Prerequisites

* FIPS-enabled Kubernetes cluster
* An existing Cluster Operator deployment with the `FIPS_MODE` environment variable set to `disabled`

.Procedure

. Upgrade the Cluster Operator to version 0.33 or newer but keep the `FIPS_MODE` environment variable set to `disabled`.

. If you initially deployed a Strimzi version older than 0.30, it might use old encryption and digest algorithms in its PKCS #12 stores, which are not supported with FIPS enabled.
  To recreate the certificates with updated algorithms, renew the cluster and clients CA certificates.

.. To renew the CAs generated by the Cluster Operator, xref:proc-renewing-ca-certs-manually-str[add the `force-renew` annotation to the CA secrets to trigger a renewal].
	
.. To renew your own CAs, xref:renewing-your-own-ca-certificates-str[add the new certificate to the CA secret and update the `ca-cert-generation` annotation with a higher incremental value to capture the update].

. If you use SCRAM-SHA-512 authentication, check the password length of your users.
  If they are less than 32 characters long, generate a new password in one of the following ways:
  
.. Delete the user secret so that the User Operator generates a new one with a new password of sufficient length.

.. If you provided your password using the `.spec.authentication.password` properties of the `KafkaUser` custom resource, update the password in the Kubernetes secret referenced in the same password configuration.
   Don't forget to update your clients to use the new passwords.

. Ensure that the CA certificates are using the correct algorithms and the SCRAM-SHA-512 passwords are of sufficient length.
  You can then enable the FIPS mode.
  
. Remove the `FIPS_MODE` environment variable from the Cluster Operator deployment.
  This restarts the Cluster Operator and rolls all the operands to enable the FIPS mode.
  After the restart is complete, all Kafka clusters now run with FIPS mode enabled.
