{
  "schema_version": 2,
  "id": "operate/kubernetes/security/fips",
  "title": "Enable FIPS 140-3 compliance mode",
  "url": "https://redis.io/docs/latest/operate/kubernetes/security/fips/",
  "summary": "Run Redis Software for Kubernetes in FIPS 140-3 compliance mode.",
  "tags": [
    "docs",
    "operate",
    "kubernetes"
  ],
  "last_updated": "2026-08-06T09:37:08-05:00",
  "page_type": "content",
  "content_hash": "2fa2ebd212ca20718a907fed794ea16ec3f2f7e3c5c123db22173851211a7d2d",
  "sections": [
    {
      "id": "overview",
      "title": "Overview",
      "role": "overview",
      "text": "You can run your Redis Software for Kubernetes cluster in FIPS 140-3 compliance mode, which uses cryptographic libraries based on FIPS 140-3 validated modules and enables the use of FIPS-approved cryptographic algorithms. FIPS mode is available starting with operator version 8.2.0.\n\nWhen you enable FIPS mode, the operator deploys a FIPS-compatible image in place of the standard one."
    },
    {
      "id": "prerequisites",
      "title": "Prerequisites",
      "role": "content",
      "text": "FIPS compliance depends on the underlying platform, not only on Redis:\n\n- **FIPS-configured nodes.** A container runs in FIPS mode only if the host node is configured for FIPS. On OpenShift, the cluster must be installed in FIPS mode. Redis does not configure the host; this is the responsibility of your platform.\n- **amd64 architecture.** The FIPS-compatible Redis Software image is built for `amd64` only. There is no arm64 FIPS image."
    },
    {
      "id": "enable-fips-mode",
      "title": "Enable FIPS mode",
      "role": "content",
      "text": "Set `spec.securityContext.fips.enabled` to `true` on the `RedisEnterpriseCluster` (REC):\n\n[code example]\n\nWhen enabled, the operator adds a `.fips` suffix to the image version tag and pulls the matching FIPS-compatible image (for example, `redislabs/redis:<version>.fips`). The field defaults to `false`."
    },
    {
      "id": "pull-the-image-by-digest",
      "title": "Pull the image by digest",
      "role": "content",
      "text": "If you pin the image by digest (`spec.redisEnterpriseImageSpec`) instead of by tag, the operator can't add the `.fips` suffix. In that case, supply a digest that points to a FIPS-compatible image yourself."
    }
  ],
  "examples": [
    {
      "id": "enable-fips-mode-ex0",
      "language": "yaml",
      "code": "apiVersion: app.redislabs.com/v1\nkind: RedisEnterpriseCluster\nmetadata:\n  name: rec\nspec:\n  securityContext:\n    fips:\n      enabled: true",
      "section_id": "enable-fips-mode"
    }
  ]
}