Restrict Access to the Control Plane Endpoint

Kako se proverava

Metod provere: Komanda ljuske

priv=$(az aks show --resource-group "${AKS_RG:?set AKS_RG}" --name "${AKS_NAME:?set AKS_NAME}" --query apiServerAccessProfile.enablePrivateCluster -o tsv) || exit 1
ranges=$(az aks show --resource-group "${AKS_RG:?set AKS_RG}" --name "${AKS_NAME:?set AKS_NAME}" --query 'apiServerAccessProfile.authorizedIpRanges' -o tsv) || exit 1
case "$priv" in [Tt]rue) echo compliant; exit 0;; esac
if [ -n "$ranges" ] && ! printf '%s\n' "$ranges" | grep -q '0\.0\.0\.0/0'; then echo compliant; else echo "noncompliant: public API server without authorized IP ranges"; fi

Očekivani izlaz

compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

If the cluster is intended to expose the Kubernetes API server only over private network paths, use a private AKS cluster; if the cluster is already private but a public DNS name is still published, disable the public FQDN. If the cluster must keep a public API server endpoint, configure authorized IP ranges so only approved administrator and egress CIDR ranges can reach it. Microsoft notes that authorized IP ranges apply only to the public API server endpoint, recommends including both the cluster egress IP and the networks used to administer the cluster, and states that rule updates can take up to two minutes to propagate. 1. If enablePrivateCluster is false and the cluster should be managed only over private connectivity, move to private cluster mode using the Microsoft-supported private-cluster workflow for that cluster type.

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

tmaegis scan --target aks