| Environment variable | Description |
|---|---|
DQ_APP_FIPS_ENABLED | Optional. Set to true to enable FIPS-compliant algorithms. In standalone, this must be enabled in the setup.sh and owlmanage.sh file upon the installation of Data Quality & Observability (self-hosted). The system also performs a series of tests to determine if the environment is FIPS compliant. Default is false. |
DQ_APP_AES_ENCRYPTION_KEY | Optional. Only required when using your own Java security provider, algorithm, and encryption key. Enter the key for AES encryption from your preferred provider. Defaults to the Collibra DQ AES key. |
DQ_FIPS_PROVIDER_NAME | Optional. Only required when using your own Java security provider, algorithm, and encryption key. Provide your own provider implementation. Defaults to Bouncy Castle, which is supported in Collibra DQ and considered one of the secure and compliant FIPS providers. |
DQ_FIPS_ALGORITHM | Optional. Only required when using your own Java security provider, algorithm, and encryption key. Provide an algorithm supported by your FIPS provider. Defaults to password-based AES 128 encryption algorithm complaint with FIPS. |
DQ_APP_ENCRYPTION_AT_REST_MODE | Optional. Specifies whether to use the legacy or hybrid cryptosystem. For FIPS compliance, set to hybrid. Default is legacy. |
DQ_APP_ENCRYPTION_AT_REST_MIGRATION | Optional. For existing customers that need to migrate from legacy to hybrid encryption at rest mode. Performs migration to new encryption key during startup. After completing the initial migration, disable this setting. Default is false. |
**Settings** and select **Admin Console**.\ :chevrons-right: The Admin Console opens.
{% endstep %}
{% step %}
Click **Agent Configuration**.\ :chevrons-right: The Agent Configuration page opens.
{% endstep %}
{% step %}
In the Actions column, click 
to edit your agent.\ :chevrons-right: The **Edit Agent** modal appears.
{% endstep %}
{% step %}
In the Free Form (Appended) field, enter the following configuration and ensure that the Bouncy Castle FIPS JAR file, such as **bc-fips-x.jar**, is included in the directory.
```
-addlib $OWL_HOME/bin/external/
```
{% endstep %}
{% step %}
Restart the DQ web application and DQ agent services.
{% endstep %}
{% endstepper %}
### Example of environment variables when using the default Bouncy Castle FIPS provider and Collibra DQ values
```
export DQ_APP_FIPS_ENABLED=true
export DBPASSWORD="String to Encrypt"
# If successful, the following command will return encrypted string
java -cp dq-core.jar:bc-fips-1.0.2.5.jar com.owl.core.security.SecurityManager -encryptString $DBPASSWORD
```
{% endtab %}
{% tab title="Cloud Native" %}
{% stepper %}
{% step %}
Before installing Data Quality & Observability (self-hosted), generate a Java truststore and keystore using a FIPS-compliant algorithm (BCFKS).
{% endstep %}
{% step %}
Create a kubernetes secret using the new keystore.
{% endstep %}
{% step %}
Pull the DQ container images that are FIPS compliant (with the `-fips` suffix). For example:
```
docker pull gcr.io/owl-hadoop-cdh/dq-web-fips:2026.02-ABDGCSHILM-4227
docker pull gcr.io/owl-hadoop-cdh/dq-agent-fips:2026.02-ABDGCSHILM-4227
docker pull gcr.io/owl-hadoop-cdh/dq-livy-fips:4.1.0-2026.02-ABDGCSHILM-4227
docker pull gcr.io/owl-hadoop-cdh/dq-spark-fips:4.1.0-2026.02-ABDGCSHILM-4227
```
{% endstep %}
{% endstepper %}
{% hint style="warning" %}
Livy interactive sessions are not supported in FIPS mode on Kubernetes. Data preview for remote-file connectors and rule and query preview for JDBC connections are not available until this limitation is resolved.
{% endhint %}
{% stepper %}
{% step %}
Configure the JVM with Bouncy Castle FIPS (BCFIPS) as the primary security provider. Internal keystores or truststores must be in BCFKS format.
1. Ensure that the entry **org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider** is set as the security provider in **$JAVA\_HOME/conf/security/java.security**.
:glasses-round: Example: `security.provider.13=org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider`
***
{% endstep %}
{% step %}
Set the OS environment variable `DQ_APP_FIPS_ENABLED` to **true**.
{% endstep %}
{% step %}
Set the additional keystore properties for the DQ web application and DQ agent:
```
DQ_APP_ENCRYPTION_AT_REST_MODE: HYBRID
KEYSTORE_FILEPATH: /opt/owl/keystore/mykeystore.bcfks
KEYSTORE_PRIVATEKEY_ALIAS: mykeypair
KEYSTORE_PUBLICKEY_ALIAS: mykeypair
KEYSTORE_SECRETS_SOURCE: FILE
KEYSTORE_TYPE: BCFKS
```
{% hint style="warning" %}
If FIPS is enabled, specify the path to the keystore in `KEYSTORE_FILEPATH` (instead of `SAML_KEYSTORE_FILE`).
{% endhint %}
{% endstep %}
{% step %}
Set additional sensitive properties for the secret:
```
KEYSTORE_PASSWORD: BASE64OFTHEPASSWORD
KEYSTORE_PRIVATEKEY_PASSWORD: BASE64OFTHEPASSWORD
```
{% endstep %}
{% step %}
Follow the installation steps for [Installing Data Quality & Observability (self-hosted) on self-hosted Kubernetes](/data-quality-self-hosted/installation/installing-data-quality-observability-self-hosted-on-self-hosted-kubernetes.md).
* Add the following statement to the helm chart to make the base image FIPS-compliant:
```
Values.global.cryptography.fips.enabled
```
{% endstep %}
{% step %}
SSL is required for FIPS compliance. Follow the standard steps for [Setting up SSL (HTTPS)](/data-quality-self-hosted/security-configuration/setting-up-ssl-https.md). Note that the datasource URL must end with `sslmode=verify-full`.
{% endstep %}
{% step %}
Create a Spark Pod template k8s-spark-template.yml and mount it at the DQ agent:
```
apiVersion: v1
Kind: Pod
spec:
securityContext:
runAsUser: 1000
runAsGroup: 1000
fsGroup: 1000
volumes:
- name: dq-truststore
secret:
secretName: dq-truststore
- name: dq-fips-keystore
secret:
secretName: dq-fips-keystore
containers:
- volumeMounts:
- name: dq-truststore
mountPath: /etc/custom-ssl
- name: dq-fips-keystore
mountPath: /opt/owl/keystore
```
{% endstep %}
{% step %}
Sign in to Data Quality & Observability (self-hosted).
{% endstep %}
{% step %}
On the Collibra DQ home page, hover your pointer over **Settings** and select **Admin Console**.\ :chevrons-right: The Admin Console opens.
{% endstep %}
{% step %}
Click **Agent Configuration**.\ :chevrons-right: The Agent Configuration page opens.
{% endstep %}
{% step %}
In the Actions column, click to edit your agent.\ :chevrons-right: The **Edit Agent** modal appears.
{% endstep %}
{% step %}
In the Free Form (Appended) field, enter the following configuration and ensure that the Bouncy Castle FIPS JAR file, such as **bc-fips-x.jar**, is included in the directory.
```
-addlib $OWL_HOME/bin/external/
```
{% endstep %}
{% step %}
In the Free Form (Appended) field, enter the following Spark configuration.
```
-conf spark.kubernetes.executor.podTemplateFile=/opt/owl/pod-templates/k8s-spark-template.yml,spark.kubernetes.driver.podTemplateFile=/opt/owl/pod-templates/k8s-spark-template.yml,spark.driver.extraJavaOptions=-Djavax.net.ssl.trustStore=/etc/custom-ssl/truststore.bcfks;-Djavax.net.ssl.trustStoreType=BCFKS;-Djavax.net.ssl.trustStorePassword=changeit
```
{% endstep %}
{% step %}
Restart the DQ web application and DQ agent services.
{% endstep %}
{% endstepper %}
{% endtab %}
{% endtabs %}