Use TLS certificates on OKE load balancer listeners for encrypted client connections

높음레벨 1수동 검토oke

설명

Using TLS certificates on OKE load balancer listeners protects client to load balancer traffic in transit by presenting a trusted server certificate and negotiating encrypted HTTPS or TLS connections at the listener. In OKE, this commonly means configuring TLS on an OCI Load Balancer created for Kubernetes Service resources, or configuring HTTPS/TLS on OCI native ingress controller listeners so externally exposed application entry points do not ... The benchmark marks this recommendation Manual.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

Review all OKE Service resources of type LoadBalancer and all Ingress resources that expose client traffic, and verify that client facing listeners use HTTPS or TLS with a valid certificate. For OCI Load Balancer backed Service resources, listener encryption is configured with annotations such as service.beta.kubernetes.io/oci-load-balancer-ssl-ports and service.beta.kubernetes.io/oci-load-balancer-tls-secret, or with OCI Certificates based configuration where used.

조치 방법

조치 방식: 가이드 또는 인프라 패치

Configure every client facing OKE load balancer listener to use HTTPS or TLS with a valid certificate so client to load balancer traffic is encrypted in transit. For OCI Load Balancer backed Service resources, configure SSL/TLS listener ports and associate a TLS certificate using Kubernetes secrets or OCI Certificates based configuration. For OCI native ingress controller resources, configure HTTPS/TLS listeners and associate the required Kubernetes secret or certificate OCID. If the design requires encryption beyond the load balancer, implement backend TLS separately because listener TLS alone protects only the client facing connection. • Add a valid certificate to each client facing OCI Load Balancer or OCI native ingress controller listener that should serve encrypted traffic.

속성

운영 체제: 모두
태그: okemanaged-servicesnetworksecrets
참고 자료: CIS Oracle Cloud Infrastructure Container Engine for Kubernetes (OKE) Benchmark v2.0.0 - 5.4.5 Use TLS certificates on OKE load balancer listeners for encrypted client connections