strimzi-kafka-fips

packaged by Chainguard

Chainguard Container for strimzi-kafka-fips

FIPS-enabled Strimzi workload image for running Apache Kafka® clusters and related components on Kubernetes or OpenShift.

Chainguard Containers are regularly-updated, secure-by-default container images.

Download this Container Image

For those with access, this container image is available on cgr.dev:

docker pull cgr.dev/ORGANIZATION/strimzi-kafka-fips:latest

Be sure to replace the ORGANIZATION placeholder with the name used for your organization's private repository within the Chainguard Registry.

Compatibility Notes

The strimzi-kafka-fips workload image must run with strimzi-kafka-operator-fips. Using the upstream Strimzi operator or Chainguard's non-FIPS strimzi-kafka-operator image is unsupported and does not provide a working end-to-end FIPS deployment.

The Chainguard strimzi-kafka-fips image is comparable to the official Strimzi Kafka image, but uses FIPS-validated cryptography. It contains the Kafka broker and the Strimzi workload components for Kafka Connect, Kafka Exporter, Kafka MirrorMaker 2, and Cruise Control. Refer to the FIPS support section below for more details.

FIPS support

The strimzi-kafka-fips image uses Chainguard's versioned kafka-fips distribution, including its Java runtime, Bouncy Castle FIPS (BCFIPS) security provider, and FIPS-validated OpenSSL cryptography. Unlike the upstream image's version-specific JAVA_HOME path, this image sets JAVA_HOME to /usr/lib/jvm/default-jvm. The selected kafka-fips version determines the Java runtime. Check that version for Java compatibility, particularly when adding custom plugins. Refer to the kafka-fips image overview for details about supported TLS versions, certificate algorithms, and keystore and truststore formats. For general information about FIPS support, consult the guide to FIPS-enabled Chainguard Containers on Chainguard Academy.

This image must be deployed through the strimzi-kafka-operator-fips image, which runs the FIPS-enabled cluster, topic, and user operators that configure and manage these workloads. The FIPS operator replaces upstream PKCS12 handling with BCFKS for operator-managed keystores. The strimzi-kafka-fips workload image provides corresponding FIPS certificate-preparation paths, including BCFKS keystores for Cruise Control.

OpenTelemetry tracing in strimzi-kafka-fips supports OTLP over HTTP/protobuf only. OTLP over gRPC is not included because its shaded gRPC transport bundles native BoringSSL cryptography outside the BCFIPS Java provider boundary. Kafka Connect-based workloads, including Kafka MirrorMaker 2, default an unset OTLP protocol to http/protobuf and reject an explicitly configured grpc protocol before startup.

Strimzi's automatic Kafka Connect Build feature (KafkaConnect.spec.build) is not supported within this image's FIPS compatibility boundary. Buildah, Kaniko, and the optional Maven builder run as separate images, and third-party connector plugins may introduce non-FIPS cryptography. Use FIPS-enabled builder images and ensure connector plugins meet your deployment's FIPS requirements.

Prerequisites

This example requires a Kubernetes cluster, Helm, kubectl, and registry access to both strimzi-kafka-fips and strimzi-kafka-operator-fips. Refer to the Strimzi deployment documentation for supported Kubernetes versions and other installation requirements.

Getting Started

Deploy the operator using the upstream Strimzi Helm chart and a values file that selects the FIPS image for every operator and Kafka workload component. The operator-side overrides use strimzi-kafka-operator-fips. The workload-side overrides use strimzi-kafka-fips.

Create the values file:

cat > values.yaml <<'EOF'
watchAnyNamespace: true

# Operator components
image:
  registry: cgr.dev
  repository: ORGANIZATION
  name: strimzi-kafka-operator-fips
  tag: latest
topicOperator:
  image:
    registry: cgr.dev
    repository: ORGANIZATION
    name: strimzi-kafka-operator-fips
    tag: latest
userOperator:
  image:
    registry: cgr.dev
    repository: ORGANIZATION
    name: strimzi-kafka-operator-fips
    tag: latest
kafkaInit:
  image:
    registry: cgr.dev
    repository: ORGANIZATION
    name: strimzi-kafka-operator-fips
    tag: latest

# Kafka workload components
kafka:
  image:
    registry: cgr.dev
    repository: ORGANIZATION
    name: strimzi-kafka-fips
    tagPrefix: latest
kafkaConnect:
  image:
    registry: cgr.dev
    repository: ORGANIZATION
    name: strimzi-kafka-fips
    tagPrefix: latest
kafkaExporter:
  image:
    registry: cgr.dev
    repository: ORGANIZATION
    name: strimzi-kafka-fips
    tagPrefix: latest
kafkaMirrorMaker2:
  image:
    registry: cgr.dev
    repository: ORGANIZATION
    name: strimzi-kafka-fips
    tagPrefix: latest
cruiseControl:
  image:
    registry: cgr.dev
    repository: ORGANIZATION
    name: strimzi-kafka-fips
    tagPrefix: latest
EOF

Install the chart:

helm install strimzi-kafka-operator-fips \
  oci://quay.io/strimzi-helm/strimzi-kafka-operator \
  --namespace kafka --create-namespace \
  --values values.yaml

After the operator is ready, apply a KafkaNodePool and Kafka custom resource to create a single-node Kafka cluster:

cat > kafka.yaml <<'EOF'
apiVersion: kafka.strimzi.io/v1
kind: KafkaNodePool
metadata:
  name: dual-role
  namespace: kafka
  labels:
    strimzi.io/cluster: my-cluster
spec:
  replicas: 1
  roles:
    - controller
    - broker
  storage:
    type: jbod
    volumes:
      - id: 0
        type: ephemeral
        kraftMetadata: shared
---
apiVersion: kafka.strimzi.io/v1
kind: Kafka
metadata:
  name: my-cluster
  namespace: kafka
spec:
  kafka:
    version: 4.3.1
    image: cgr.dev/ORGANIZATION/strimzi-kafka-fips:latest-kafka-4.3.1
    listeners:
      - name: plain
        port: 9092
        type: internal
        tls: false
    config:
      offsets.topic.replication.factor: 1
      transaction.state.log.replication.factor: 1
      transaction.state.log.min.isr: 1
      default.replication.factor: 1
      min.insync.replicas: 1
  entityOperator:
    topicOperator: {}
    userOperator: {}
EOF

kubectl apply -f kafka.yaml

Wait for the cluster to become ready:

kubectl wait kafka/my-cluster \
  --namespace kafka \
  --for=condition=Ready \
  --timeout=10m

Configuration

The chart constructs image references by joining registry, repository, and name. For Kafka workloads, tagPrefix: latest allows the chart to append the Kafka version, producing references such as cgr.dev/ORGANIZATION/strimzi-kafka-fips:latest-kafka-4.3.1. Using tag: latest instead would suppress the version suffix.

The spec.kafka.image field makes the broker image explicit. Do not change it to strimzi-kafka, and do not install this cluster with the non-FIPS strimzi-kafka-operator. Either change breaks the required FIPS pairing. When pinning versions instead of using latest, select a compatible strimzi-kafka-operator-fips tag and strimzi-kafka-fips tag prefix, and set spec.kafka.version to the Kafka version included in the workload image.

Preserving the Bouncy Castle FIPS configuration

The image sets JAVA_TOOL_OPTIONS so Java loads the Bouncy Castle FIPS modules and uses a FIPS truststore. If you override this variable through a Strimzi custom resource or Pod template, preserve both options because the override replaces the image's complete value:

- name: JAVA_TOOL_OPTIONS
  value: >-
    --module-path=/usr/share/java/bouncycastle-fips/
    -Djavax.net.ssl.trustStoreType=FIPS

Optional Kafka Bridge

The Strimzi Helm chart installs the KafkaBridge custom resource definition, but it does not deploy a bridge by default. If you plan to create a KafkaBridge resource, add the following override to values.yaml so the operator uses the kafka-bridge-fips image instead of Strimzi's non-FIPS default:

kafkaBridge:
  image:
    registry: cgr.dev
    repository: ORGANIZATION
    name: kafka-bridge-fips
    tag: latest

An image set in KafkaBridge.spec.image takes precedence over the Helm value and must also reference cgr.dev/ORGANIZATION/kafka-bridge-fips to preserve FIPS operation.

Documentation and Resources

• Strimzi documentation
• Strimzi Helm chart
• Strimzi quickstart
• FIPS-enabled Chainguard Containers

What are Chainguard Containers?

Chainguard's free tier of Starter container images are built with Wolfi, our minimal Linux undistro.

All other Chainguard Containers are built with Chainguard OS, Chainguard's minimal Linux operating system designed to produce container images that meet the requirements of a more secure software supply chain.

The main features of Chainguard Containers include:

• Minimal design, without unnecessary software bloat
• Daily builds to ensure container images are up-to-date with available security patches
• High quality build-time SBOMs attesting to the provenance of all artifacts within the image
• Verifiable signatures provided by Sigstore
• Reproducible builds with Cosign and apko (read more about reproducibility)

For cases where you need container images with shells and package managers to build or debug, most Chainguard Containers come paired with a development, or -dev, variant.

In all other cases, including Chainguard Containers tagged as :latest or with a specific version number, the container images include only an open-source application and its runtime dependencies. These minimal container images typically do not contain a shell or package manager.

Although the -dev container image variants have similar security features as their more minimal versions, they include additional software that is typically not necessary in production environments. We recommend using multi-stage builds to copy artifacts from the -dev variant into a more minimal production image.

Need additional packages?

To improve security, Chainguard Containers include only essential dependencies. Need more packages? Chainguard customers can use Custom Assembly to add packages, either through the Console, chainctl, or API.

To use Custom Assembly in the Chainguard Console: navigate to the image you'd like to customize in your Organization's list of images, and click on the Customize image button at the top of the page.

Learn More

Refer to our Chainguard Containers documentation on Chainguard Academy. Chainguard also offers VMs and Libraries — contact us for access.

Trademarks

This software listing is packaged by Chainguard. The trademarks set forth in this offering are owned by their respective companies, and use of them does not imply any affiliation, sponsorship, or endorsement by such companies.