-
Bug
-
Resolution: Not a Bug
-
Undefined
-
None
-
4.16.z
-
None
-
Quality / Stability / Reliability
-
False
-
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
Description of problem:
OpenShift 4.16.36 cluster installation fails in FIPS mode with error "FIPS mode is enabled, but the required OpenSSL backend is unavailable" despite proper FIPS configuration on the host system. The same configuration works successfully with OpenShift 4.14.38.
# ./openshift-install version ./openshift-install 4.16.36 built from commit ed196179749c9370de6906453fb78f16b37a6e42 release image quay.io/openshift-release-dev/ocp-release@sha256:efab0026a48c418ff01754238aea813e24097f65ff75962147cef78d785f06f4 release architecture amd64 # ./oc version Client Version: 4.16.36 Kustomize Version: v5.0.4-0.20230601165947-6ce0bf390ce3 # oc adm release extract --command=openshift-install-fips --to /tmp docker-gcs-infra-local.artifactrepository.xyz.net/redhat/openshift4:4.16.36-x86_64@sha256:efab0026a48c418ff01754238aea813e24097f65ff75962147cef78d785f06f4 error: command "openshift-install-fips" does not support the operating system "linux"
Version-Release number of selected component (if applicable):
OpenShift Version: 4.16.36 Installation Method: Agent-based installer Host OS: RHEL 9.5 (Plow) Host Kernel: 5.14.0-503.19.1.el9_5.x86_64 OpenSSL Version: 3.2.2 (June 4, 2024) OpenSSL Package: openssl-libs-3.2.2-6.el9_5.x86_64 Deployment Type: Disconnected environment
How reproducible:
Steps to Reproduce:
1. Enable FIPS mode on RHEL 9.5 host: sudo fips-mode-setup --enable 2. Reboot system and verify FIPS mode is enabled: fips-mode-setup --check 3. Set `fips: true` in the install-config.yaml 4. Attempt to create PXE files: ./openshift-install agent create pxe-files --dir clusterconfigs
Actual results:
The installation fails with error:
level=error msg=FIPS mode is enabled, but the required OpenSSL backend is unavailable level=fatal msg=failed to fetch Agent Installer PXE Files: failed to fetch dependency of "Agent Installer PXE Files": failed to fetch dependency of "Agent Installer Artifacts": failed to generate asset "BaseIso Image": failed to get base ISO image
Expected results:
Installation should proceed successfully.
Additional info:
FIPS Status Check: # fips-mode-setup --check FIPS mode is enabled.
OS Version: # cat /etc/os-release NAME="Red Hat Enterprise Linux" VERSION="9.5 (Plow)" ID="rhel" VERSION_ID="9.5"
OpenSSL Library and Version: # rpm -qf /lib64/libcrypto.so.3 openssl-libs-3.2.2-6.el9_5.x86_64 # openssl version OpenSSL 3.2.2 4 Jun 2024 (Library: OpenSSL 3.2.2 4 Jun 2024)
FIPS Validation Test: # openssl md5 /etc/hostname Error setting digest 002E141A147F0000:error:0308010C:digital envelope routines:inner_evp_generic_fetch:unsupported:crypto/evp/evp_fetch.c:355:Global default library context, Algorithm (MD5 : 95), Properties () 002E141A147F0000:error:03000086:digital envelope routines:evp_md_init_internal:initialization error:crypto/evp/digest.c:272: