TMA-OKE-5.4.2

Enable private OKE control plane access and disable public IP access

높음레벨 1자동oke

설명

This recommendation is the strict private access version of API endpoint hardening. The intended end state is that the Kubernetes API server is reachable only from inside the cluster VCN or from a connected private network, and there is no internet-reachable public API endpoint at all. This is a pure control plane exposure decision. Requires the oci CLI with read access to the cluster in OKE_CLUSTER_ID.

점검 방법

감사 방식: 셸 명령

shell

pub=$(oci ce cluster get --cluster-id "${OKE_CLUSTER_ID:?set OKE_CLUSTER_ID}" --query 'data."endpoint-config"."is-public-ip-enabled"' --raw-output) || exit 1
ep=$(oci ce cluster get --cluster-id "${OKE_CLUSTER_ID:?set OKE_CLUSTER_ID}" --query 'data.endpoints."public-endpoint"' --raw-output) || exit 1
if [ "$pub" = false ] && { [ -z "$ep" ] || [ "$ep" = null ]; }; then echo compliant; else echo "noncompliant: is-public-ip-enabled=$pub public-endpoint=$ep"; fi

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

Use private OKE control plane access by placing the Kubernetes API endpoint in a private subnet and disabling public IP assignment. This keeps Kubernetes API access on the VCN or an approved private network path. For a new cluster, create the Kubernetes API endpoint in a private subnet and do not assign a public IP address. oci ce cluster create \ --name $CLUSTER_NAME \ --compartment-id $COMPARTMENT_ID \ --vcn-id $VCN_OCID \ --kubernetes-version $KUBERNETES_VERSION \ --endpoint-subnet-id $PRIVATE_ENDPOINT_SUBNET_OCID \ --endpoint-public-ip-enabled false For an existing cluster, update the endpoint configuration so the Kubernetes API endpoint is not assigned a public IP address.

속성

운영 체제: 모두
태그: okemanaged-servicesnetwork
참고 자료: CIS Oracle Cloud Infrastructure Container Engine for Kubernetes (OKE) Benchmark v2.0.0 - 5.4.2 Enable private OKE control plane access and disable public IP access

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target oke