Restrict AKS workloads to approved container registries only

MediumLevel 2Manual reviewaks

Description

Configure AKS so workloads pull images only from registries that have been explicitly approved by the organization, such as selected ACR instances or other trusted registries. In AKS, this is typically enforced with Azure Policy by auditing or denying deployments that reference images outside the approved registry list, while AKS-to-ACR integration provides the managed identity and pull-role pattern needed for authorized image retrieval from ... The benchmark marks this recommendation Manual.

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

Review AKS image source controls to confirm workloads are limited to approved container registries. The audit should verify that an Azure Policy definition or initiative is assigned to the cluster to audit or deny unapproved image sources, that the approved registry list is explicitly defined, and that AKS has valid pull access only to those approved registries. In addition, deploy only validated images which supports restricting image sources to trusted registries.

How it is fixed

Fix method: Guidance or infrastructure patch

Restrict AKS workloads to approved container registries by enforcing an Azure Policy control for allowed images or trusted registries, defining the approved registry list, and ensuring workloads reference only those registries. In AKS, using the Azure Policy add-on with built-in AKS policies, and AKS image-management guidance recommends deploying only validated images. 1. Enable the Azure Policy add-on on the AKS cluster if it is not already installed. 2. Assign an AKS policy or initiative that audits or denies unapproved image sources, and set the parameters to the organization’s approved registry list. 3. Migrate or mirror workload images from external or nonapproved registries into an approved registry, such as ACR, before deployment. AKS-to-ACR integration supports authenticated image pulls through the kubelet managed identity. 4.

Properties

Operating systems: Any
Tags: aksmanaged-services
Reference: CIS Azure Kubernetes Service (AKS) Benchmark v2.0.0 - 5.1.4 Restrict AKS workloads to approved container registries only