anchor.diff:  [id="installation-about-fips-components_{context}"]
   ==  FIPS support in components that the cluster uses
   
  -Although the {product-title} cluster itself uses FIPS validated / Implementation Under Test modules, ensure that the systems that support your {product-title} cluster use FIPS validated / Implementation Under Test modules for cryptography.
  +Although the {product-title} cluster itself uses FIPS Validated / Modules in Process modules, ensure that the systems that support your {product-title} cluster use FIPS Validated / Modules in Process modules for cryptography.
   
   [id="installation-about-fips-components-etcd_{context}"]
   === etcd
   
  -To ensure that the secrets that are stored in etcd use FIPS validated / Implementation Under Test encryption, encrypt the etcd datastore by using a FIPS-approved cryptographic algorithm. After you install the cluster, you can xref:../security/encrypting-etcd.adoc#encrypting-etcd[encrypt the etcd data] by using the `aes cbc` algorithm.
  +To ensure that the secrets that are stored in etcd use FIPS Validated / Modules in Process encryption, encrypt the etcd datastore by using a FIPS-approved cryptographic algorithm. After you install the cluster, you can xref:../security/encrypting-etcd.adoc#encrypting-etcd[encrypt the etcd data] by using the `aes cbc` algorithm.
   
   [id="installation-about-fips-components-storage_{context}"]
   === Storage
   
  -For local storage, use RHEL-provided disk encryption or Container Native Storage that uses RHEL-provided disk encryption. By storing all data in volumes that use RHEL-provided disk encryption and enabling FIPS mode for your cluster, both data at rest and data in motion, or network data, are protected by FIPS validated / Implementation Under Test encryption.
  +For local storage, use RHEL-provided disk encryption or Container Native Storage that uses RHEL-provided disk encryption. By storing all data in volumes that use RHEL-provided disk encryption and enabling FIPS mode for your cluster, both data at rest and data in motion, or network data, are protected by FIPS Validated / Modules in Process encryption.
   You can configure your cluster to encrypt the root filesystem of each node, as described
   in xref:../installing/install_config/installing-customizing.adoc#installing-customizing[Customizing nodes].
   
   [id="installation-about-fips-components-runtimes_{context}"]
   === Runtimes
   
  -To ensure that containers know that they are running on a host that is using FIPS validated / Implementation Under Test cryptography modules, use CRI-O to manage your runtimes. CRI-O supports FIPS-Mode, in that it configures the containers to know that they are running in FIPS mode.
  +To ensure that containers know that they are running on a host that is using FIPS Validated / Modules in Process cryptography modules, use CRI-O to manage your runtimes. CRI-O supports FIPS-Mode, in that it configures the containers to know that they are running in FIPS mode.
   
   [id="installing-fips-mode_{context}"]
   ==  Installing a cluster in FIPS mode
  
positive.code: 
  toc::[]
  
  Starting with version 4.3, you can install an {product-title} cluster that uses FIPS validated / Implementation Under Test cryptographic libraries.
  
  For the {op-system-first} machines in your cluster, this change is applied when the machines are deployed based on the status of an option in the `install-config.yaml` file, which governs the cluster options that a user can change during cluster deployment. With Red Hat Enterprise Linux machines, you must enable FIPS mode when you install the operating system on the machines that you plan to use as worker machines. These configuration methods ensure that your cluster meet the requirements of a FIPS compliance audit: only FIPS validated / Implementation Under Test cryptography packages are enabled before the initial system boot.
  
  Because FIPS must be enabled before the operating system that your cluster uses boots for the first time, you cannot enable FIPS after you deploy a cluster.
  
  [id="installation-about-fips-validation_{context}"]
  == FIPS validation in {product-title}
  
  {product-title} uses certain FIPS validated / Implementation Under Test modules within Red Hat Enterprise Linux (RHEL) and {op-system} for the operating system components that it uses. See link:https://access.redhat.com/articles/3359851[RHEL7 core crypto components]. For example, when users SSH into {product-title} clusters and containers, those connections are properly encrypted.
  
  {product-title} components are written in Go and built with Red Hat’s golang compiler. When you enable FIPS mode for your cluster, Red Hat’s golang compiler calls RHEL and {op-system} cryptographic libraries for all {product-title} components that require cryptographic signing. At the initial release of {product-title} version 4.3, only the `ose-sdn` package uses the native golang cryptography, which is not FIPS validated / Implementation Under Test. Red Hat verifies that all other packages use the FIPS validated / Implementation Under Test OpenSSL module.
  
  .FIPS mode attributes and limitations in {product-title} {product-version}
  [cols="8a,8a",options="header"]
  
negative.code: |FIPS support in CRI-O runtimes.
  |FIPS support in {product-title} services.
  
  |FIPS Validated / Modules in Process cryptographic module and algorithms that are obtained from RHEL 7 and {op-system} binaries and images.
  |
  
  |Use of FIPS compatible golang compiler.
  