Kubernetes and Node Requirements

Kubernetes Cluster Requirements

• Ensure that a Kubernetes cluster (for example, Azure Kubernetes Service (AKS)) is provisioned and accessible.

• A Kubernetes cluster should be configured with separate node pools:

  • System node pool: Used for core Kubernetes components and general workloads. This pool can use non-SGX VM instances and should have a minimum of three nodes for high availability. The minimum supported VM size is Standard_D4d_v5.

  • User node pool (SGX-enabled): Used for running Fortanix Armor workloads that require SGX. This pool must use SGX-capable VM instances. The minimum supported VM size is Standard_DC8s_v3 (DC8s_v3), or a later supported SGX-enabled VM size. SGX must be enabled according to the cloud provider configuration (for example, by enabling the SGX add-on in AKS).

• The node pools should be running Linux. Fortanix has validated this deployment on Ubuntu 24.x version.

• Kubernetes version: 1.35.8 or later (or supported non-end-of-life version).

  INITIAL AKS VERSION	SUPPORTED UPGRADE VERSIONS
  1.35.8	1.36.0
  1.36.0	1.36.x (minor updates)

• The cluster must have a minimum of three nodes for user pool.

• Ensure that the KUBECONFIG environment variable is set in the environment used to run Helm commands for installing the Fortanix Armor Kubernetes Operator.

  For example,

  export KUBECONFIG=<path-to-kubeconfig>

  Where, <path-to-kubeconfig> is the file path to your Kubernetes configuration file. For example: $HOME/.kube/config.

Node Requirements

• Configure SGX Support on the Kubernetes cluster:

  • The Kubernetes cluster must include node pools with SGX-capable VM instances to run Fortanix Armor workloads.

  • Intel SGX must be enabled and functional on these nodes.

  • The Intel SGX Device Plugin must be installed in the cluster and expose the following resources:

    • sgx.intel.com/enclave

    • sgx.intel.com/provision

    NOTE

    For Azure AKS, SGX support requires enabling the SGX add-on when creating the cluster. For detailed steps, refer to Microsoft official documentation.

  

Configure User Node Pool (SGX-Enabled) Labelling in AKS

Fortanix Armor SGX workloads, such as node-agent and sgx-quote-helper should run only on SGX-enabled nodes.

In AKS clusters with multiple workload types, Kubernetes might schedule these workloads on nodes that do not support SGX if SGX-specific scheduling constraints are not configured.

To ensure correct scheduling behavior, install and configure Kubernetes Node Feature Discovery (NFD) in the cluster.

Example: NFD can be installed using Helm. The following commands are provided as an example:

helm repo add nfd <NFD-repository>
helm install nfd nfd/node-feature-discovery \
    --namespace node-feature-discovery \
    --create-namespace

NOTE

• Fortanix does not provide or install NFD. The commands above are an example of how NFD can be installed. Use the installation method and repository appropriate for your Kubernetes environment.

• The node-feature-discovery version must be 0.15.0 or later.

After installing NFD, verify that SGX-enabled nodes have the following label:

feature.node.kubernetes.io/cpu-security.sgx.enabled=true