Fails on FIPS enabled nodes

[davidkarlsen]

Describe the bug

status:
  conditions:
  - lastTransitionTime: "2022-08-18T13:20:35.226Z"
    message: 'java.io.IOException: getPBEAlgorithmParameters failed: PBEWithHmacSHA256AndAES_256
      AlgorithmParameters not available'
    reason: RuntimeException
    status: "True"
    type: NotReady
  observedGeneration: 1

To Reproduce
Steps to reproduce the behavior:

1. have FIPS enabled nodes
2. declare resource as in [*]

[*]

apiVersion: kafka.strimzi.io/v1beta2
kind: Kafka
metadata:
  creationTimestamp: "2022-08-18T13:20:32Z"
  generation: 1
  name: test
  namespace: jfr-dev
  resourceVersion: "2977695313"
  uid: ab911481-b72a-4549-b7b2-f94af9f0c655
spec:
  entityOperator:
    topicOperator: {}
    userOperator: {}
  kafka:
    config:
      default.replication.factor: 3
      inter.broker.protocol.version: "3.2"
      min.insync.replicas: 2
      offsets.topic.replication.factor: 3
      transaction.state.log.min.isr: 2
      transaction.state.log.replication.factor: 3
    listeners:
    - name: plain
      port: 9092
      tls: false
      type: internal
    - name: tls
      port: 9093
      tls: true
      type: internal
    replicas: 3
    storage:
      type: ephemeral
    version: 3.2.0
  zookeeper:
    replicas: 3
    storage:
      type: ephemeral

Expected behavior
should roll out cluster

Environment (please complete the following information):

• Strimzi version: 0.30.0
• Installation method: OLM
• Kubernetes cluster: OCP 4.10
• Infrastructure: BareMetal/vsphere

YAML files and logs
See issuedescription

Additional context
Nodes are FIPS enabled.

[scholzj]

Strimzi does not support FIPS. If you want to run Strimzi on FIPS enabled cluster, you can disable the FIPS mode in Strimzi containers through the FIPS_MODE environment variable of the cluster operator: https://strimzi.io/docs/operators/latest/full/configuring.html#proc-configuring-fips-mode-cluster-operator-str

[scholzj]

(A better FIPS support might be added in the future as OPenJDK improves their FIPS support and allow use of PKCS12 instead of NSS)

[davidkarlsen]

Doh - just realized this was documented in: https://strimzi.io/docs/operators/latest/full/configuring.html#proc-configuring-fips-mode-cluster-operator-str