Restrict OKE control plane endpoint access using private endpoints or approved CIDRs

YüksekDüzey 1Manuel incelemeoke

Açıklama

This recommendation is about reducing exposure of the Kubernetes API server without necessarily making it private only. The intended end state is that the OKE Kubernetes API endpoint is placed behind a private endpoint where possible, or if a public IP address is assigned, access is limited to approved source CIDRs through OCI network security rules. Reported as a manual review because it needs site-specific judgement.

Nasıl denetlenir

Denetim yöntemi: Manuel inceleme

Bu öneri otomatik olarak denetlenemez. --include-manual parametresini verdiğinizde tarama bunu bu talimatlarla birlikte listeler.

Check the OKE Kubernetes API endpoint configuration and determine whether the endpoint has a public IP address assigned. Also identify the endpoint subnet and any network security groups attached to the endpoint. oci ce cluster get \ --cluster-id $CLUSTER_ID \ --query 'data.{endpointConfig:"endpoint-config",endpoints:endpoints}' \ --output json Expected Output: { "endpointConfig": { "is-public-ip-enabled": false, "nsg-ids": [ "ocid1.networksecuritygroup.oc1..." ], "subnet-id": "ocid1.subnet.oc1..." }, "endpoints": { "private-endpoint": "10.0.0.10:6443", "public-endpoint": null } } ...

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

Restrict access to the OKE Kubernetes API endpoint by using a private endpoint where possible, or by limiting public endpoint access through OCI network security groups or security lists. The Kubernetes API endpoint is hosted in a VCN subnet, and Oracle recommends using network security groups or security lists to control access to that subnet. For new clusters, place the Kubernetes API endpoint in a private subnet when internet access to the API endpoint is not required.

Özellikler

İşletim sistemleri: Herhangi biri
Etiketler: okemanaged-servicesnetwork
Referans: CIS Oracle Cloud Infrastructure Container Engine for Kubernetes (OKE) Benchmark v2.0.0 - 5.4.1 Restrict OKE control plane endpoint access using private endpoints or approved CIDRs