{
  "id": "fips",
  "title": "Enable FIPS 140-3 compliance mode",
  "url": "https://redis.io/docs/latest/operate/kubernetes/security/fips/",
  "summary": "Run Redis Software for Kubernetes in FIPS 140-3 compliance mode.",
  "tags": [
    "docs",
    "operate",
    "kubernetes"
  ],
  "last_updated": "2026-07-24T10:52:10-07:00",
  "page_type": "content",
  "content_hash": "4d0bd8cc96145169e8e8628a850ffb9e383130dc7200f82687720c98ca46dab9",
  "sections": [
    {
      "id": "overview",
      "title": "Overview",
      "role": "overview",
      "text": "You can run your Redis Software for Kubernetes cluster in FIPS 140-3 compliance mode, where cryptographic operations use validated, FIPS-approved algorithms. FIPS mode is available starting with operator version 8.2.0.\n\nWhen you enable FIPS mode, the operator deploys a FIPS-compatible image in place of the standard one."
    },
    {
      "id": "prerequisites",
      "title": "Prerequisites",
      "role": "content",
      "text": "FIPS compliance depends on the underlying platform, not only on Redis:\n\n- **FIPS-configured nodes.** A container runs in FIPS mode only if the host node is configured for FIPS. On OpenShift, the cluster must be installed in FIPS mode. Redis does not configure the host; this is the responsibility of your platform.\n- **amd64 architecture.** The FIPS-compatible Redis Enterprise image is built for `amd64` only. There is no arm64 FIPS image."
    },
    {
      "id": "enable-fips-mode",
      "title": "Enable FIPS mode",
      "role": "content",
      "text": "Set `spec.securityContext.fips.enabled` to `true` on the `RedisEnterpriseCluster` (REC):\n\n[code example]\n\nWhen enabled, the operator adds a `.fips` suffix to the image version tag and pulls the matching FIPS-compatible image (for example, `redislabs/redis:<version>.fips`). The field defaults to `false`."
    },
    {
      "id": "pull-the-image-by-digest",
      "title": "Pull the image by digest",
      "role": "content",
      "text": "If you pin the image by digest (`spec.redisEnterpriseImageSpec`) instead of by tag, the operator can't add the `.fips` suffix. In that case, supply a digest that points to a FIPS-compatible image yourself."
    }
  ],
  "examples": [
    {
      "id": "enable-fips-mode-ex0",
      "language": "yaml",
      "code": "apiVersion: app.redislabs.com/v1\nkind: RedisEnterpriseCluster\nmetadata:\n  name: rec\nspec:\n  securityContext:\n    fips:\n      enabled: true",
      "section_id": "enable-fips-mode"
    }
  ]
}