TMA-OKE-5.4.2

Enable private OKE control plane access and disable public IP access

高レベル 1自動oke

説明

This recommendation is the strict private access version of API endpoint hardening. The intended end state is that the Kubernetes API server is reachable only from inside the cluster VCN or from a connected private network, and there is no internet-reachable public API endpoint at all. This is a pure control plane exposure decision. Requires the oci CLI with read access to the cluster in OKE_CLUSTER_ID.

チェック方法

監査方法: シェルコマンド

shell

pub=$(oci ce cluster get --cluster-id "${OKE_CLUSTER_ID:?set OKE_CLUSTER_ID}" --query 'data."endpoint-config"."is-public-ip-enabled"' --raw-output) || exit 1
ep=$(oci ce cluster get --cluster-id "${OKE_CLUSTER_ID:?set OKE_CLUSTER_ID}" --query 'data.endpoints."public-endpoint"' --raw-output) || exit 1
if [ "$pub" = false ] && { [ -z "$ep" ] || [ "$ep" = null ]; }; then echo compliant; else echo "noncompliant: is-public-ip-enabled=$pub public-endpoint=$ep"; fi

期待される出力: compliant

修正方法

修正方法: ガイダンスまたは IaC パッチ

Use private OKE control plane access by placing the Kubernetes API endpoint in a private subnet and disabling public IP assignment. This keeps Kubernetes API access on the VCN or an approved private network path. For a new cluster, create the Kubernetes API endpoint in a private subnet and do not assign a public IP address. oci ce cluster create \ --name $CLUSTER_NAME \ --compartment-id $COMPARTMENT_ID \ --vcn-id $VCN_OCID \ --kubernetes-version $KUBERNETES_VERSION \ --endpoint-subnet-id $PRIVATE_ENDPOINT_SUBNET_OCID \ --endpoint-public-ip-enabled false For an existing cluster, update the endpoint configuration so the Kubernetes API endpoint is not assigned a public IP address.

プロパティ

オペレーティングシステム: すべて
タグ: okemanaged-servicesnetwork
参照: CIS Oracle Cloud Infrastructure Container Engine for Kubernetes (OKE) Benchmark v2.0.0 - 5.4.2 Enable private OKE control plane access and disable public IP access

このホストをチェック

監査が許可されているマシンで実行してください。スキャンは読み取り専用です。

shell

tmaegis scan --target oke