> ## Documentation Index
> Fetch the complete documentation index at: https://docs.abbyy.com/llms.txt
> Use this file to discover all available pages before exploring further.

# FIPS Compliance

> Configure FIPS 140-2 compliance for ABBYY Vantage Self-Hosted on Azure AKS: Redis versions, NFS file shares, FIPS-enabled node pools, and storage rules.

<Note>
  This page applies only to **Azure AKS** deployments. FIPS compliance configuration is not applicable to Virtual Machine deployments.
</Note>

## Overview

Federal Information Processing Standard (FIPS) 140-2 compliance is required for certain US government and regulated industry deployments. Enabling FIPS compliance in your Vantage deployment requires specific configuration changes during infrastructure creation and installation.

## Key Differences from Standard Deployment

| Component       | Standard Deployment | FIPS-Enabled Deployment        |
| --------------- | ------------------- | ------------------------------ |
| Redis Version   | 6.2 or later        | 6.2 to 7.0.7 only              |
| File Share Type | SMB                 | NFS                            |
| AKS Node Pools  | Standard            | FIPS-enabled                   |
| Storage Access  | Public or Private   | Virtual network only (for NFS) |

## Requirements

### Redis Version Restriction

<Warning>
  For FIPS compliance, Redis must be version **6.2 to 7.0.7** (not newer). Versions 7.0.8 and later are not supported for FIPS deployments.
</Warning>

### NFS Share Considerations

When FIPS is enabled, Network File System (NFS) shares are used instead of SMB shares:

* NFS share storage account configuration can allow access from public IP addresses
* However, you **cannot mount** NFS shares from a public IP address
* You can only connect to NFS shares from a machine on a virtual network trusted by the storage account

## Infrastructure Creation with FIPS

When creating Azure infrastructure for a FIPS-compliant deployment, add the `enableFIPS=true` parameter to the ARM template deployments.

### Create AKS Cluster with FIPS

```bash theme={null}
az deployment group create --name aks-cluster \
  --resource-group <resource_group_name> \
  --template-file files/infrastructure/azure/arms/Cluster.Manual.json \
  --parameters kubernetesClusterName=<cluster_name> \
  --parameters enableFIPS=true
```

### Configure NFS Share Access

After creating the FIPS-enabled cluster, run the following commands to connect the shared storage account with NFS share:

```bash theme={null}
# Get the principal ID of the AKS cluster
export principalId=$(az aks show --name <cluster_name> -g <resource_group_name> \
  -o tsv --query identity.principalId)

# Get the subnet scope
export scope=$(az aks show --name <cluster_name> -g <resource_group_name> \
  -o tsv --query agentPoolProfiles[*].vnetSubnetId | uniq)

# Create role assignment for the cluster to access storage
az role assignment create --role "Contributor" \
  --assignee-principal-type ServicePrincipal \
  --assignee-object-id $principalId \
  --scope $scope
```

### Create Storage Accounts with FIPS

```bash theme={null}
az deployment group create --name storage \
  --resource-group <resource_group_name> \
  --template-file files/infrastructure/azure/arms/StorageAccounts.Template.json \
  --parameters kubernetesClusterName=<cluster_name> \
  --parameters enableFIPS=true
```

## Configuration Parameters

### env\_specific.yml

Enable FIPS support by setting the following parameter:

```yaml theme={null}
k8s_fips_enabled: true
```

### Azure Government Cloud

If deploying to Azure Government Cloud, add the `s3endpointSuffix` parameter immediately after `k8s_fips_enabled`:

```yaml theme={null}
k8s_fips_enabled: true
s3endpointSuffix: core.usgovcloudapi.net
```

<Note>
  Only add `s3endpointSuffix` when deploying to Azure Government Cloud. Do not include this parameter for standard Azure commercial cloud deployments.
</Note>

## Complete FIPS Configuration Example

```yaml theme={null}
env: vantage
poc: false

domain: yourdomain.gov
product_host: "vantage.{{ domain }}"

loadbalancer:
  external_ip: X.X.X.X

container_registry_host: "registry.yourdomain.gov"
container_registry_user: "service"
container_registry_password: "password"
container_registry_name: "{{ container_registry_host }}/vantage"

techcore:
  use_gpu_workers: false
  use_nn_extraction_training_workers: false

logging:
  enabled: true
  elasticsearch:
    enabled: false
  file:
    enabled: true

platform_admin_email: admin@yourdomain.gov

smtp:
  host: X.X.X.X
  login: null
  password: ""
  port: 587
  useSSL: false

mailFrom: noreply@yourdomain.gov

database:
  type: sqlserver
  host: X.X.X.X
  username: login
  password: password
  encrypt: true  # Recommended for FIPS

s3storage:
  skills:
    accessKey: skills_storage_account_name
    secretKey: skills_storage_account_key
  processing:
    accessKey: processing_storage_account_name
    secretKey: processing_storage_account_key
  temporary:
    accessKey: temporary_storage_account_name
    secretKey: temporary_storage_account_key
  sharedfolder:
    accessKey: sharedfolder_storage_account_name
    secretKey: sharedfolder_storage_account_key
    resourcegroup: your_resource_group
  archive:
    accessKey: archive_storage_account_name
    secretKey: archive_storage_account_key

# Redis cluster - must be version 6.2 to 7.0.7 for FIPS
redis:
  ips: ['172.16.10.101', '172.16.10.102', '172.16.10.103', '172.16.10.104', '172.16.10.105', '172.16.10.106']
  port: 6379
  password: redispassword
  ssl: true  # Recommended for FIPS

reporting:
  enabled: false

id_reading:
  enabled: false

# FIPS Configuration
k8s_fips_enabled: true

# Uncomment for Azure Government Cloud only:
# s3endpointSuffix: core.usgovcloudapi.net
```

## Verification

After deployment, verify FIPS is enabled on your AKS nodes:

```bash theme={null}
# Get node information
kubectl get nodes -o wide

# Check FIPS status on a node (connect to node first)
cat /proc/sys/crypto/fips_enabled
# Output: 1 (FIPS enabled) or 0 (FIPS disabled)
```

## Related Documentation

* [System Requirements](/vantage/self-hosted/v2.7/system-requirements) - Full requirements including Redis cluster configuration
* [Azure Infrastructure Creation](/vantage/self-hosted/v2.7/azure-infrastructure) - Step-by-step Azure resource creation
* [Installation](/vantage/self-hosted/v2.7/installation) - Complete installation guide