Minimize AKS cluster access to pull-only access for Azure Container Registry (ACR)

MediaNivel 1Revisión manualaks

Descripción

Configure AKS with read-only access to ACR so the cluster can pull the images it needs to run workloads without being able to modify registry content. This is implemented by granting the kubelet managed identity only the required pull permission—typically AcrPull for non-ABAC registries, or Container Registry Repository Reader for ABAC-enabled registries—so cluster access is limited to image retrieval rather than push, delete, or registry ... The benchmark marks this recommendation Manual.

Cómo se verifica

Método de auditoría: Revisión manual

Esta recomendación no se puede verificar automáticamente. Un escaneo la lista con estas instrucciones cuando se pasa --include-manual.

Review AKS access to ACR to confirm the cluster is limited to image pull access and does not have broader registry permissions. Identify the registry authorization mode, confirm the kubelet managed identity is used for ACR access, and verify that the cluster has only the minimum read role required for image pulls. • Determine whether the registry uses RBAC Registry Permissions or RBAC Registry + ABAC Repository Permissions, because this affects the expected pull role and scope model.

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Restrict AKS access to ACR so the cluster can only pull images needed for workload startup and cannot push, delete, or administer registry content. For AKS, this means using the kubelet managed identity for registry authentication and assigning only the minimum pull role required by the registry authorization mode: AcrPull for non-ABAC registries or Container Registry Repository Reader for ABAC-enabled registries. 1. Configure AKS to use the kubelet managed identity for ACR access rather than shared registry credentials. 2. Assign only the required pull role to the kubelet identity: AcrPull for standard RBAC registries, or Container Registry Repository Reader for ABAC-enabled registries. 3. Remove any additional ACR permissions granted to the kubelet identity, especially write, delete, or broader registry management roles. 4.

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: aksmanaged-servicesrbacregistry
Referencia: CIS Azure Kubernetes Service (AKS) Benchmark v2.0.0 - 5.1.3 Minimize AKS cluster access to pull-only access for Azure Container Registry (ACR)