Restrict Access to the Control Plane Endpoint

Nasıl denetlenir

Denetim yöntemi: Kabuk komutu

priv=$(az aks show --resource-group "${AKS_RG:?set AKS_RG}" --name "${AKS_NAME:?set AKS_NAME}" --query apiServerAccessProfile.enablePrivateCluster -o tsv) || exit 1
ranges=$(az aks show --resource-group "${AKS_RG:?set AKS_RG}" --name "${AKS_NAME:?set AKS_NAME}" --query 'apiServerAccessProfile.authorizedIpRanges' -o tsv) || exit 1
case "$priv" in [Tt]rue) echo compliant; exit 0;; esac
if [ -n "$ranges" ] && ! printf '%s\n' "$ranges" | grep -q '0\.0\.0\.0/0'; then echo compliant; else echo "noncompliant: public API server without authorized IP ranges"; fi

Beklenen çıktı

compliant

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

If the cluster is intended to expose the Kubernetes API server only over private network paths, use a private AKS cluster; if the cluster is already private but a public DNS name is still published, disable the public FQDN. If the cluster must keep a public API server endpoint, configure authorized IP ranges so only approved administrator and egress CIDR ranges can reach it. Microsoft notes that authorized IP ranges apply only to the public API server endpoint, recommends including both the cluster egress IP and the networks used to administer the cluster, and states that rule updates can take up to two minutes to propagate. 1. If enablePrivateCluster is false and the cluster should be managed only over private connectivity, move to private cluster mode using the Microsoft-supported private-cluster workflow for that cluster type.

Bu ana makineyi denetle

Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.

tmaegis scan --target aks