Skip to content

Commit 8618ed8

Browse files
v-regandownerv-regandowner
authored
Merge pull request #205362 from erik-ha-msft/erikha-aks-windows-fips
[AKS] - FIPS for Windows
2 parents aaf79ba + 0f75ea0 commit 8618ed8

File tree

4 files changed

+140
-73
lines changed

4 files changed

+140
-73
lines changed

‎articles/aks/TOC.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -297,6 +297,8 @@
297297
href: azure-disk-customer-managed-keys.md
298298
- name: Enable host-based encryption
299299
href: enable-host-encryption.md
300+
- name: Enable FIPS
301+
href: enable-fips-nodes.md
300302
- name: Application security
301303
items:
302304
- name: Use Azure AD pod identity (preview)

‎articles/aks/enable-fips-nodes.md

Lines changed: 135 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,135 @@
1+
---
2+
title: Enable Federal Information Process Standard (FIPS) for Azure Kubernetes Service (AKS) node pools
3+
description: Learn how to enable Federal Information Process Standard (FIPS) for Azure Kubernetes Service (AKS) node pools.
4+
author: erik-ha-msft
5+
ms.author: erikha
6+
ms.service: container-service
7+
ms.topic: how-to
8+
ms.date: 07/19/2022
9+
ms.custom: template-how-to
10+
---
11+
12+
# Enable Federal Information Process Standard (FIPS) for Azure Kubernetes Service (AKS) node pools
13+
14+
The Federal Information Processing Standard (FIPS) 140-2 is a US government standard that defines minimum security requirements for cryptographic modules in information technology products and systems. Azure Kubernetes Service (AKS) allows you to create Linux and Windows node pools with FIPS 140-2 enabled. Deployments running on FIPS-enabled node pools can use those cryptographic modules to provide increased security and help meet security controls as part of FedRAMP compliance. For more information on FIPS 140-2, see [Federal Information Processing Standard (FIPS) 140][fips].
15+
16+
## Prerequisites
17+
18+
You need the Azure CLI version 2.32.0 or later installed and configured. Run `az --version` to find the version. For more information about installing or upgrading the Azure CLI, see [Install Azure CLI][install-azure-cli].
19+
20+
FIPS-enabled node pools have the following limitations:
21+
22+
* FIPS-enabled node pools require Kubernetes version 1.19 and greater.
23+
* To update the underlying packages or modules used for FIPS, you must use [Node Image Upgrade][node-image-upgrade].
24+
* Container images on the FIPS nodes haven't been assessed for FIPS compliance.
25+
26+
> [!IMPORTANT]
27+
> The FIPS-enabled Linux image is a different image than the default Linux image used for Linux-based node pools. To enable FIPS on a node pool, you must create a new Linux-based node pool. You can't enable FIPS on existing node pools.
28+
>
29+
> FIPS-enabled node images may have different version numbers, such as kernel version, than images that are not FIPS-enabled. Also, the update cycle for FIPS-enabled node pools and node images may differ from node pools and images that are not FIPS-enabled.
30+
31+
## Create a FIPS-enabled Linux node pool
32+
33+
To create a FIPS-enabled Linux node pool, use the [az aks nodepool add][az-aks-nodepool-add] command with the `--enable-fips-image` parameter when creating a node pool.
34+
35+
```azurecli-interactive
36+
az aks nodepool add \
37+
--resource-group myResourceGroup \
38+
--cluster-name myAKSCluster \
39+
--name fipsnp \
40+
--enable-fips-image
41+
```
42+
43+
> [!NOTE]
44+
> You can also use the `--enable-fips-image` parameter with [az aks create][az-aks-create] when creating a cluster to enable FIPS on the default node pool. When adding node pools to a cluster created in this way, you still must use the `--enable-fips-image` parameter when adding node pools to create a FIPS-enabled node pool.
45+
46+
To verify your node pool is FIPS-enabled, use [az aks show][az-aks-show] to check the *enableFIPS* value in *agentPoolProfiles*.
47+
48+
```azurecli-interactive
49+
az aks show \
50+
--resource-group myResourceGroup \
51+
--name myAKSCluster \
52+
--query="agentPoolProfiles[].{Name:name enableFips:enableFips}" \
53+
-o table
54+
```
55+
56+
The following example output shows the *fipsnp* node pool is FIPS-enabled and *nodepool1* isn't.
57+
58+
```output
59+
Name enableFips
60+
--------- ------------
61+
fipsnp True
62+
nodepool1 False
63+
```
64+
65+
You can also verify deployments have access to the FIPS cryptographic libraries using `kubectl debug` on a node in the FIPS-enabled node pool. Use `kubectl get nodes` to list the nodes:
66+
67+
```output
68+
$ kubectl get nodes
69+
NAME STATUS ROLES AGE VERSION
70+
aks-fipsnp-12345678-vmss000000 Ready agent 6m4s v1.19.9
71+
aks-fipsnp-12345678-vmss000001 Ready agent 5m21s v1.19.9
72+
aks-fipsnp-12345678-vmss000002 Ready agent 6m8s v1.19.9
73+
aks-nodepool1-12345678-vmss000000 Ready agent 34m v1.19.9
74+
```
75+
76+
In the above example, the nodes starting with `aks-fipsnp` are part of the FIPS-enabled node pool. Use `kubectl debug` to run a deployment with an interactive session on one of those nodes in the FIPS-enabled node pool.
77+
78+
```azurecli-interactive
79+
kubectl debug node/aks-fipsnp-12345678-vmss000000 -it --image=mcr.microsoft.com/dotnet/runtime-deps:6.0
80+
```
81+
82+
From the interactive session, you can verify the FIPS cryptographic libraries are enabled:
83+
84+
```output
85+
root@aks-fipsnp-12345678-vmss000000:/# cat /proc/sys/crypto/fips_enabled
86+
1
87+
```
88+
89+
FIPS-enabled node pools also have a *kubernetes.azure.com/fips_enabled=true* label, which can be used by deployments to target those node pools.
90+
91+
## Create a FIPS-enabled Windows node pool
92+
93+
To create a FIPS-enabled Windows node pool, use the [az aks nodepool add][az-aks-nodepool-add] command with the `--enable-fips-image` parameter when creating a node pool. Unlike Linux-based node pools, Windows node pools share the same image set.
94+
95+
```azurecli-interactive
96+
az aks nodepool add \
97+
--resource-group myResourceGroup \
98+
--cluster-name myAKSCluster \
99+
--name fipsnp \
100+
--enable-fips-image \
101+
--os-type Windows
102+
```
103+
104+
To verify your node pool is FIPS-enabled, use [az aks show][az-aks-show] to check the *enableFIPS* value in *agentPoolProfiles*.
105+
106+
```azurecli-interactive
107+
az aks show \
108+
--resource-group myResourceGroup \
109+
--name myAKSCluster \
110+
--query="agentPoolProfiles[].{Name:name enableFips:enableFips}" \
111+
-o table
112+
```
113+
114+
To verify Windows node pools have access to the FIPS cryptographic libraries, [create an RDP connection to a Windows node][aks-rdp] in a FIPS-enabled node pool and check the registry.
115+
116+
1. From the **Run** application, enter `regedit`.
117+
1. Look for `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\FIPSAlgorithmPolicy` in the registry.
118+
1. If `Enabled` is set to 1, then FIPS is enabled.
119+
120+
:::image type="content" source="./media/enable-fips-nodes/enable-fips-nodes-windows.png" alt-text="Screenshot shows a picture of the registry editor to the FIPS Algorithm Policy, and it being enabled.":::
121+
122+
FIPS-enabled node pools also have a *kubernetes.azure.com/fips_enabled=true* label, which can be used by deployments to target those node pools.
123+
124+
## Next steps
125+
126+
To learn more about AKS security, see [Best practices for cluster security and upgrades in Azure Kubernetes Service (AKS)][aks-best-practices-security].
127+
128+
<!-- LINKS - Internal -->
129+
[az-aks-nodepool-add]: /cli/azure/aks/nodepool#az-aks-nodepool-add
130+
[az-aks-show]: /cli/azure/aks#az_aks_show
131+
[aks-best-practices-security]: operator-best-practices-cluster-security.md
132+
[aks-rdp]: rdp.md
133+
[fips]: /azure/compliance/offerings/offering-fips-140-2
134+
[install-azure-cli]: /cli/azure/install-azure-cli
135+
[node-image-upgrade]: node-image-upgrade.md

‎articles/aks/media/enable-fips-nodes/enable-fips-nodes-windows.png

33.4 KB
Loading

‎articles/aks/use-multiple-node-pools.md

Lines changed: 3 additions & 73 deletions
Original file line numberDiff line numberDiff line change
@@ -409,7 +409,7 @@ As your application workloads demands, you may associate node pools to capacity
409409

410410
For more information on the capacity reservation groups, please refer to [Capacity Reservation Groups][capacity-reservation-groups].
411411

412-
Associating a node pool with an existing capacity reservation group can be done using [az aks nodepool add][az-aks-nodepool-add] command and specifying a capacity reservation group with the --capacityReservationGroup flag" The capacity reservation group should already exist , otherwise the node pool will be added to the cluster with a warning and no capacity reservation group gets associated.
412+
Associating a node pool with an existing capacity reservation group can be done using [az aks nodepool add][az-aks-nodepool-add] command and specifying a capacity reservation group with the --capacityReservationGroup flag" The capacity reservation group should already exist, otherwise the node pool will be added to the cluster with a warning and no capacity reservation group gets associated.
413413

414414
```azurecli-interactive
415415
az aks nodepool add -g MyRG --cluster-name MyMC -n myAP --capacityReservationGroup myCRG
@@ -605,77 +605,7 @@ For more information on using Azure tags with node pools, see [Use Azure tags in
605605

606606
## Add a FIPS-enabled node pool
607607

608-
The Federal Information Processing Standard (FIPS) 140-2 is a US government standard that defines minimum security requirements for cryptographic modules in information technology products and systems. AKS allows you to create Linux-based node pools with FIPS 140-2 enabled. Deployments running on FIPS-enabled node pools can use those cryptographic modules to provide increased security and help meet security controls as part of FedRAMP compliance. For more information on FIPS 140-2, see [Federal Information Processing Standard (FIPS) 140-2][fips].
609-
610-
### Prerequisites
611-
612-
You need the Azure CLI version 2.32.0 or later installed and configured. Run `az --version` to find the version. If you need to install or upgrade, see [Install Azure CLI][install-azure-cli].
613-
614-
FIPS-enabled node pools have the following limitations:
615-
616-
* Currently, you can only have FIPS-enabled Linux-based node pools running on Ubuntu 18.04.
617-
* FIPS-enabled node pools require Kubernetes version 1.19 and greater.
618-
* To update the underlying packages or modules used for FIPS, you must use [Node Image Upgrade][node-image-upgrade].
619-
* Container Images on the FIPS nodes haven't been assessed for FIPS compliance.
620-
621-
> [!IMPORTANT]
622-
> The FIPS-enabled Linux image is a different image than the default Linux image used for Linux-based node pools. To enable FIPS on a node pool, you must create a new Linux-based node pool. You can't enable FIPS on existing node pools.
623-
>
624-
> FIPS-enabled node images may have different version numbers, such as kernel version, than images that are not FIPS-enabled. Also, the update cycle for FIPS-enabled node pools and node images may differ from node pools and images that are not FIPS-enabled.
625-
626-
To create a FIPS-enabled node pool, use [az aks nodepool add][az-aks-nodepool-add] with the *--enable-fips-image* parameter when creating a node pool.
627-
628-
```azurecli-interactive
629-
az aks nodepool add \
630-
--resource-group myResourceGroup \
631-
--cluster-name myAKSCluster \
632-
--name fipsnp \
633-
--enable-fips-image
634-
```
635-
636-
> [!NOTE]
637-
> You can also use the *--enable-fips-image* parameter with [az aks create][az-aks-create] when creating a cluster to enable FIPS on the default node pool. When adding node pools to a cluster created in this way, you still must use the *--enable-fips-image* parameter when adding node pools to create a FIPS-enabled node pool.
638-
639-
To verify your node pool is FIPS-enabled, use [az aks show][az-aks-show] to check the *enableFIPS* value in *agentPoolProfiles*.
640-
641-
```azurecli-interactive
642-
az aks show --resource-group myResourceGroup --name myAKSCluster --query="agentPoolProfiles[].{Name:name enableFips:enableFips}" -o table
643-
```
644-
645-
The following example output shows the *fipsnp* node pool is FIPS-enabled and *nodepool1* isn't.
646-
647-
```output
648-
Name enableFips
649-
--------- ------------
650-
fipsnp True
651-
nodepool1 False
652-
```
653-
654-
You can also verify deployments have access to the FIPS cryptographic libraries using `kubectl debug` on a node in the FIPS-enabled node pool. Use `kubectl get nodes` to list the nodes:
655-
656-
```output
657-
$ kubectl get nodes
658-
NAME STATUS ROLES AGE VERSION
659-
aks-fipsnp-12345678-vmss000000 Ready agent 6m4s v1.19.9
660-
aks-fipsnp-12345678-vmss000001 Ready agent 5m21s v1.19.9
661-
aks-fipsnp-12345678-vmss000002 Ready agent 6m8s v1.19.9
662-
aks-nodepool1-12345678-vmss000000 Ready agent 34m v1.19.9
663-
```
664-
665-
In the above example, the nodes starting with `aks-fipsnp` are part of the FIPS-enabled node pool. Use `kubectl debug` to run a deployment with an interactive session on one of those nodes in the FIPS-enabled node pool.
666-
667-
```azurecli-interactive
668-
kubectl debug node/aks-fipsnp-12345678-vmss000000 -it --image=mcr.microsoft.com/dotnet/runtime-deps:6.0
669-
```
670-
671-
From the interactive session, you can verify the FIPS cryptographic libraries are enabled:
672-
673-
```output
674-
root@aks-fipsnp-12345678-vmss000000:/# cat /proc/sys/crypto/fips_enabled
675-
1
676-
```
677-
678-
FIPS-enabled node pools also have a *kubernetes.azure.com/fips_enabled=true* label, which can be used by deployments to target those node pools.
608+
For more information on enabling Federal Information Process Standard (FIPS) for your AKS cluster, see [Enable Federal Information Process Standard (FIPS) for Azure Kubernetes Service (AKS) node pools][enable-fips-nodes].
679609

680610
## Manage node pools using a Resource Manager template
681611

@@ -911,6 +841,7 @@ Use [proximity placement groups][reduce-latency-ppg] to reduce latency for your
911841
[az-group-delete]: /cli/azure/group#az_group_delete
912842
[az-deployment-group-create]: /cli/azure/deployment/group#az_deployment_group_create
913843
[az-aks-nodepool-add]: /cli/azure/aks#az_aks_nodepool_add
844+
[enable-fips-nodes]: enable-fips-nodes.md
914845
[gpu-cluster]: gpu-cluster.md
915846
[install-azure-cli]: /cli/azure/install-azure-cli
916847
[operator-best-practices-advanced-scheduler]: operator-best-practices-advanced-scheduler.md
@@ -927,7 +858,6 @@ Use [proximity placement groups][reduce-latency-ppg] to reduce latency for your
927858
[public-ip-prefix-benefits]: ../virtual-network/ip-services/public-ip-address-prefix.md
928859
[az-public-ip-prefix-create]: /cli/azure/network/public-ip/prefix#az_network_public_ip_prefix_create
929860
[node-image-upgrade]: node-image-upgrade.md
930-
[fips]: /azure/compliance/offerings/offering-fips-140-2
931861
[use-tags]: use-tags.md
932862
[use-labels]: use-labels.md
933863
[cordon-and-drain]: resize-node-pool.md#cordon-the-existing-nodes

0 commit comments

Comments
 (0)