Azure AKS clusters should use private cluster mode and disable the public control plane FQDN

azure.kubernetes
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Description

This rule verifies that an Azure Kubernetes Service (AKS) cluster is configured as a private cluster and that the public control plane FQDN is disabled. Running the API server in private cluster mode keeps control-plane traffic on the private network, while disabling the public FQDN ensures that the cluster’s control plane is not additionally exposed through a publicly resolvable name.

The evaluation inspects the cluster’s api_server_access_profile:

  • enable_private_cluster must be true so that the API server is provisioned with a private endpoint.
  • enable_private_cluster_public_fqdn must be false (or unset) so that no public FQDN is generated for the private cluster control plane.

When both conditions are met the cluster is reported as pass; otherwise it is reported as fail.

Rationale

Exposing the AKS control plane through a public FQDN increases the cluster’s attack surface and may allow connection attempts from the public internet. Private cluster mode restricts API server access to the cluster’s virtual network, and disabling the public FQDN removes a publicly resolvable entry point to the control plane.

Remediation

Enable private cluster mode and disable the public control plane FQDN on the AKS cluster. Private cluster mode can only be configured at cluster creation time, while the public FQDN can be disabled on an existing private cluster. For step-by-step guidance, see the Create a private Azure Kubernetes Service (AKS) cluster documentation.

Confirm in the cluster’s API server access profile that enablePrivateCluster is true and enablePrivateClusterPublicFQDN is false.

References