From c362904e0d7c1df110f6a675b8dadabfc34bbe10 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vin=C3=ADcius=20Ferr=C3=A3o?=
 <2031761+viniciusferrao@users.noreply.github.com>
Date: Fri, 17 Jul 2026 16:09:05 -0300
Subject: [PATCH] docs(dhcp): clarify legacy OMAPI FIPS limits
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Vinícius Ferrão <2031761+viniciusferrao@users.noreply.github.com>
---
 .../domain_name_resolution/domain_name_resolution.rst      | 3 +--
 docs/source/guides/admin-guides/references/man5/site.5.rst | 7 +++++--
 perl-xCAT/xCAT/Schema.pm                                   | 7 +++++--
 3 files changed, 11 insertions(+), 6 deletions(-)

diff --git a/docs/source/advanced/domain_name_resolution/domain_name_resolution.rst b/docs/source/advanced/domain_name_resolution/domain_name_resolution.rst
index 1d5f26b8f..1122eb682 100644
--- a/docs/source/advanced/domain_name_resolution/domain_name_resolution.rst
+++ b/docs/source/advanced/domain_name_resolution/domain_name_resolution.rst
@@ -93,7 +93,7 @@ Edit **/etc/resolv.conf** to contain the cluster domain value you set in the sit
 Legacy ISC DHCP and BIND TSIG Key Options
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-xCAT uses **xcat_key** for BIND DDNS updates and legacy ISC DHCP OMAPI. New installations on Enterprise Linux 9 or later and Ubuntu 20.04 or later set **hmac-sha256**. Ubuntu 18.04, SLES 12, SLES 15, and openSUSE Leap 15 leave **dhcpomapialgorithm** unset because their bundled ``omshell`` does not support the ``key-algorithm`` command. If **dhcpomapialgorithm** is not set, including on an existing installation, xCAT continues to use **hmac-md5** for compatibility. Kea does not use OMAPI, but Kea DDNS uses this TSIG algorithm.
+xCAT uses **xcat_key** for BIND DDNS updates and legacy ISC DHCP OMAPI. New installations on Enterprise Linux 9 or later and Ubuntu 20.04 or later set **hmac-sha256**. Ubuntu 18.04, SLES 12, SLES 15, and openSUSE Leap 15 leave **dhcpomapialgorithm** unset because their bundled ``omshell`` does not support the ``key-algorithm`` command. If **dhcpomapialgorithm** is not set, including on an existing installation, xCAT continues to use **hmac-md5** for compatibility. HMAC-MD5 is not approved for FIPS mode; a FIPS-mode site that needs OMAPI must provide an ``omshell`` supporting ``key-algorithm`` and set a SHA-2 algorithm explicitly. Kea does not use OMAPI, but Kea DDNS uses this TSIG algorithm.
 
 To use another supported algorithm, set **dhcpomapialgorithm** in the site table and update the matching **passwd** table secret. Supported values are **hmac-md5**, **hmac-sha1**, **hmac-sha224**, **hmac-sha256**, **hmac-sha384**, and **hmac-sha512**. For example: ::
 
@@ -519,4 +519,3 @@ Execute ``confignetwork -s`` to configure provision IP address as static IP addr
     b. If the compute node is already running, use ``updatenode`` command to run ``confignetwork -s`` postscript without rebooting the node ::
 
         updatenode cn1 -P "confignetwork -s"
-
diff --git a/docs/source/guides/admin-guides/references/man5/site.5.rst b/docs/source/guides/admin-guides/references/man5/site.5.rst
index 69b3be415..0496a919e 100644
--- a/docs/source/guides/admin-guides/references/man5/site.5.rst
+++ b/docs/source/guides/admin-guides/references/man5/site.5.rst
@@ -102,8 +102,11 @@ site Attributes:
                         omshell does not support the key-algorithm command.
                         When this attribute is not set, including on an
                         existing installation, xCAT uses hmac-md5 for
-                        compatibility. Kea does not use OMAPI, but Kea DDNS
-                        uses this TSIG algorithm.
+                        compatibility. HMAC-MD5 is not approved for FIPS
+                        mode; a FIPS-mode site that needs OMAPI must provide
+                        an omshell supporting key-algorithm and explicitly
+                        select a SHA-2 algorithm. Kea does not use OMAPI, but
+                        Kea DDNS uses this TSIG algorithm.
 
    dhcpomapikeyname:  The TSIG/OMAPI key name used by legacy ISC DHCP and
                      BIND DDNS integration. The default is xcat_key. The
diff --git a/perl-xCAT/xCAT/Schema.pm b/perl-xCAT/xCAT/Schema.pm
index b8481038b..7f1578a3b 100644
--- a/perl-xCAT/xCAT/Schema.pm
+++ b/perl-xCAT/xCAT/Schema.pm
@@ -1052,8 +1052,11 @@ passed as argument rather than by table value',
 "                      omshell does not support the key-algorithm command.\n" .
 "                      When this attribute is not set, including on an\n" .
 "                      existing installation, xCAT uses hmac-md5 for\n" .
-"                      compatibility. Kea does not use OMAPI, but Kea DDNS\n" .
-"                      uses this TSIG algorithm.\n\n" .
+"                      compatibility. HMAC-MD5 is not approved for FIPS\n" .
+"                      mode; a FIPS-mode site that needs OMAPI must provide\n" .
+"                      an omshell supporting key-algorithm and explicitly\n" .
+"                      select a SHA-2 algorithm. Kea does not use OMAPI, but\n" .
+"                      Kea DDNS uses this TSIG algorithm.\n\n" .
 " dhcpomapikeyname:  The TSIG/OMAPI key name used by legacy ISC DHCP and\n" .
 "                   BIND DDNS integration. The default is xcat_key. The\n" .
 "                   value maps to the passwd table entry where key=omapi\n" .