Use HTTPS with valid TLS certificates for externally exposed workloads

MediaNivel 2Revisión manualaks

Descripción

This helps protect externally exposed AKS applications by ensuring client connections use HTTPS instead of plaintext HTTP at the cluster entry point. In AKS, that protection is typically applied at the ingress or gateway layer, where external web traffic is accepted and routed to backend services. Using TLS at that layer reduces the risk of exposing application traffic, credentials, session data, or other sensitive content in transit. The benchmark marks this recommendation Manual.

Cómo se verifica

Método de auditoría: Revisión manual

Esta recomendación no se puede verificar automáticamente. Un escaneo la lista con estas instrucciones cuando se pasa --include-manual.

Its important to review this at the Ingress or Gateway layer, since in AKS those components are the primary enforcement points for external HTTP and TLS termination. The purpose of the review is to confirm that public application entry points are not exposing client traffic over plaintext HTTP and that every externally published hostname is protected by a certificate-backed HTTPS or TLS listener. In AKS, ingress can provide SSL termination, and the application routing add-on supports certificate-based HTTPS using Azure Key Vault–integrated patterns.

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Remediate by ensuring every externally exposed AKS web entry point is published through an Ingress or Gateway listener configured for HTTPS/TLS, with a valid certificate bound to the public hostname. In AKS, HTTPS protection is typically implemented at the layer 7 ingress or gateway layer, where client traffic is accepted and TLS is terminated before traffic is forwarded to backend services. The remediation objective is to eliminate plaintext HTTP exposure for public application endpoints and standardize certificate-backed TLS for all external web traffic. 1. Update each public Ingress or Gateway that currently exposes HTTP-only traffic so the listener uses HTTPS or TLS for the published hostname. In AKS, ingress is the supported control point for external HTTP-like traffic and SSL/TLS termination. 2.

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: aksmanaged-servicesnetwork
Referencia: CIS Azure Kubernetes Service (AKS) Benchmark v2.0.0 - 5.4.5 Use HTTPS with valid TLS certificates for externally exposed workloads