Use HTTPS with valid TLS certificates for externally exposed workloads

SedangLevel 2Tinjauan manualaks

Deskripsi

This helps protect externally exposed AKS applications by ensuring client connections use HTTPS instead of plaintext HTTP at the cluster entry point. In AKS, that protection is typically applied at the ingress or gateway layer, where external web traffic is accepted and routed to backend services. Using TLS at that layer reduces the risk of exposing application traffic, credentials, session data, or other sensitive content in transit. The benchmark marks this recommendation Manual.

Cara pemeriksaan

Metode audit: Tinjauan manual

Rekomendasi ini tidak dapat diperiksa secara otomatis. Pemindaian akan menampilkannya beserta petunjuk ini saat Anda memberikan opsi --include-manual.

Its important to review this at the Ingress or Gateway layer, since in AKS those components are the primary enforcement points for external HTTP and TLS termination. The purpose of the review is to confirm that public application entry points are not exposing client traffic over plaintext HTTP and that every externally published hostname is protected by a certificate-backed HTTPS or TLS listener. In AKS, ingress can provide SSL termination, and the application routing add-on supports certificate-based HTTPS using Azure Key Vault–integrated patterns.

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

Remediate by ensuring every externally exposed AKS web entry point is published through an Ingress or Gateway listener configured for HTTPS/TLS, with a valid certificate bound to the public hostname. In AKS, HTTPS protection is typically implemented at the layer 7 ingress or gateway layer, where client traffic is accepted and TLS is terminated before traffic is forwarded to backend services. The remediation objective is to eliminate plaintext HTTP exposure for public application endpoints and standardize certificate-backed TLS for all external web traffic. 1. Update each public Ingress or Gateway that currently exposes HTTP-only traffic so the listener uses HTTPS or TLS for the published hostname. In AKS, ingress is the supported control point for external HTTP-like traffic and SSL/TLS termination. 2.

Properti

Sistem operasi: Apa saja
Tag: aksmanaged-servicesnetwork
Referensi: CIS Azure Kubernetes Service (AKS) Benchmark v2.0.0 - 5.4.5 Use HTTPS with valid TLS certificates for externally exposed workloads