Skip to content
Kong Docs are moving soon! Our docs are migrating to a new home. You'll be automatically redirected to the new site in the future. In the meantime, view this page on the new site!
|
Kong Gateway
3.10.x (latest)
github-edit-pageEdit this page
report-issueReport an issue

Install and Configure the FIPS Compliant Package

This how-to guide explains how to install and configure the Kong Gateway FIPS-compliant package. After following the steps in this guide, you will have a FIPS-compliant Kong Gateway with FIPS mode enabled.

Installing a Kong Gateway FIPS compliant package

The FIPS-compliant Ubuntu 20.04 package can be installed using the package distinctively named kong-enterprise-edition-fips. To install the package follow these instructions:

  1. Set up the Kong APT repository: 
     curl -1sLf "https://packages.konghq.com/public/gateway-310/gpg.5F07A9706C09A6C6.key" |  gpg --dearmor >> /usr/share/keyrings/kong-gateway-310-archive-keyring.gpg
 curl -1sLf "https://packages.konghq.com/public/gateway-310/config.deb.txt?distro=ubuntu&codename=$(lsb_release -sc)" > /etc/apt/sources.list.d/kong-gateway-310.list
  2. Update the repository: 
     sudo apt-get update

  3. Install the Kong Gateway FIPS package:

     apt install -y kong-enterprise-edition-fips=3.10.0.2

The FIPS-compliant Red Hat 8 package can be installed using the package distinctively named kong-enterprise-edition-fips. To install the package follow these instructions:

  1. Download the FIPS package:

     curl -Lo kong-enterprise-edition-fips-3.10.0.2.rpm $(rpm --eval https://packages.konghq.com/public/gateway-310/rpm/el/%{rhel}/x86_64/kong-enterprise-edition-fips-3.10.0.2.el%{rhel}.x86_64.rpm)

  2. Install the Kong Gateway FIPS package:

     yum install kong-enterprise-edition-fips-3.10.0.2

  1. Set up the Kong Yum repository:

     curl -1sLf "https://packages.konghq.com/public/gateway-310/config.rpm.txt?distro=el&codename=$(rpm --eval '%{rhel}')" | sudo tee /etc/yum.repos.d/kong-gateway-310.repo
 sudo yum -q makecache -y --disablerepo='*' --enablerepo='kong-gateway-310'

  2. Install the Kong Gateway FIPS package:

     yum install kong-enterprise-edition-fips-3.10.0.2

Configure FIPS

To start in FIPS mode, set the following configuration property to on in the kong.conf configuration file before starting Kong Gateway:

fips = on # fips mode is enabled, causing incompatible ciphers to be disabled

You can also set this configuration using an environment variable:

export KONG_FIPS=on

If you are migrating from Kong Gateway 3.1 to 3.2 in FIPS mode and are using the key-auth-enc plugin, you should send PATCH or POST requests to all existing key-auth-enc credentials to re-hash them in SHA256.

Migrating from non-FIPS to FIPS mode and backwards is not supported.