Use private AKS clusters and disable public control plane DNS

Nasıl denetlenir

Denetim yöntemi: Kabuk komutu

out=$(az aks show --resource-group "${AKS_RG:?set AKS_RG}" --name "${AKS_NAME:?set AKS_NAME}" --query '[apiServerAccessProfile.enablePrivateCluster, apiServerAccessProfile.enablePublicFqdn]' -o tsv) || exit 1
set -- $(printf '%s\n' "$out" | tr 'A-Z' 'a-z')
if [ "${1:-}" = true ] && [ "${2:-}" = false ]; then echo compliant; else echo "noncompliant: enablePrivateCluster=${1:-} enablePublicFqdn=${2:-}"; fi

Beklenen çıktı

compliant

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

Use the apiServerAccessProfile results to determine whether the cluster must be moved to private cluster mode and whether the public FQDN must be disabled. Remediation should bring the cluster to enablePrivateCluster: true and, where required by policy, enablePublicFqdn: false; the detailed action depends on whether the cluster is new or existing and whether API Server VNet Integration is already in place. 1. If enablePrivateCluster is false on a new deployment, create the cluster as private by using az aks create --enable-private-cluster add --disable-public-fqdn when the requirement is to prevent publication of a public DNS name for the API server. 2. If enablePrivateCluster is false on an existing cluster, first determine whether the cluster already uses API Server VNet Integration.

Bu ana makineyi denetle

Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.

tmaegis scan --target aks --level 2