LinkedIn
FIPS-Validated Encryption in Transit for FedRAMP
Encrypting data in transit is one of the more challenging requirements for FedRAMP Authorization. Buoyant Enterprise for Linkerd (BEL) simplifies the process across every pod in the cluster, without changing the application code.
Why FIPS for Kubernetes is challenging
FIPS 140-2 and 140-3 are the US government standards for cryptographic modules, defined by the National Institute of Standards and Technology (NIST). FedRAMP is one compliance framework that requires FIPS-validated encryption.
FIPS requires that all data transported in an application use FIPS-validated cryptographic code; it's not just a matter of flipping a configuration switch. Since most Kubernetes environments are a complex mix of open-source technologies, ensuring that the core platform, the network proxies, and every third-party add-on are all using these certified libraries is a significant challenge: if even one minor component slips through with standard commercial encryption, the entire cluster fails an audit.
Months
SC-13 requires FIPS 140-validated modules for every pod-to-pod connection inside the authorization boundary, including traffic that never leaves the cluster. Adding them service by service, by hand, stalls most authorization timelines.
FedRAMP SC-13, NIST SP 800-53
0
Inject the proxy. Every east-west connection in the cluster runs FIPS 140-validated mTLS, with both the control plane and data plane covered by BEL's FIPS-validated builds.
BEL FIPS guide, docs.buoyant.io
BEL takes care of all application communications without changing application code, taking care of one of the more challenging aspects of FedRAMP for a Kubernetes environment and allowing you to expedite your path to FedRAMP. Read the full analysis ↗
What you get
BEL enforces FIPS-validated encryption and zero-trust controls across both the control and data planes without application code changes.
Easy compliance auditing
BEL simplifies the auditing process with a FIPS dashboard to give auditors real-time proof of encryption as well as readily available CMVP numbers.
Control and data planes validated, zero code changes
Buoyant Enterprise for Linkerd (BEL) covers the control plane and the data plane with FIPS-validated builds without adding development hours to your FedRAMP timeline.
Expedited timeline
IntelliGRC estimated FIPS with Linkerd eliminated at least 3 months of custom certificate-management development for their team.
Reduced attack surface
BEL’s custom proxy is written entirely in Rust which eliminates memory-safety vulnerabilities to vastly reduce the attack surface for strict FedRAMP audits.
How it works
BEL uses FIPS-validated cryptographic libraries to encrypt all data in transit between meshed pods. You inject the proxy; the control plane issues each pod a short-lived identity certificate, and every east-west connection is mutually authenticated and encrypted with validated modules. The FIPS dashboard gives auditors real-time proof, and linkerd fips audit lets your own team verify coverage.
Zone-aware load balancing with HAZL
Under normal load HAZL keeps requests in-zone; when the in-zone endpoint is overloaded or returning errors, it spills to another zone, then returns in-zone as load recovers.
What FIPS in the mesh covers, and what it doesn't
BEL gives you FIPS-validated encryption in transit between meshed pods – the hardest part of FIPS compliance. It does not, on its own, cover data at rest, traffic to non-meshed workloads, or the ingress and egress boundary, and FedRAMP SC-13 requires validated cryptography everywhere cryptography is used.
What FIPS needs
✗ Data in transit between meshed workloads
✗ Data at rest (not in scope for a service mesh)
✗ Traffic from unmeshed workloads
✗ Ingress and egress boundary
✓ mTLS for all meshed traffic (not FIPS-validated)
✓ Proxy cert auto-rotation (24 h)
✓ cert-manager integration
✓ Community support
What BEL gives you
✓ FIPS 140-validated encryption for every east-west connection
✓ Both control plane and data plane validated
✓ FIPS dashboard with CMVP certificate numbers on request
✓ linkerd fips audit for self-serve coverage checks
✓ FedRAMP SC-13, CMMC, and HIPAA (same validated builds)
✓ Trust-anchor rotation (BEL 2.20 operator)
✓ Hardened releases + commercial support
✓ Defined CVE-response path
Why BEL for FIPS
1
Both control plane and data plane, validated
BEL's FIPS-validated builds cover both the control plane and its data plane, and allow your application to have FIPS validated encryption without changing its code. It secures the control plane by ensuring that all internal components use validated cryptography for mesh administration, while simultaneously forcing data plane's Rust-based microproxies use FIPS-validated cryptography for mutual TLS (mTLS) and data in transit.
2
Proof for auditors, and a self-serve check
The FIPS dashboard gives auditors real-time evidence, with CMVP numbers available on request. For the engineer who wants to confirm coverage directly:
$ linkerd fips audit
√ Found 24 proxies. All proxies are FIPS.
A non-FIPS proxy is named explicitly so you can find and fix it.
3
Certificates issued and rotated for you
BEL gives each pod a short-lived identity certificate, auto-rotated every 24 hours, with no certificate-management system to build. The riskiest cert operation (rotating the shared trust anchor) is automated by a dedicated operator, allowing for an easy hands-off workflow with no downtime.
4
One team accountable for both planes
Buoyant builds Linkerd's control plane and data plane with a single team. BEL is the build Buoyant runs in its own production systems, with a defined escalation, remediation, and CVE-response path, helping to streamline FedRAMP validation.
5
Expedited timeline for FedRAMP
Because BEL removes the for code changes in order to meet FIPS-validated encryption, companies like IntelliGRC were able to take months off of their FedRAMP timeline.
Show me the evidence
We've helped companies like Zscaler build Kubernetes applications using FIPS-validated cryptographic libraries. If FIPS certification is a requirement for you, we'd love to chat!
FedRAMP Moderate with a 5-person team
IntelliGRC reached FedRAMP Moderate on a 42-microservice platform with a 5-person team using Linkerd.
Rev. 5 FedRAMP authorization on Kubernetes
Zscaler used Linkerd to authorize its cloud browser-isolation product under the Rev. 5 baselines, one of the first Kubernetes solutions to do so.
Frequently asked questions
What's the difference between FIPS 140-2 and 140-3?
Both are NIST standards for cryptographic modules; 140-2 is the current successor. BEL provides validated builds referencing both.
Does FIPS in BEL require code changes?
No. The validated builds cover the control plane and data plane, and your application is unchanged.