Enable FIPS Mode in AKS EE

Question

Enable FIPS Mode in AKS EE

Jinyan Li 0

We are wondering how to enable FIPS in AKS EE on a Windows Server? In that environment, there are several software components working as the pods of Arc-enabled Kubernetes cluster. Moreover, they are built as Docker containers, e.g. "FROM mcr.microsoft.com/dotnet/aspnet:8.0 AS base" is currently used.

We have tried out following approaches, but no luck.

Set ENV DOTNET_SYSTEM_GLOBALIZATION_USENONFIPSALGORITHMS=0
Enabled FIPS in the server VM we were testing with

User's image

Look forward to the working solution. Thank you.

Locked Question. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

Christos Panagiotidis 3,546 Reputation points

2026-07-29T10:48:51.1433333+00:00

AKS Edge Essentials is different from managed AKS, and the managed-AKS enableFIPS node-pool setting does not apply to an Edge Essentials cluster. Its documented GA support matrix lists Linux worker nodes; Windows worker nodes are experimental. Enabling the Windows host FIPS policy or setting a .NET environment variable does not make the Kubernetes node, container image, or application cryptography FIPS validated.

If formal FIPS compliance is required, the supported Azure design is a managed AKS cluster with a FIPS-enabled node pool. Windows Server 2022 and later AKS node pools enable FIPS, but Microsoft also states that container images running on FIPS nodes are not automatically assessed for compliance. You must use validated cryptographic modules in the application and verify the complete compliance boundary. If the workload must remain on AKS Edge Essentials, there is no documented supported switch that provides equivalent FIPS assurance. Raise a Microsoft support or product request and have the proposed host, node, container, and .NET configuration reviewed by your compliance team.

Christos Panagiotidis 3,546 Reputation points

2026-07-29T10:48:51.1433333+00:00

AKS Edge Essentials is different from managed AKS, and the managed-AKS enableFIPS node-pool setting does not apply to an Edge Essentials cluster. Its documented GA support matrix lists Linux worker nodes; Windows worker nodes are experimental. Enabling the Windows host FIPS policy or setting a .NET environment variable does not make the Kubernetes node, container image, or application cryptography FIPS validated.

If formal FIPS compliance is required, the supported Azure design is a managed AKS cluster with a FIPS-enabled node pool. Windows Server 2022 and later AKS node pools enable FIPS, but Microsoft also states that container images running on FIPS nodes are not automatically assessed for compliance. You must use validated cryptographic modules in the application and verify the complete compliance boundary. If the workload must remain on AKS Edge Essentials, there is no documented supported switch that provides equivalent FIPS assurance. Raise a Microsoft support or product request and have the proposed host, node, container, and .NET configuration reviewed by your compliance team.