Amazon Kubernetes CNI FIPS container provides FIPS-validated networking capabilities for Kubernetes clusters. This container implements AWS VPC networking for Kubernetes, enabling native VPC networking and enhanced security features in compliance with Federal Information Processing Standards (FIPS).
Core capabilities and strengths of this container
Typical scenarios where this container excels
Download the container image from the registry
docker pull clnstrt-images.cleanstart.com/$ORGANIZATION/amazon-k8s-cni-fips:latestdocker pull clnstrt-images.cleanstart.com/$ORGANIZATION/amazon-k8s-cni-fips:latest-devRun the container with basic configuration
docker run -it --name amazon-k8s-cni-fips-test clnstrt-images.cleanstart.com/$ORGANIZATION/amazon-k8s-cni-fips:latest-devDeploy with production security settings
docker run -d --name amazon-k8s-cni-fips-prod \
--read-only \
--security-opt=no-new-privileges \
--user 1000:1000 \
clnstrt-images.cleanstart.com/$ORGANIZATION/amazon-k8s-cni-fips:latestMount local directory for persistent data
docker run -v $(pwd)/data:/data clnstrt-images.cleanstart.com/$ORGANIZATION/amazon-k8s-cni-fips:latestRun with custom port mappings
docker run -p 8080:80 clnstrt-images.cleanstart.com/$ORGANIZATION/amazon-k8s-cni-fips:latestConfiguration options available through environment variables
DEBUG9001falseeniRecommended security configurations and practices
Recommended security context for Kubernetes deployments
securityContext:
runAsNonRoot: true
runAsUser: 1000
runAsGroup: 1000
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
capabilities:
drop: ["ALL"]
add: ["NET_ADMIN", "NET_RAW"]Essential links and resources for further information