Minimize AKS cluster access to pull-only access for Azure Container Registry (ACR)

MittelStufe 1Manuelle Prüfungaks

Beschreibung

Configure AKS with read-only access to ACR so the cluster can pull the images it needs to run workloads without being able to modify registry content. This is implemented by granting the kubelet managed identity only the required pull permission—typically AcrPull for non-ABAC registries, or Container Registry Repository Reader for ABAC-enabled registries—so cluster access is limited to image retrieval rather than push, delete, or registry ... The benchmark marks this recommendation Manual.

So wird geprüft

Prüfmethode: Manuelle Prüfung

Diese Empfehlung kann nicht automatisch geprüft werden. Ein Scan führt sie mit diesen Anweisungen auf, wenn Sie --include-manual übergeben.

Review AKS access to ACR to confirm the cluster is limited to image pull access and does not have broader registry permissions. Identify the registry authorization mode, confirm the kubelet managed identity is used for ACR access, and verify that the cluster has only the minimum read role required for image pulls. • Determine whether the registry uses RBAC Registry Permissions or RBAC Registry + ABAC Repository Permissions, because this affects the expected pull role and scope model.

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

Restrict AKS access to ACR so the cluster can only pull images needed for workload startup and cannot push, delete, or administer registry content. For AKS, this means using the kubelet managed identity for registry authentication and assigning only the minimum pull role required by the registry authorization mode: AcrPull for non-ABAC registries or Container Registry Repository Reader for ABAC-enabled registries. 1. Configure AKS to use the kubelet managed identity for ACR access rather than shared registry credentials. 2. Assign only the required pull role to the kubelet identity: AcrPull for standard RBAC registries, or Container Registry Repository Reader for ABAC-enabled registries. 3. Remove any additional ACR permissions granted to the kubelet identity, especially write, delete, or broader registry management roles. 4.

Eigenschaften

Betriebssysteme: Beliebig
Tags: aksmanaged-servicesrbacregistry
Referenz: CIS Azure Kubernetes Service (AKS) Benchmark v2.0.0 - 5.1.3 Minimize AKS cluster access to pull-only access for Azure Container Registry (ACR)