Self-managed install & maintenance > Install and config > Advanced config > Security & access control > Auth server FIPS 140-3 mode

Auth server FIPS 140-3 mode¶

The auth server is built with the Go FIPS 140-3 cryptographic module, but FIPS mode is off by default. When you turn it on, the auth server checks the module's integrity and runs the FIPS 140-3 power-on self-tests at startup, before it serves any requests. If a self-test fails, the container exits with a non-zero code instead of starting.

FIPS mode applies to the auth server container, its database migration init container, and the cleanup CronJob. It is available in DataRobot 11.14 and later.

Turn on FIPS mode for installations that must meet FIPS 140-3 requirements. It is not turned on automatically, even when the rest of the installation runs in FIPS mode.

前提条件¶

In FIPS mode, the auth server also needs a third key, secretsPagination, in the auth-server-system-secrets Secret. Whether you have to add it yourself depends on where the Secret comes from.

Secret source	アクション
Created by the DataRobot Helm chart (the default)	なし。 The chart adds `secretsPagination` on the first install or upgrade with FIPS mode enabled. It keeps the key on later upgrades. On ArgoCD and other `helm template` installs, the auth server's `hydra-keys` init container adds it the first time the pod starts.
Keys set in your values file: `auth-token-customization.hydra.secret.secretsSystem` `secretsCookie`	Also set `auth-token-customization.hydra.secret.secretsPagination` to a long random value. See ArgoCD.
External Secrets (ESO or VSO)	Add a `secretsPagination` property to the `auth-server-system-secrets` entry in your secret store, and wait for it to sync into the cluster. See Auth server system secrets.
A Secret you create yourself	Add the key to the Secret, as shown below.

Add the key before you enable FIPS mode

If the Secret has no secretsPagination key, the auth server pod cannot start. It stays in CreateContainerConfigError, and sign-in to DataRobot fails until the key is added.

To add the key to a Secret you manage yourself:

kubectl -n ${NAMESPACE} patch secret auth-server-system-secrets \
  --type=merge \
  -p "{\"data\":{\"secretsPagination\":\"$(openssl rand -hex 22 | tr -d '\n' | base64)\"}}"

secretsPagination only protects the tokens the auth server uses to page through long lists. Unlike secretsSystem, it does not protect stored data, so you can generate it at any time.

Turn on FIPS mode¶

Add the following to your values file, then run helm upgrade (or sync the ArgoCD Application):

auth-token-customization:
  hydra:
    fips:
      enabled: true

auth-token-customization.hydra.fips.mode is optional and controls how much the self-tests log:

debug (default): Runs in FIPS mode and logs one line for each self-test that passes. Use this mode if you need a record that the self-tests ran at startup, for example for an audit.
"on": Runs in FIPS mode without logging each passing self-test. Quote the value, because otherwise YAML reads on as true.

To turn off the self-test log lines, add mode: "on" under fips:

auth-token-customization:
  hydra:
    fips:
      enabled: true
      mode: "on"

Check that self-tests ran¶

With the default debug mode, the auth server logs the self-test results each time it starts. The following commands find the auth server Deployment with jq and print those lines:

HYDRA=$(kubectl -n ${NAMESPACE} get deployment -o json \
  | jq -r '.items[] | select(any(.spec.template.spec.containers[]; .name == "hydra")) | .metadata.name')
kubectl -n ${NAMESPACE} logs deployment/"$HYDRA" -c hydra | grep -E 'fips140|FIPS 140-3'

Example output:

FIPS 140-3 self-test passed: cSHAKE128
FIPS 140-3 self-test passed: SHA2-256
FIPS 140-3 self-test passed: SHA2-512
FIPS 140-3 self-test passed: HMAC-SHA2-256
fips140: verified code+data
FIPS 140-3 self-test passed: AES-CBC
...

The exact list of self-tests depends on the auth server version. fips140: verified code+data confirms the module integrity check.

If a self-test fails, the container log shows fatal error: FIPS 140-3 self-test failed: <self-test name>, the container exits with code 2, and Kubernetes restarts it. The pod shows CrashLoopBackOff until the cause is fixed. Contact DataRobot Support if this happens.

If the pod is in CreateContainerConfigError instead, the Secret has no secretsPagination key; see Prerequisites.