Use HTTPS with valid TLS certificates for externally exposed workloads

Trung bìnhCấp 2Xem xét thủ côngaks

Mô tả

This helps protect externally exposed AKS applications by ensuring client connections use HTTPS instead of plaintext HTTP at the cluster entry point. In AKS, that protection is typically applied at the ingress or gateway layer, where external web traffic is accepted and routed to backend services. Using TLS at that layer reduces the risk of exposing application traffic, credentials, session data, or other sensitive content in transit. The benchmark marks this recommendation Manual.

Cách kiểm tra

Phương pháp kiểm tra: Xem xét thủ công

Khuyến nghị này không thể kiểm tra tự động. Lần quét sẽ liệt kê mục này kèm hướng dẫn khi bạn truyền cờ --include-manual.

Its important to review this at the Ingress or Gateway layer, since in AKS those components are the primary enforcement points for external HTTP and TLS termination. The purpose of the review is to confirm that public application entry points are not exposing client traffic over plaintext HTTP and that every externally published hostname is protected by a certificate-backed HTTPS or TLS listener. In AKS, ingress can provide SSL termination, and the application routing add-on supports certificate-based HTTPS using Azure Key Vault–integrated patterns.

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

Remediate by ensuring every externally exposed AKS web entry point is published through an Ingress or Gateway listener configured for HTTPS/TLS, with a valid certificate bound to the public hostname. In AKS, HTTPS protection is typically implemented at the layer 7 ingress or gateway layer, where client traffic is accepted and TLS is terminated before traffic is forwarded to backend services. The remediation objective is to eliminate plaintext HTTP exposure for public application endpoints and standardize certificate-backed TLS for all external web traffic. 1. Update each public Ingress or Gateway that currently exposes HTTP-only traffic so the listener uses HTTPS or TLS for the published hostname. In AKS, ingress is the supported control point for external HTTP-like traffic and SSL/TLS termination. 2.

Thuộc tính

Hệ điều hành: Bất kỳ
Thẻ: aksmanaged-servicesnetwork
Tham chiếu: CIS Azure Kubernetes Service (AKS) Benchmark v2.0.0 - 5.4.5 Use HTTPS with valid TLS certificates for externally exposed workloads