Cloudera Docs

Deploying Cloudera Flow Management on FIPS 140-3-enabled clusters

nvironments. Cloudera Flow Management can run on FIPS-enabled operating systems and FIPS 140-3-validated cryptographic modules. Additional configuration is required to deploy and run Cloudera Flow Management in a FIPS 140-3-enabled environment.

This guide provides the required steps on how to deploy and configure Cloudera Flow Management on clusters running in FIPS 140-3 mode.

Ensure that the following requirements are met:

  • Cloudera Base on premises installed with FIPS mode enabled.
  • A supported FIPS-compatible Java version (such as Java 21) is installed.
  • Cloudera Flow Management 4.x is installed.
  • AutoTLS is configured (recommended).
  • The required SafeLogic CryptoComply for Java and SafeLogic/Bouncy Castle files are available.
  • The sasl-sha256aes JAR file that provides the ClouderaSaslProvider is available.

If Cloudera Base on premises was configured according to Preparing the hosts, the required JAR files should already be available on the Cloudera Manager host in the /opt/cloudera/fips directory. The same documentation also lists the required JAR filenames.

  1. Configure the JDK used by Cloudera Flow Management for FIPS compliance.
    1. Follow the steps n Configuring hosts to use FIPS-compliant JDK 17, adapting them to the JDK 21 or later installation used by Cloudera Flow Management.
    2. Validate the configuration as described in Validating the FIPS-compliant JDK 17 installation.

      Cloudera Flow Management uses a non-default JDK installation, run each validation command using the full path to that JDK’s Java executable. Otherwise, you might validate the wrong JDK.

      For example, replace:

      java -p /opt/cloudera/fips/ ListSecurityProviders.java

      with

      ${JAVA_HOME}/bin/java -p /opt/cloudera/fips/ ListSecurityProviders.java
  2. Install the required cryptographic JARs by copying the following files into the Cloudera Flow Management parcel's nifi, registry, and toolkit directories. 
    cp -a /opt/cloudera/fips/ccj-4.0.0-fips.jar \
      /opt/cloudera/fips/bctls-2.0.17.1.jar \   
      /opt/cloudera/fips/bcutil-2.0.1.jar \  
      /opt/cloudera/parcels/CFM-[***VERSION***]/TOOLKIT/lib/

cp -a /opt/cloudera/fips/ccj-4.0.0-fips.jar \
      /opt/cloudera/fips/bctls-2.0.17.1.jar \
      /opt/cloudera/fips/bcutil-2.0.1.jar \  
      /opt/cloudera/parcels/CFM-[***VERSION***]/REGISTRY/lib/

cp -a /opt/cloudera/fips/ccj-4.0.0-fips.jar \
      /opt/cloudera/fips/bctls-2.0.17.1.jar \
      /opt/cloudera/fips/bcutil-2.0.1.jar \  
      /opt/cloudera/fips/sasl-sha256aes-0.1.0.[***CDP_VERSION***].jar \
      /opt/cloudera/parcels/CFM-[***VERSION***]/NIFI/lib/

    Replace [***VERSION***] with the appropriate Cloudera Flow Management version string, and [***CDP_VERSION***] with the appropriate Cloudera Data Platform version string.

  3. Configure GCM Cipher support and the NiFi Bootstrap settings.

    Modern web browsers (for example, Chrome and Firefox) reject weak TLS cipher suites. By default, Bouncy Castle’s FIPS TLS library does not enable GCM ciphers, which are required for compatibility with these browsers.

    This configuration step enables GCM-based TLS ciphers through Bouncy Castle, avoiding connection issues caused by legacy AES-CBC suites, especially in FIPS environments.

    1. In Cloudera Manager, go to NiFi > Configuration > Advanced > NiFi Node Advanced Configuration Snippet (Safety Valve) for staging/bootstrap.conf.xml.
    2. Switch to the XML view and add the following properties. 
      <property>
    <name>java.arg.modulepath</name>
    <value>--module-path=/opt/cloudera/fips</value>
</property>
<property>
    <name>java.arg.addexports</name>
    <value>--add-exports=java.base/sun.security.provider=com.safelogic.cryptocomply.fips.core</value>
</property>
<property>
    <name>java.arg.addmodules</name>
    <value>--add-modules=com.safelogic.cryptocomply.fips.core,bctls</value>
</property>
<property>
    <name>java.arg.ccj.approved</name>
    <value>-Dcom.safelogic.cryptocomply.fips.approved_only=true</value>
</property>
<property>
    <name>java.arg.bctls.approved</name>
    <value>-Dorg.bouncycastle.fips.approved_only=true</value>
</property>
<property>
    <name>java.arg.allowgcm</name>
    <value>-Dorg.bouncycastle.jsse.fips.allowGCMCiphers=true</value>
</property>
<property>
    <name>java.arg.truststoretype</name>
    <value>-Djavax.net.ssl.trustStoreType=BCFKS</value>
</property>
<property>
    <name>java.arg.truststorepath</name>
    <value>-Djavax.net.ssl.trustStore=/var/lib/cloudera-scm-agent/agent-cert/cm-auto-global_truststore.jks</value>
</property>
<property>
    <name>java.arg.truststorepassword</name>
    <value>-Djavax.net.ssl.trustStorePassword=[***PASSWORD***]</value>
</property>

      Replace [***PASSWORD***] with the Auto-TLS truststore password.

    3. If NiFi Registry is part of your deployment, apply the same configuration to it.

      Navigate to NiFi Registry > Configuration > Advanced > NiFi Registry Advanced Configuration Snippet (Safety Valve) for staging/bootstrap.conf.xml and add the same properties as defined for NiFi.

    4. If using Hadoop with SASL, set the SASL mechanism to a FIPS-safe algorithm.

      1. Navigate to NiFi > Configuration > Advanced > NiFi Service Environment Advanced Configuration Snippet (Safety Valve) and add HADOOP_SASL_MECHANISM=DIGEST-SHA.

    5. If using AutoTLS Use Case 3, you can retrieve the truststore password. 
      sudo -u postgres psql
\c scm
SELECT * FROM CONFIGS WHERE attr LIKE 'truststore_password';
  4. Encrypt NiFi sensitive properties with FIPS algorithm by adding the following to the NiFi Node Advanced Configuration Snippet (Safety Valve) for staging/nifi.properties.xml. 
    <property>
  <name>nifi.sensitive.props.algorithm</name>
  <value>NIFI_PBKDF2_AES_GCM_256</value>
</property>
<property>
  <name>nifi.sensitive.props.key</name>
  <value>your_secure_password_here</value>
</property>

    1. Use either NIFI_PBKDF2_AES_GCM_128 or 256.

    2. The password must be at least 12 characters.

  5. Restart the Cloudera SCM agent to start and validate the Cloudera Flow Management deployment. 
    sudo systemctl stop cloudera-scm-supervisord.service
sudo systemctl restart cloudera-scm-agent
  6. Start the NiFi service through Cloudera Manager.
  7. Confirm that NiFi stays running and that no cipher mismatch or keyStore errors are present in the logs.