Restrict Access to the Control Plane Endpoint

Как проверяется

Метод проверки: Команда оболочки

priv=$(az aks show --resource-group "${AKS_RG:?set AKS_RG}" --name "${AKS_NAME:?set AKS_NAME}" --query apiServerAccessProfile.enablePrivateCluster -o tsv) || exit 1
ranges=$(az aks show --resource-group "${AKS_RG:?set AKS_RG}" --name "${AKS_NAME:?set AKS_NAME}" --query 'apiServerAccessProfile.authorizedIpRanges' -o tsv) || exit 1
case "$priv" in [Tt]rue) echo compliant; exit 0;; esac
if [ -n "$ranges" ] && ! printf '%s\n' "$ranges" | grep -q '0\.0\.0\.0/0'; then echo compliant; else echo "noncompliant: public API server without authorized IP ranges"; fi

Ожидаемый вывод

compliant

Как исправляется

Метод исправления: Рекомендация или патч инфраструктуры

If the cluster is intended to expose the Kubernetes API server only over private network paths, use a private AKS cluster; if the cluster is already private but a public DNS name is still published, disable the public FQDN. If the cluster must keep a public API server endpoint, configure authorized IP ranges so only approved administrator and egress CIDR ranges can reach it. Microsoft notes that authorized IP ranges apply only to the public API server endpoint, recommends including both the cluster egress IP and the networks used to administer the cluster, and states that rule updates can take up to two minutes to propagate. 1. If enablePrivateCluster is false and the cluster should be managed only over private connectivity, move to private cluster mode using the Microsoft-supported private-cluster workflow for that cluster type.

Проверить этот хост

Выполните команду на компьютере, аудит которого вам разрешён. Сканирование работает только на чтение.

tmaegis scan --target aks