How a missing kernel flag broke FIPS-certified containers in managed Kubernetes

A customer building a FedRAMP-compliant deployment found that Ubuntu Pro 22.04 FIPS container images were silently failing on standard, mainline Linux kernels, the kind used by managed Kubernetes environments such as AWS EKS and Fargate. The fix required a patch that preserved FIPS compliance without triggering months of recertification. This post explains what happened, why it matters for anyone running FIPS workloads in containerized cloud environments, and what Canonical changed as a result.