anchor.diff:  If you plan to upgrade your existing cluster to a version that can be run in
   a FIPS 140-2 configured JVM, we recommend to first perform a rolling
   upgrade to the new version in your existing JVM and perform all necessary
  -configuration changes in preparation for running in fips mode. You can then
  +configuration changes in preparation for running in FIPS 140-2 mode. You can then
   perform a rolling restart of the nodes, starting each node in a FIPS 140-2 JVM.
   During the restart, {es}:
   
  
positive.code: 
  FIPS 140-2 (via NIST Special Publication 800-132) dictates that encryption keys should at
  least have an effective strength of 112 bits.
  As such, the elasticsearch keystore that stores the node's <<secure-settings,secure settings>>
  needs to be password protected with a password that satisfies this requirement.
  This means that the password needs to be 14 bytes long which is equivalent
  to a 14 character ASCII encoded password, or a 7 character UTF-8 encoded password.
  
negative.code: === Limitations
  
  Due to the limitations that FIPS 140-2 compliance enforces, a small number of
  features are not available while running in FIPS 140-2 mode. The list is as follows:
  
  * Azure Classic Discovery Plugin
  * Ingest Attachment Plugin
  