Deploy EKS Auto Mode nodes only in private subnets

Nasıl denetlenir

Denetim yöntemi: Manuel inceleme

Bu öneri otomatik olarak denetlenemez. --include-manual parametresini verdiğinizde tarama bunu bu talimatlarla birlikte listeler.

Review the EKS Auto Mode NodePool and NodeClass configuration to confirm nodes are placed only in private subnets. Validate the NodeClass subnet selection, subnet public IP behavior, and route table design. A compliant design uses subnets that do not auto assign public IPv4 addresses and do not route directly to an Internet Gateway. Review the NodePool and NodeClass configuration and confirm each NodePool references a NodeClass whose subnetSelectorTerms select only private subnets. The NodeClass should use private subnet IDs directly or private subnet tags.

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

For EKS Auto Mode nodes placed in public subnets, remediate by updating the NodeClass and NodePool design so Auto Mode provisions nodes only in private subnets. In EKS Auto Mode, subnet placement is controlled through NodeClass subnetSelectorTerms, and NodePools reference the NodeClass that defines the infrastructure configuration. If existing nodes were created from a NodeClass that selects public subnets, create or update a NodeClass that selects only private subnets, then move workloads to NodePools that reference the corrected NodeClass. • Create or update the NodeClass so subnetSelectorTerms selects only private subnet IDs or private subnet tags • Confirm the selected subnets do not auto assign public IPv4 addresses and their route tables do not send 0.0.0.0/0 directly to an Internet Gateway.