Minimize AKS cluster access to pull-only access for Azure Container Registry (ACR)

中レベル 1手動レビューaks

説明

Configure AKS with read-only access to ACR so the cluster can pull the images it needs to run workloads without being able to modify registry content. This is implemented by granting the kubelet managed identity only the required pull permission—typically AcrPull for non-ABAC registries, or Container Registry Repository Reader for ABAC-enabled registries—so cluster access is limited to image retrieval rather than push, delete, or registry ... The benchmark marks this recommendation Manual.

チェック方法

監査方法: 手動レビュー

この推奨事項は自動ではチェックできません。--include-manual を指定すると、スキャン結果にこの手順付きで一覧表示されます。

Review AKS access to ACR to confirm the cluster is limited to image pull access and does not have broader registry permissions. Identify the registry authorization mode, confirm the kubelet managed identity is used for ACR access, and verify that the cluster has only the minimum read role required for image pulls. • Determine whether the registry uses RBAC Registry Permissions or RBAC Registry + ABAC Repository Permissions, because this affects the expected pull role and scope model.

修正方法

修正方法: ガイダンスまたは IaC パッチ

Restrict AKS access to ACR so the cluster can only pull images needed for workload startup and cannot push, delete, or administer registry content. For AKS, this means using the kubelet managed identity for registry authentication and assigning only the minimum pull role required by the registry authorization mode: AcrPull for non-ABAC registries or Container Registry Repository Reader for ABAC-enabled registries. 1. Configure AKS to use the kubelet managed identity for ACR access rather than shared registry credentials. 2. Assign only the required pull role to the kubelet identity: AcrPull for standard RBAC registries, or Container Registry Repository Reader for ABAC-enabled registries. 3. Remove any additional ACR permissions granted to the kubelet identity, especially write, delete, or broader registry management roles. 4.

プロパティ

オペレーティングシステム: すべて
タグ: aksmanaged-servicesrbacregistry
参照: CIS Azure Kubernetes Service (AKS) Benchmark v2.0.0 - 5.1.3 Minimize AKS cluster access to pull-only access for Azure Container Registry (ACR)