Minimize AKS cluster access to pull-only access for Azure Container Registry (ACR)

MoyenneNiveau 1Revue manuelleaks

Description

Configure AKS with read-only access to ACR so the cluster can pull the images it needs to run workloads without being able to modify registry content. This is implemented by granting the kubelet managed identity only the required pull permission—typically AcrPull for non-ABAC registries, or Container Registry Repository Reader for ABAC-enabled registries—so cluster access is limited to image retrieval rather than push, delete, or registry ... The benchmark marks this recommendation Manual.

Méthode de vérification

Méthode d'audit: Revue manuelle

Cette recommandation ne peut pas être vérifiée automatiquement. Une analyse la liste avec ces instructions lorsque vous passez --include-manual.

Review AKS access to ACR to confirm the cluster is limited to image pull access and does not have broader registry permissions. Identify the registry authorization mode, confirm the kubelet managed identity is used for ACR access, and verify that the cluster has only the minimum read role required for image pulls. • Determine whether the registry uses RBAC Registry Permissions or RBAC Registry + ABAC Repository Permissions, because this affects the expected pull role and scope model.

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

Restrict AKS access to ACR so the cluster can only pull images needed for workload startup and cannot push, delete, or administer registry content. For AKS, this means using the kubelet managed identity for registry authentication and assigning only the minimum pull role required by the registry authorization mode: AcrPull for non-ABAC registries or Container Registry Repository Reader for ABAC-enabled registries. 1. Configure AKS to use the kubelet managed identity for ACR access rather than shared registry credentials. 2. Assign only the required pull role to the kubelet identity: AcrPull for standard RBAC registries, or Container Registry Repository Reader for ABAC-enabled registries. 3. Remove any additional ACR permissions granted to the kubelet identity, especially write, delete, or broader registry management roles. 4.

Propriétés

Systèmes d'exploitation: Tous
Étiquettes: aksmanaged-servicesrbacregistry
Référence: CIS Azure Kubernetes Service (AKS) Benchmark v2.0.0 - 5.1.3 Minimize AKS cluster access to pull-only access for Azure Container Registry (ACR)