You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/aks/enable-fips-nodes.md
+14-7Lines changed: 14 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -146,10 +146,15 @@ FIPS-enabled node pools also have a *kubernetes.azure.com/fips_enabled=true* lab
146
146
147
147
FIPS-enabled node pools also have a *kubernetes.azure.com/fips_enabled=true* label, which deployments can use to target those node pools.
148
148
149
-
## Update an existing Linux node pool to enable or disable FIPS (preview)
149
+
## Update an existing node pool to enable or disable FIPS (preview)
150
+
150
151
Existing node pools can be updated to enable or disable FIPS. If you are planning to migrate your node pools from non-FIPS to FIPS, first validate that your application is working properly in a test environment before migrating it to a production environment. Validating your application in a test environment should prevent issues caused by the FIPS kernel blocking some weak cipher or encryption algorithm, such as an MD4 algorithm that is not FIPS compliant.
152
+
153
+
> [!NOTE]
154
+
> When updating an existing Linux node pool to enable or disable FIPS, the node pool update will move between the fips and non-fips image. This node pool update will trigger a reimage to complete the update. This may cause the node pool update to take a few minutes to complete.
155
+
151
156
### Limitations
152
-
* FIPS cannot be enabled via node pool update for for Windows node pools
157
+
153
158
* Make sure you have installed Azure CLI version 2.56.0 or later, together with the [aks-preview](https://github.com/cli/azure/azure-cli-extensions-list) extension. Run `az --version` to find the version. If you need to install or upgrade, see [Install Azure CLI][install-azure-cli].
154
159
155
160
[!INCLUDE [preview features callout](~/reusable-content/ce-skilling/azure/includes/aks/includes/preview/preview-callout.md)]
@@ -188,10 +193,10 @@ Existing node pools can be updated to enable or disable FIPS. If you are plannin
188
193
az provider register --namespace Microsoft.ContainerService
189
194
```
190
195
191
-
### Enable FIPS on an existing Linux node pool
192
-
Existing Linux node pools can be updated to enable FIPS. When you update an existing node pool, the node image will change from the current image to the recommended FIPS image of the same OS SKU. The node image change will occur after a re-image.
196
+
### Enable FIPS on an existing node pool
197
+
Existing node pools can be updated to enable FIPS. When you update an existing node pool, the node image will change from the current image to the recommended FIPS image of the same OS SKU.
193
198
194
-
1. Update a Linux node pool using the [`az aks nodepool update`][az-aks-nodepool-update] command with the `--enable-fips-image` parameter.
199
+
1. Update a node pool using the [`az aks nodepool update`][az-aks-nodepool-update] command with the `--enable-fips-image` parameter.
195
200
196
201
```azurecli-interactive
197
202
az aks nodepool update \
@@ -201,6 +206,7 @@ Existing Linux node pools can be updated to enable FIPS. When you update an exis
201
206
--enable-fips-image
202
207
```
203
208
209
+
The above command will trigger a reimage. This reimage will occur during the node pool update, no additional steps are required.
204
210
205
211
2. Verify that your node pool is FIPS-enabled using the [`az aks show`][az-aks-show] command and query for the *enableFIPS* value in *agentPoolProfiles*.
206
212
@@ -217,7 +223,7 @@ Existing Linux node pools can be updated to enable FIPS. When you update an exis
217
223
```output
218
224
Name enableFips
219
225
--------- ------------
220
-
np True
226
+
np True
221
227
nodepool1 False
222
228
```
223
229
@@ -253,7 +259,7 @@ Existing Linux node pools can be updated to enable FIPS. When you update an exis
253
259
FIPS-enabled node pools also have a *kubernetes.azure.com/fips_enabled=true* label, which deployments can use to target those node pools.
254
260
255
261
## Disable FIPS on an existing node pool
256
-
Existing Linux node pools can be updated to disable FIPS. When updating an existing node pool, the node image will change from the current FIPS image to the recommended non-FIPS image of the same OS SKU. The node image change will occur after a re-image.
262
+
Existing Linux node pools can be updated to disable FIPS. When updating an existing node pool, the node image will change from the current FIPS image to the recommended non-FIPS image of the same OS SKU. The node image change will occur after a reimage.
257
263
258
264
1. Update a Linux node pool using the [`az aks nodepool update`][az-aks-nodepool-update] command with the `--disable-fips-image` parameter.
259
265
@@ -265,6 +271,7 @@ Existing Linux node pools can be updated to disable FIPS. When updating an exist
265
271
--disable-fips-image
266
272
```
267
273
274
+
The above command will trigger a reimage. This reimage will occur during the node pool update, no additional steps are required.
268
275
269
276
2. Verify that your node pool is not FIPS-enabled using the [`az aks show`][az-aks-show] command and query for the *enableFIPS* value in *agentPoolProfiles*.
0 commit comments