Enable private OKE control plane access and disable public IP access

Méthode de vérification

Méthode d'audit: Commande shell

pub=$(oci ce cluster get --cluster-id "${OKE_CLUSTER_ID:?set OKE_CLUSTER_ID}" --query 'data."endpoint-config"."is-public-ip-enabled"' --raw-output) || exit 1
ep=$(oci ce cluster get --cluster-id "${OKE_CLUSTER_ID:?set OKE_CLUSTER_ID}" --query 'data.endpoints."public-endpoint"' --raw-output) || exit 1
if [ "$pub" = false ] && { [ -z "$ep" ] || [ "$ep" = null ]; }; then echo compliant; else echo "noncompliant: is-public-ip-enabled=$pub public-endpoint=$ep"; fi

Sortie attendue

compliant

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

Use private OKE control plane access by placing the Kubernetes API endpoint in a private subnet and disabling public IP assignment. This keeps Kubernetes API access on the VCN or an approved private network path. For a new cluster, create the Kubernetes API endpoint in a private subnet and do not assign a public IP address. oci ce cluster create \ --name $CLUSTER_NAME \ --compartment-id $COMPARTMENT_ID \ --vcn-id $VCN_OCID \ --kubernetes-version $KUBERNETES_VERSION \ --endpoint-subnet-id $PRIVATE_ENDPOINT_SUBNET_OCID \ --endpoint-public-ip-enabled false For an existing cluster, update the endpoint configuration so the Kubernetes API endpoint is not assigned a public IP address.

Vérifier cet hôte

Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.

tmaegis scan --target oke