Use TLS certificates on OKE load balancer listeners for encrypted client connections

Kako se proverava

Metod provere: Ručni pregled

Ova preporuka se ne može proveriti automatski. Skeniranje je navodi sa ovim uputstvima kada prosledite --include-manual.

Review all OKE Service resources of type LoadBalancer and all Ingress resources that expose client traffic, and verify that client facing listeners use HTTPS or TLS with a valid certificate. For OCI Load Balancer backed Service resources, listener encryption is configured with annotations such as service.beta.kubernetes.io/oci-load-balancer-ssl-ports and service.beta.kubernetes.io/oci-load-balancer-tls-secret, or with OCI Certificates based configuration where used.

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Configure every client facing OKE load balancer listener to use HTTPS or TLS with a valid certificate so client to load balancer traffic is encrypted in transit. For OCI Load Balancer backed Service resources, configure SSL/TLS listener ports and associate a TLS certificate using Kubernetes secrets or OCI Certificates based configuration. For OCI native ingress controller resources, configure HTTPS/TLS listeners and associate the required Kubernetes secret or certificate OCID. If the design requires encryption beyond the load balancer, implement backend TLS separately because listener TLS alone protects only the client facing connection. • Add a valid certificate to each client facing OCI Load Balancer or OCI native ingress controller listener that should serve encrypted traffic.