Restrict OKE control plane endpoint access using private endpoints or approved CIDRs

Méthode de vérification

Méthode d'audit: Revue manuelle

Cette recommandation ne peut pas être vérifiée automatiquement. Une analyse la liste avec ces instructions lorsque vous passez --include-manual.

Check the OKE Kubernetes API endpoint configuration and determine whether the endpoint has a public IP address assigned. Also identify the endpoint subnet and any network security groups attached to the endpoint. oci ce cluster get \ --cluster-id $CLUSTER_ID \ --query 'data.{endpointConfig:"endpoint-config",endpoints:endpoints}' \ --output json Expected Output: { "endpointConfig": { "is-public-ip-enabled": false, "nsg-ids": [ "ocid1.networksecuritygroup.oc1..." ], "subnet-id": "ocid1.subnet.oc1..." }, "endpoints": { "private-endpoint": "10.0.0.10:6443", "public-endpoint": null } } ...

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

Restrict access to the OKE Kubernetes API endpoint by using a private endpoint where possible, or by limiting public endpoint access through OCI network security groups or security lists. The Kubernetes API endpoint is hosted in a VCN subnet, and Oracle recommends using network security groups or security lists to control access to that subnet. For new clusters, place the Kubernetes API endpoint in a private subnet when internet access to the API endpoint is not required.