Deploying Cloudera Flow Management on FIPS-enabled clusters

Cloudera Flow Management can run in FIPS 140-2- and FIPS 140-3-enabled environments. Additional configuration is required to enable Cloudera Flow Management to use the appropriate FIPS-validated cryptographic modules and Java security settings.

This guide explains how to deploy and configure Cloudera Flow Management in a FIPS-enabled environment.

Supported configurations:


FIPS standard	Cloudera Flow Management version	Operating system
FIPS 140-2	Cloudera Flow Management 4.12.0 Cloudera Flow Management 4.12.0.10001	Red Hat Enterprise Linux 8.8 or 8.10
FIPS 140-3	Cloudera Flow Management 4.12.0.10001	Red Hat Enterprise Linux 9.6

Ensure that the requirements for your selected FIPS configuration are met.

FIPS 140-2 prerequisites

Cloudera Base on premises 7.3.2 and Cloudera Manager 7.13.2 are installed with FIPS mode enabled.
Cloudera Flow Management 4.12.0 or 4.12.0.10001 is installed.
Red Hat Enterprise Linux 8.8 or 8.10 is installed with FIPS mode enabled.
A supported FIPS-compliant JDK 21 version (for example: Azul Zulu JDK 21) is installed for Cloudera Flow Management.
Auto-TLS is configured (recommended).
The required SafeLogic and Bouncy Castle cryptographic JAR files are available.

FIPS 140-3 prerequisites

Cloudera Base on premises 7.3.2 SP1 and Cloudera Manager 7.13.2.10000 are installed with FIPS mode enabled.
Cloudera Flow Management 4.12.0.10001 is installed.
Red Hat Enterprise Linux 9.6 is installed with FIPS mode enabled.
A supported FIPS-compliant JDK 21 version (for example: Azul Zulu JDK 21) is installed for Cloudera Flow Management.
Auto-TLS is configured (recommended).
The required SafeLogic CryptoComply for Java and SafeLogic/Bouncy Castle files are available.
The sasl-sha256aes JAR file that provides the ClouderaSaslProvider is available.

If Cloudera Base on premises was configured according to Preparing the hosts, the required JAR files should already be available on the Cloudera Manager host in the /opt/cloudera/fips directory. The same documentation also lists the required JAR filenames.

Configure the JDK used by Cloudera Flow Management for FIPS compliance.

Cloudera Base on premises uses JDK 17, while Cloudera Flow Management 4.12.x requires JDK 21.
Repeat the applicable FIPS security-provider configuration for the JDK 21 installation used by Cloudera Flow Management.
1. Configure the hosts for the JDK 21 installation used by Cloudera Flow Management.
2. Validate the configuration.
  Because Cloudera Flow Management uses a non-default JDK installation, run each validation command by using the full path to the Java executable for the JDK used by Cloudera Flow Management. Otherwise, you might validate the wrong JDK intsallation.
  
  For example, replace:
```
java -p /opt/cloudera/fips/ ListSecurityProviders.java
```
  with
```
${JAVA_HOME}/bin/java -p /opt/cloudera/fips/ ListSecurityProviders.java
```

Install the required cryptographic JARs by copying the following files into the NiFi Toolkit, NiFi Registry, and NiFi library directories in theCloudera Flow Management parcel.

The following example uses the JAR versions supplied with the current configuration. Use the versions installed for Cloudera Base on premises if they differ.

cp -a /opt/cloudera/fips/ccj-4.0.0-fips.jar \
      /opt/cloudera/fips/bctls-2.0.17.1.jar \   
      /opt/cloudera/fips/bcutil-2.0.1.jar \  
      /opt/cloudera/parcels/CFM-[***VERSION***]/TOOLKIT/lib/

cp -a /opt/cloudera/fips/ccj-4.0.0-fips.jar \
      /opt/cloudera/fips/bctls-2.0.17.1.jar \
      /opt/cloudera/fips/bcutil-2.0.1.jar \  
      /opt/cloudera/parcels/CFM-[***VERSION***]/REGISTRY/lib/

cp -a /opt/cloudera/fips/ccj-4.0.0-fips.jar \
      /opt/cloudera/fips/bctls-2.0.17.1.jar \
      /opt/cloudera/fips/bcutil-2.0.1.jar \
      /opt/cloudera/parcels/CFM-[***VERSION***]/NIFI/lib/

For a FIPS 140-3 deployment, also copy the JAR file that provides the ClouderaSaslProvider into the NiFi library directory:

cp -a /opt/cloudera/fips/sasl-sha256aes-0.1.0.[***CDP_VERSION***].jar \
      /opt/cloudera/parcels/CFM-[***VERSION***]/NIFI/lib/

Replace:

[***VERSION***] with the appropriate Cloudera Flow Management version
[***CDP_VERSION***] with the appropriate Cloudera Data Platform version

Configure GCM Cipher support and the NiFi Bootstrap settings.

Modern web browsers (for example, Chrome and Firefox) reject weak TLS cipher suites. By default, Bouncy Castle’s FIPS TLS library does not enable GCM ciphers, which are required for compatibility with these browsers.

To enable GCM-based cipher suites and configure the FIPS security providers:
1. In Cloudera Manager, go to NiFi > Configuration > Advanced > NiFi Node Advanced Configuration Snippet (Safety Valve) for staging/bootstrap.conf.xml.
2. Switch to the XML view and add the following properties.
```
<property>
    <name>java.arg.modulepath</name>
    <value>--module-path=/opt/cloudera/fips</value>
</property>
<property>
    <name>java.arg.addexports</name>
    <value>--add-exports=java.base/sun.security.provider=com.safelogic.cryptocomply.fips.core</value>
</property>
<property>
    <name>java.arg.addmodules</name>
    <value>--add-modules=com.safelogic.cryptocomply.fips.core,bctls</value>
</property>
<property>
    <name>java.arg.ccj.approved</name>
    <value>-Dcom.safelogic.cryptocomply.fips.approved_only=true</value>
</property>
<property>
    <name>java.arg.bctls.approved</name>
    <value>-Dorg.bouncycastle.fips.approved_only=true</value>
</property>
<property>
    <name>java.arg.allowgcm</name>
    <value>-Dorg.bouncycastle.jsse.fips.allowGCMCiphers=true</value>
</property>
<property>
    <name>java.arg.truststoretype</name>
    <value>-Djavax.net.ssl.trustStoreType=BCFKS</value>
</property>
<property>
    <name>java.arg.truststorepath</name>
    <value>-Djavax.net.ssl.trustStore=/var/lib/cloudera-scm-agent/agent-cert/cm-auto-global_truststore.jks</value>
</property>
<property>
    <name>java.arg.truststorepassword</name>
    <value>-Djavax.net.ssl.trustStorePassword=[***PASSWORD***]</value>
</property>
```
  Replace [***PASSWORD***] with the Auto-TLS truststore password.
3. If NiFi Registry is part of your deployment, apply the same bootstrap configuration to it.
  1. Navigate to NiFi Registry > Configuration > Advanced > NiFi Registry Advanced Configuration Snippet (Safety Valve) for staging/bootstrap.conf.xml.
  2. Add the same properties as configured for NiFi in the previous section.
4. Configure the SASL mechanism for FIPS 140-3.
  This step applies only to FIPS 140-3 deployments that use Hadoop with SASL.
  1. Navigate to NiFi > Configuration > Advanced > NiFi Service Environment Advanced Configuration Snippet (Safety Valve).
  2. Add the following environment variable:
    
    HADOOP_SASL_MECHANISM=DIGEST-SHA.
  This configuration enables NiFi to use the FIPS-compliant ClouderaSaslProvider when communicating with Hadoop components.
5. If you use AutoTLS Use Case 3, retrieve the truststore password from the Cloudera Manager database.
```
sudo -u postgres psql
\c scm
SELECT * FROM CONFIGS WHERE attr LIKE 'truststore_password';
```
Encrypt NiFi sensitive properties with FIPS algorithm by adding the following to the NiFi Node Advanced Configuration Snippet (Safety Valve) for staging/nifi.properties.xml.
```
<property>
  <name>nifi.sensitive.props.algorithm</name>
  <value>NIFI_PBKDF2_AES_GCM_256</value>
</property>
<property>
  <name>nifi.sensitive.props.key</name>
  <value>your_secure_password_here</value>
</property>
```
- Use either NIFI_PBKDF2_AES_GCM_128 or 256.
- The password must be at least 12 characters.

Restart the Cloudera SCM agent to to apply the configuration.

sudo systemctl stop cloudera-scm-supervisord.service
sudo systemctl restart cloudera-scm-agent

Start and validate NiFi.
1. Start the NiFi service in Cloudera Manager.
2. Confirm that NiFi remains running.
3. Review the NiFi logs and verify that they do not contain:
  - Cipher mismatch errors
  - Keystore or truststore errors
  - Security-provider initialization errors
If NiFi Registry is part of the deployment, start it and perform the same validation.