Skip to content

Commit 9e7dcec

Browse files
committed
remove windows limitation and address comments
1 parent 29e024c commit 9e7dcec

File tree

1 file changed

+14
-7
lines changed

1 file changed

+14
-7
lines changed

articles/aks/enable-fips-nodes.md

Lines changed: 14 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -146,10 +146,15 @@ FIPS-enabled node pools also have a *kubernetes.azure.com/fips_enabled=true* lab
146146
147147
FIPS-enabled node pools also have a *kubernetes.azure.com/fips_enabled=true* label, which deployments can use to target those node pools.
148148
149-
## Update an existing Linux node pool to enable or disable FIPS (preview)
149+
## Update an existing node pool to enable or disable FIPS (preview)
150+
150151
Existing node pools can be updated to enable or disable FIPS. If you are planning to migrate your node pools from non-FIPS to FIPS, first validate that your application is working properly in a test environment before migrating it to a production environment. Validating your application in a test environment should prevent issues caused by the FIPS kernel blocking some weak cipher or encryption algorithm, such as an MD4 algorithm that is not FIPS compliant.
152+
153+
> [!NOTE]
154+
> When updating an existing Linux node pool to enable or disable FIPS, the node pool update will move between the fips and non-fips image. This node pool update will trigger a reimage to complete the update. This may cause the node pool update to take a few minutes to complete.
155+
151156
### Limitations
152-
* FIPS cannot be enabled via node pool update for for Windows node pools
157+
153158
* Make sure you have installed Azure CLI version 2.56.0 or later, together with the [aks-preview](https://github.com/cli/azure/azure-cli-extensions-list) extension. Run `az --version` to find the version. If you need to install or upgrade, see [Install Azure CLI][install-azure-cli].
154159
155160
[!INCLUDE [preview features callout](~/reusable-content/ce-skilling/azure/includes/aks/includes/preview/preview-callout.md)]
@@ -188,10 +193,10 @@ Existing node pools can be updated to enable or disable FIPS. If you are plannin
188193
az provider register --namespace Microsoft.ContainerService
189194
```
190195
191-
### Enable FIPS on an existing Linux node pool
192-
Existing Linux node pools can be updated to enable FIPS. When you update an existing node pool, the node image will change from the current image to the recommended FIPS image of the same OS SKU. The node image change will occur after a re-image.
196+
### Enable FIPS on an existing node pool
197+
Existing node pools can be updated to enable FIPS. When you update an existing node pool, the node image will change from the current image to the recommended FIPS image of the same OS SKU.
193198
194-
1. Update a Linux node pool using the [`az aks nodepool update`][az-aks-nodepool-update] command with the `--enable-fips-image` parameter.
199+
1. Update a node pool using the [`az aks nodepool update`][az-aks-nodepool-update] command with the `--enable-fips-image` parameter.
195200
196201
```azurecli-interactive
197202
az aks nodepool update \
@@ -201,6 +206,7 @@ Existing Linux node pools can be updated to enable FIPS. When you update an exis
201206
--enable-fips-image
202207
```
203208
209+
The above command will trigger a reimage. This reimage will occur during the node pool update, no additional steps are required.
204210
205211
2. Verify that your node pool is FIPS-enabled using the [`az aks show`][az-aks-show] command and query for the *enableFIPS* value in *agentPoolProfiles*.
206212
@@ -217,7 +223,7 @@ Existing Linux node pools can be updated to enable FIPS. When you update an exis
217223
```output
218224
Name enableFips
219225
--------- ------------
220-
np True
226+
np True
221227
nodepool1 False
222228
```
223229
@@ -253,7 +259,7 @@ Existing Linux node pools can be updated to enable FIPS. When you update an exis
253259
FIPS-enabled node pools also have a *kubernetes.azure.com/fips_enabled=true* label, which deployments can use to target those node pools.
254260
255261
## Disable FIPS on an existing node pool
256-
Existing Linux node pools can be updated to disable FIPS. When updating an existing node pool, the node image will change from the current FIPS image to the recommended non-FIPS image of the same OS SKU. The node image change will occur after a re-image.
262+
Existing Linux node pools can be updated to disable FIPS. When updating an existing node pool, the node image will change from the current FIPS image to the recommended non-FIPS image of the same OS SKU. The node image change will occur after a reimage.
257263
258264
1. Update a Linux node pool using the [`az aks nodepool update`][az-aks-nodepool-update] command with the `--disable-fips-image` parameter.
259265
@@ -265,6 +271,7 @@ Existing Linux node pools can be updated to disable FIPS. When updating an exist
265271
--disable-fips-image
266272
```
267273
274+
The above command will trigger a reimage. This reimage will occur during the node pool update, no additional steps are required.
268275
269276
2. Verify that your node pool is not FIPS-enabled using the [`az aks show`][az-aks-show] command and query for the *enableFIPS* value in *agentPoolProfiles*.
270277

0 commit comments

Comments
 (0)