// Module included in the following assemblies:
//
// * rosa_hcp/rosa-hcp-creating-cluster-with-fips-encryption.adoc

:_mod-docs-content-type: PROCEDURE
[id="creating-cluster-with-fips-encryption-cli_{context}"]
= Creating a {product-title} cluster using FIPS encryption in the CLI

[role="_abstract"]
You can create a {product-title} cluster with Federal Information Processing Standards (FIPS) encryption and a customer-provided Key Management Service (KMS) key by using {rosa-cli-first}.

.Procedure

. Verify the KMS key has been created by running the following command:
+
[source,terminal]
----
$ echo $KMS_ARN
----

. Confirm the details of the policy file created by running the following command:
+
[source,terminal]
----
$ cat rosa-key-policy.json
----

. Create the cluster by running the following command:
+
[NOTE]
====
If your cluster name is longer than 15 characters, it will contain an autogenerated domain prefix as a sub-domain for your provisioned cluster on `*.openshiftapps.com`. 

To customize the subdomain, use the `--domain-prefix` flag. The domain prefix cannot be longer than 15 characters, must be unique, and cannot be changed after cluster creation. 
====
+
[source,terminal]
----
$ rosa create cluster \
--cluster-name ${PREFIX}-test \
--hosted-cp \
--machine-cidr 10.0.0.0/16 \
--oidc-config-id $OIDC_CONFIG \
--mode auto \
--region $AWS_REGION \
--replicas 2 \
--operator-roles-prefix $PREFIX \
--installer-role-arn "arn:aws:iam::${AWS_ACCOUNT}:role/${PREFIX}-HCP-ROSA-Installer-Role" \
--support-role-arn "arn:aws:iam::${AWS_ACCOUNT}:role/${PREFIX}-HCP-ROSA-Support-Role" \
--worker-iam-role-arn "arn:aws:iam::${AWS_ACCOUNT}:role/${PREFIX}-HCP-ROSA-Worker-Role" \
--subnet-ids <subnet-ids> \
--etcd-encryption \
--etcd-encryption-kms-arn $KMS_ARN \
--fips
----
+
--
where:

`--subnet-ids`:: These subnet IDs should be at least one private subnet ID and public subnet ID.
`--kms-key-arn`:: This KMS key ARN is used to encrypt all worker node root volumes. It is not required if only etcd database encryption is needed.
`--etcd-encryption-kms-arn`:: This KMS key ARN is used to encrypt the etcd database. The etcd database is always encrypted by default with an AES cipher block, but can be encrypted instead with a KMS key. It is not required if only node root volume encryption is needed.
--

.Verification

. Log in to your cluster as an admin user.
. Set the node name as a variable by running the following command:
+
[source,terminal]
----
$ NODE=$(oc get nodes --no-headers | awk '$2=="Ready"{print $1; exit}')
----

. Check your cluster's FIPS status by running the following command:
+
[source,terminal]
----
$ oc debug node/${NODE} --to-namespace=default -- chroot /host bash -c 'set -x; \
update-crypto-policies --show; \
cat /etc/system-fips; \
cat /proc/sys/crypto/fips_enabled; \
sysctl crypto.fips_enabled'
----
+
.Example output
[source,terminal]
----
Starting pod/ip-10-0-1-162us-east-2computeinternal-debug-86cnb ...
To use host binaries, run `chroot /host`
+ update-crypto-policies --show
FIPS
+ cat /etc/system-fips
# FIPS module installation complete
+ cat /proc/sys/crypto/fips_enabled
1
+ sysctl crypto.fips_enabled
crypto.fips_enabled = 1

Removing debug pod ...
----