Ensure clusters are created with Private Nodes

ВысокийУровень 1Ручная проверкаoke

Описание

This recommendation is about the data plane, not the control plane. It means worker nodes are placed in private subnets and are not intended to have direct public internet exposure. In the common pattern, nodes run in private subnets while internet-facing ingress resources are placed in public subnets. The benchmark marks this recommendation Manual.

Как проверяется

Метод проверки: Ручная проверка

Эту рекомендацию нельзя проверить автоматически. Сканирование выводит её вместе с этими инструкциями при указании флага --include-manual.

Review the subnets used by each OKE node pool and verify that worker nodes are deployed in private subnets, not public subnets. For this control, the deciding evidence is node subnet placement, public IP behavior, and subnet routing, not the control plane endpoint settings. A compliant private-node design places nodes in subnets that prohibit public IP assignment on VNICs and do not have a default route to an Internet Gateway. If outbound access is required, the design should use a NAT gateway, service gateway, or other required private network path instead.

Как исправляется

Метод исправления: Рекомендация или патч инфраструктуры

For existing worker nodes that run in public subnets, remediate the nodes by replacing them with a new node pool that uses only private subnets, then migrating workloads and retiring the original node pool. The target private subnets should prohibit public IP assignment on VNICs and should not have a default route to an Internet Gateway. If outbound access is required for image pulls or OCI API calls, provide it through a NAT gateway, service gateway, or the required private network path instead. • Create a new node pool that uses only private subnet IDs. Do not reuse public subnets for the replacement worker nodes. • Ensure the replacement subnets prohibit public IP assignment on VNICs, so new worker instances are launched without public IPs. • Ensure the route tables for those subnets do not send 0.0.0.0/0 directly to an Internet Gateway.

Свойства

Операционные системы: Любая
Теги: okemanaged-servicesnetwork
Источник: CIS Oracle Cloud Infrastructure Container Engine for Kubernetes (OKE) Benchmark v2.0.0 - 5.4.3 Ensure clusters are created with Private Nodes