Enable Federal Information Processing Standard (FIPS) for Azure Kubernetes Service (AKS) clusters (preview)

The Federal Information Processing Standard (FIPS) is a US government standard that defines minimum security requirements for cryptographic modules in information technology products and systems. This article describes how to enable FIPS mode at the cluster level for Azure Kubernetes Service (AKS). Cluster-level FIPS enforces that every node pool in the cluster uses a FIPS-enabled OS image, and it blocks AKS-managed components that aren't FIPS-compliant. This capability is intended for customers with compliance requirements such as FedRAMP who need a single, declarative way to ensure FIPS usage across their AKS cluster. For more information on FIPS, see Federal Information Processing Standard (FIPS) 140.

What is FIPS mode in AKS?

FIPS 140-2/140-3 defines U.S. government standards for cryptographic modules. When you enable FIPS mode on an AKS cluster:

• All node pools in the cluster, including Windows node pools, must use FIPS-enabled OS images.
• AKS blocks creation of non-FIPS node pools.
• AKS blocks AKS-managed add-ons, features, and extensions that aren't validated for FIPS compliance.

Cluster-level FIPS (properties.enableFIPS) is separate from FIPS on individual node pools (enableFIPS on each agent pool). Cluster-level FIPS requires every node pool to be FIPS-enabled, but disabling cluster-level FIPS doesn't disable FIPS on your node pools. For more information about FIPS-enabled node pools, see Enable FIPS for AKS node pools.

Prerequisites

• An active Azure subscription. If you don't have an Azure subscription, create a free account before you begin.
• Azure CLI version 2.86.0 or later installed and configured. To find the version, run az --version. For more information about installing or upgrading the Azure CLI, see Install Azure CLI.
• The latest version of the aks-preview Azure CLI extension. The --enable-fips and --disable-fips parameters are available only in the aks-preview extension. For instructions, see Install the aks-preview Azure CLI extension.
• The k8s-extension Azure CLI extension, used to list and remove cluster extensions. Install it by running az extension add --upgrade --name k8s-extension.
• kubectl installed. You can install it locally by using the az aks install-cli command.
• The EnableFIPSPreview feature flag registered on your subscription. For instructions, see Register the EnableFIPSPreview feature flag.
• Kubernetes version 1.35.0 or later. To see the versions available in your region, use the az aks get-versions command. A FIPS-enabled cluster on an earlier version isn't grandfathered: AKS rejects every update to the cluster until you upgrade it to 1.35.0 or later or disable FIPS.
• If you use Azure Resource Manager (ARM) templates or the REST API, use API version 2026-03-02-preview or later for Microsoft.ContainerService/managedClusters and Microsoft.ContainerService/managedClusters/agentPools.

Install the aks-preview Azure CLI extension

1. Install the aks-preview extension by using the az extension add command.

   az extension add --name aks-preview
   

2. Update to the latest version of the extension by using the az extension update command.

   az extension update --name aks-preview
   

Set environment variables

Set the following environment variables for the resources that you use in this article. Replace the placeholder values with your own. Then set your subscription context by using the az account set command.

export SUBSCRIPTION_ID="<subscription-id>"
export RESOURCE_GROUP="myResourceGroup"
export CLUSTER_NAME="myAKSCluster"
export NODE_POOL_NAME="fipsnp"

az account set --subscription $SUBSCRIPTION_ID

Register the EnableFIPSPreview feature flag

1. Register the EnableFIPSPreview feature flag by using the az feature register command.

   az feature register --namespace "Microsoft.ContainerService" --name "EnableFIPSPreview"
   

   It takes a few minutes for the status to show Registered.

2. Verify the registration status by using the az feature show command.

   az feature show --namespace "Microsoft.ContainerService" --name "EnableFIPSPreview"
   

3. When the status shows Registered, refresh the registration of the Microsoft.ContainerService resource provider by using the az provider register command.

   az provider register --namespace Microsoft.ContainerService
   

Limitations

The following limitations apply when using FIPS-enabled AKS clusters.

• Some AKS-managed components aren't FIPS-compliant and are blocked on FIPS-enabled clusters. For the list, see Blocked components.

• Node pools that use a Kata workload runtime (KataVmIsolation, KataMshvVmIsolation, or KataCcIsolation) aren't supported.

• Node pools that use the preview node pool–level custom CA trust setting (enableCustomCATrust) aren't supported. Use cluster-level custom certificate authority trust instead.

• All limitations documented for FIPS-enabled node pools also apply to FIPS-enabled clusters, including OS, image, and upgrade constraints. For details, see Enable Federal Information Processing Standard (FIPS) for Azure Kubernetes Service (AKS) node pools.

Blocked components

Some AKS-managed components aren't yet built with FIPS-compliant cryptographic libraries. You can't enable these components on a FIPS-enabled cluster, and you can't enable FIPS on a cluster that uses them. The following table lists the blocked components and the Azure CLI command to disable each one. Add --resource-group $RESOURCE_GROUP --name $CLUSTER_NAME to each az aks command.

If an automation, such as an Azure Policy assignment, tries to install an extension that isn't FIPS-compliant on a FIPS-enabled cluster, AKS rejects the installation and the extension shows a Failed provisioning state. The cluster isn't affected.

Create a FIPS-enabled AKS cluster

You can enable FIPS when you create the cluster by using the --enable-fips flag. The cluster can't use any of the blocked components.

1. Create a FIPS-enabled AKS cluster by using the az aks create command with the --enable-fips parameter.

   az aks create \
       --name $CLUSTER_NAME \
       --resource-group $RESOURCE_GROUP \
       --kubernetes-version 1.35 \
       --enable-fips \
       --generate-ssh-keys
   

2. Verify your cluster is FIPS-enabled by using the az aks show command and query for the enableFips value.

   az aks show \
       --name $CLUSTER_NAME \
       --resource-group $RESOURCE_GROUP \
       --query "enableFips"
   

   The following example output shows your cluster is FIPS-enabled:

   true
   

   If the command doesn't return true, you didn't install the aks-preview extension when you created the cluster. Without the extension, the Azure CLI treats --enable-fips as --enable-fips-image and enables FIPS only on the default node pool. Install the aks-preview extension, and then enable FIPS on the existing cluster.

3. Creating a FIPS-enabled cluster automatically creates a FIPS-enabled node pool. You can verify this by inspecting the node pool configuration by using the az aks show command and query for the enableFips value in agentPoolProfiles.

   az aks show \
       --name $CLUSTER_NAME \
       --resource-group $RESOURCE_GROUP \
       --query "agentPoolProfiles[].{Name:name, enableFips:enableFips}" \
       --output table
   

   The following example output shows the default node pool is FIPS-enabled:

   Name       EnableFips
   ---------  ----------
   nodepool1  True
   

Update an existing AKS cluster to enable or disable FIPS

To enable FIPS on an existing cluster, prepare the cluster first, and then update it.

Prepare your cluster for FIPS

Complete the following steps before you enable FIPS at the cluster level.

1. Make sure the cluster runs Kubernetes version 1.35.0 or later. If your cluster is running an earlier version, upgrade the cluster first. For instructions, see Upgrade an AKS cluster.

2. Make sure every node pool is FIPS-enabled. Update each non-FIPS node pool to use FIPS-enabled images. For instructions, see Update an existing node pool to enable or disable FIPS.

   Windows Server 2022 node pools already run with FIPS enabled in the OS, but their enableFips property is False unless you set it. Run az aks nodepool update --enable-fips-image on these node pools too. For these node pools, the update sets the property and doesn't change the node image.

3. Disable or remove every component that's listed in Blocked components, including cluster extensions that aren't FIPS-compliant. To list the extensions on your cluster, use the az k8s-extension list command. To remove an extension, use the az k8s-extension delete command. For more information, see Manage AKS extensions.

   az k8s-extension list \
       --resource-group $RESOURCE_GROUP \
       --cluster-name $CLUSTER_NAME \
       --cluster-type managedClusters \
       --query "[].{name:name, extensionType:extensionType, state:provisioningState}" \
       --output table
   

   Note

   An extension can be installed automatically after cluster creation, for example by an Azure Policy assignment. List the extensions again right before you enable FIPS. If an assignment keeps installing an extension that isn't FIPS-compliant, exempt the cluster from that assignment.

Update an existing cluster to enable FIPS

After you prepare your cluster, enable FIPS. If the cluster doesn't meet a requirement, AKS rejects the update, and the error message describes the cause. For help, see Troubleshoot cluster-level FIPS errors.

1. Update an AKS cluster by using the az aks update command with the --enable-fips parameter.

   az aks update \
       --name $CLUSTER_NAME \
       --resource-group $RESOURCE_GROUP \
       --enable-fips
   

2. Verify your cluster is FIPS-enabled by using the az aks show command and query for the enableFips value.

   az aks show \
       --name $CLUSTER_NAME \
       --resource-group $RESOURCE_GROUP \
       --query "enableFips"
   

   The following example output shows your cluster is FIPS-enabled:

   true
   

Update an existing cluster to disable FIPS

You can update an existing cluster to disable FIPS. When you disable FIPS mode:

• Cluster-level FIPS enforcement is removed.
• Existing node pools aren't modified.
• You can run both FIPS and non-FIPS node pools in the same cluster.
• You can deploy AKS extensions and add-ons that were previously blocked while FIPS was enabled.
• New node pools are no longer required to be FIPS-enabled.

1. Update an AKS cluster by using the az aks update command with the --disable-fips parameter.

   az aks update \
       --name $CLUSTER_NAME \
       --resource-group $RESOURCE_GROUP \
       --disable-fips
   

2. Verify your cluster isn't FIPS-enabled by using the az aks show command and query for the enableFips value.

   az aks show \
       --name $CLUSTER_NAME \
       --resource-group $RESOURCE_GROUP \
       --query "enableFips"
   

   The following example output shows your cluster isn't FIPS-enabled:

   false
   

Add a node pool to a FIPS-enabled AKS cluster

Every new node pool in a FIPS-enabled cluster must be FIPS-enabled. Add a node pool by using the az aks nodepool add command with the --enable-fips-image parameter. If you omit --enable-fips-image, AKS rejects the request.

az aks nodepool add \
    --resource-group $RESOURCE_GROUP \
    --cluster-name $CLUSTER_NAME \
    --name $NODE_POOL_NAME \
    --enable-fips-image

Troubleshoot cluster-level FIPS errors

When a request conflicts with cluster-level FIPS, AKS rejects it, usually with a BadRequest error that describes the cause. For common error messages and how to resolve them, see Troubleshoot cluster-level FIPS errors in AKS.

Clean up resources

When you no longer need the resources you created in this article, delete the resource group and all related resources by using the az group delete command.

az group delete --name $RESOURCE_GROUP --yes --no-wait

Related content

• AKS security best practices
• FIPS for AKS node pools
• Federal Information Processing Standard (FIPS) 140
• Troubleshoot cluster-level FIPS errors in AKS