Restrict Access to the Control Plane Endpoint

Cách kiểm tra

Phương pháp kiểm tra: Lệnh shell

priv=$(az aks show --resource-group "${AKS_RG:?set AKS_RG}" --name "${AKS_NAME:?set AKS_NAME}" --query apiServerAccessProfile.enablePrivateCluster -o tsv) || exit 1
ranges=$(az aks show --resource-group "${AKS_RG:?set AKS_RG}" --name "${AKS_NAME:?set AKS_NAME}" --query 'apiServerAccessProfile.authorizedIpRanges' -o tsv) || exit 1
case "$priv" in [Tt]rue) echo compliant; exit 0;; esac
if [ -n "$ranges" ] && ! printf '%s\n' "$ranges" | grep -q '0\.0\.0\.0/0'; then echo compliant; else echo "noncompliant: public API server without authorized IP ranges"; fi

Đầu ra mong đợi

compliant

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

If the cluster is intended to expose the Kubernetes API server only over private network paths, use a private AKS cluster; if the cluster is already private but a public DNS name is still published, disable the public FQDN. If the cluster must keep a public API server endpoint, configure authorized IP ranges so only approved administrator and egress CIDR ranges can reach it. Microsoft notes that authorized IP ranges apply only to the public API server endpoint, recommends including both the cluster egress IP and the networks used to administer the cluster, and states that rule updates can take up to two minutes to propagate. 1. If enablePrivateCluster is false and the cluster should be managed only over private connectivity, move to private cluster mode using the Microsoft-supported private-cluster workflow for that cluster type.

Kiểm tra máy này

Chạy lệnh này trên máy bạn được phép kiểm tra. Lần quét chỉ ở chế độ đọc.

tmaegis scan --target aks