Use HTTPS with valid TLS certificates for externally exposed workloads

보통레벨 2수동 검토aks

설명

This helps protect externally exposed AKS applications by ensuring client connections use HTTPS instead of plaintext HTTP at the cluster entry point. In AKS, that protection is typically applied at the ingress or gateway layer, where external web traffic is accepted and routed to backend services. Using TLS at that layer reduces the risk of exposing application traffic, credentials, session data, or other sensitive content in transit. The benchmark marks this recommendation Manual.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

Its important to review this at the Ingress or Gateway layer, since in AKS those components are the primary enforcement points for external HTTP and TLS termination. The purpose of the review is to confirm that public application entry points are not exposing client traffic over plaintext HTTP and that every externally published hostname is protected by a certificate-backed HTTPS or TLS listener. In AKS, ingress can provide SSL termination, and the application routing add-on supports certificate-based HTTPS using Azure Key Vault–integrated patterns.

조치 방법

조치 방식: 가이드 또는 인프라 패치

Remediate by ensuring every externally exposed AKS web entry point is published through an Ingress or Gateway listener configured for HTTPS/TLS, with a valid certificate bound to the public hostname. In AKS, HTTPS protection is typically implemented at the layer 7 ingress or gateway layer, where client traffic is accepted and TLS is terminated before traffic is forwarded to backend services. The remediation objective is to eliminate plaintext HTTP exposure for public application endpoints and standardize certificate-backed TLS for all external web traffic. 1. Update each public Ingress or Gateway that currently exposes HTTP-only traffic so the listener uses HTTPS or TLS for the published hostname. In AKS, ingress is the supported control point for external HTTP-like traffic and SSL/TLS termination. 2.

속성

운영 체제: 모두
태그: aksmanaged-servicesnetwork
참고 자료: CIS Azure Kubernetes Service (AKS) Benchmark v2.0.0 - 5.4.5 Use HTTPS with valid TLS certificates for externally exposed workloads