kernel-6.18: enable fips modules

[piyush-jena]

Description of changes:

• Enable FIPS modules in kernel-6.18 after AL2023 added a modularized kmod for cryptography - https://aws.amazon.com/blogs/compute/introducing-modularized-kernel-cryptography-in-amazon-linux/

Testing done:
Created a custom aws-k8s-1.36 variant with fips=true image feature and fips=1 kernel parameter

1. Then ran the following under sheltie

bash-5.2# uname -r
6.18.38
bash-5.2# apiclient report fips
Benchmark name:  FIPS Security Policy
Version:         v1.0.0
Reference:       https://csrc.nist.gov/
Benchmark level: 1
Start time:      2026-07-28T06:20:59.692117474Z

[PASS] 1.0       FIPS mode is enabled. (Automatic)
[PASS] 1.1       FIPS module is Amazon Linux 2023 Kernel Cryptographic API. (Automatic)
[PASS] 1.2       FIPS self-tests passed. (Automatic)

Passed:          3
Failed:          0
Skipped:         0
Total checks:    3

Compliance check result: PASS
bash-5.2# cat /proc/sys/crypto/fips_enabled
1
bash-5.2# sysctl crypto.fips_enabled
crypto.fips_enabled = 1
bash-5.2# cat /proc/cmdline | grep fips
SYSTEMD_CGROUP_ENABLE_LEGACY_FORCE=1 SYSTEMD_DEFAULT_MOUNT_RATE_LIMIT_BURST=25 fips=1 module_blacklist=i8042 BOOT_IMAGE=/vmlinuz console=tty0 console=ttyS0,115200n8 net.ifnames=0 netdog.default-interface=eth0:dhcp4,dhcp6? quiet fips=1 bootconfig root=/dev/dm-0 rootwait ro raid=noautodetect random.trust_cpu=on selinux=1 enforcing=1 "dm-mod.create=root,,,ro,0 704800 verity 1 PARTUUID=ea87da3c-ee4e-40a6-9f4c-a386ce952b22/PARTNROFF=1 PARTUUID=ea87da3c-ee4e-40a6-9f4c-a386ce952b22/PARTNROFF=2 4096 4096 88100 1 sha256 cf43be255368d39799ba9ec04176b3be0cbd37089ea0d47b67e359b0fdf54778 79e8522653e6b69c1c7c3e9626365ad94303ed2a656ee33173e464452df6c875 2 restart_on_corruption ignore_zero_blocks" -- systemd.unit=fipscheck.target systemd.log_target=journal-or-kmsg systemd.log_color=0 systemd.show_status=true

2. Ran FIPS test from aws-k8s-tester in a cluster:

$ go test -tags e2e -v ./test/cases/fips/
2026/07/28 17:04:14 Node ip-192-168-91-183.us-west-2.compute.internal: OS=Bottlerocket OS 1.64.0 (aws-k8s-1.36), FIPS=false
2026/07/28 17:04:14 registry-fips DaemonSet deployed
2026/07/28 17:04:14 registry-nonfips DaemonSet deployed
2026/07/28 17:04:14 Waiting for registry-fips DaemonSet to be ready...
2026/07/28 17:04:19 registry-fips DaemonSet is ready
2026/07/28 17:04:19 Waiting for registry-nonfips DaemonSet to be ready...
2026/07/28 17:04:24 registry-nonfips DaemonSet is ready
2026/07/28 17:04:24 Waiting for registry-fips seed container to complete...
2026/07/28 17:04:24 registry-fips seed still waiting... (got 1397 bytes of logs)
2026/07/28 17:04:29 registry-fips seed completed successfully on all 1 pods
2026/07/28 17:04:29 Waiting for registry-nonfips seed container to complete...
2026/07/28 17:04:29 registry-nonfips seed completed successfully on all 1 pods
2026/07/28 17:04:29 test pods deployed
=== RUN   TestFIPSTLS
=== RUN   TestFIPSTLS/fips-tls-pull
=== RUN   TestFIPSTLS/fips-tls-pull/Pull_from_FIPS-cipher_registry_succeeds
    fips_test.go:90: FIPS TLS pull succeeded as expected
=== RUN   TestFIPSTLS/nonfips-tls-pull
=== RUN   TestFIPSTLS/nonfips-tls-pull/Pull_from_non-FIPS-cipher_registry_fails_on_FIPS_node
    fips_test.go:120: Polling test-pull-nonfips: Phase=Pending
    fips_test.go:123:   Container test: Waiting (Reason=ErrImagePull)
    fips_test.go:139: registry-nonfips nginx logs:
        /docker-entrypoint.sh: /docker-entrypoint.d/ is not empty, will attempt to perform configuration
        /docker-entrypoint.sh: Looking for shell scripts in /docker-entrypoint.d/
        /docker-entrypoint.sh: Launching /docker-entrypoint.d/10-listen-on-ipv6-by-default.sh
        10-listen-on-ipv6-by-default.sh: info: Getting the checksum of /etc/nginx/conf.d/default.conf
        10-listen-on-ipv6-by-default.sh: info: Enabled listen on IPv6 in /etc/nginx/conf.d/default.conf
        /docker-entrypoint.sh: Sourcing /docker-entrypoint.d/15-local-resolvers.envsh
        /docker-entrypoint.sh: Launching /docker-entrypoint.d/20-envsubst-on-templates.sh
        /docker-entrypoint.sh: Launching /docker-entrypoint.d/30-tune-worker-processes.sh
        /docker-entrypoint.sh: Configuration complete; ready for start up
        2026/07/28 17:04:30 [info] 30#30: *1 SSL_do_handshake() failed (SSL: error:0A0000C1:SSL routines::no shared cipher) while SSL handshaking, client: 127.0.0.1, server: 0.0.0.0:5001
    fips_test.go:139: Verified: FIPS node rejected non-FIPS cipher suite (no shared cipher)
    fips_test.go:140: Non-FIPS TLS pull correctly rejected (ImagePullBackOff)
--- PASS: TestFIPSTLS (5.10s)
    --- PASS: TestFIPSTLS/fips-tls-pull (5.04s)
        --- PASS: TestFIPSTLS/fips-tls-pull/Pull_from_FIPS-cipher_registry_succeeds (5.02s)
    --- PASS: TestFIPSTLS/nonfips-tls-pull (0.06s)
        --- PASS: TestFIPSTLS/nonfips-tls-pull/Pull_from_non-FIPS-cipher_registry_fails_on_FIPS_node (0.04s)
PASS
ok      github.com/aws/aws-k8s-tester/test/cases/fips   21.075s

Terms of contribution:

By submitting this pull request, I agree that this contribution is dual-licensed under the terms of both the Apache License, version 2.0, and the MIT license.