11---
2+ reviewed : 2024-03-25
23severity : Important
34pillar : Security
4- category : Optimize
5+ category : SE:08 Hardening resources
56resource : Azure Kubernetes Service
67online version : https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.AKS.AzurePolicyAddOn/
78---
@@ -41,72 +42,93 @@ For example:
4142
4243``` json
4344{
44- "type" : " Microsoft.ContainerService/managedClusters"
45- "apiVersion" : " 2021-10-01"
46- "name" : " [parameters('clusterName')]"
47- "location" : " [parameters('location')]"
48- "identity" : {
49- "type" : " UserAssigned"
50- "userAssignedIdentities" : {
51- "[format('{0}', resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('identityName')))]" : {}
52- }
45+ "type" : " Microsoft.ContainerService/managedClusters"
46+ "apiVersion" : " 2024-01-01"
47+ "name" : " [parameters('name')]"
48+ "location" : " [parameters('location')]"
49+ "identity" : {
50+ "type" : " UserAssigned"
51+ "userAssignedIdentities" : {
52+ "[format('{0}', resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('identityName')))]" : {}
53+ }
54+ },
55+ "properties" : {
56+ "kubernetesVersion" : " [parameters('kubernetesVersion')]"
57+ "disableLocalAccounts" : true ,
58+ "enableRBAC" : true ,
59+ "dnsPrefix" : " [parameters('dnsPrefix')]"
60+ "agentPoolProfiles" : [
61+ {
62+ "name" : " system"
63+ "osDiskSizeGB" : 0 ,
64+ "minCount" : 3 ,
65+ "maxCount" : 5 ,
66+ "enableAutoScaling" : true ,
67+ "maxPods" : 50 ,
68+ "vmSize" : " Standard_D4s_v5"
69+ "type" : " VirtualMachineScaleSets"
70+ "vnetSubnetID" : " [parameters('clusterSubnetId')]"
71+ "mode" : " System"
72+ "osDiskType" : " Ephemeral"
73+ },
74+ {
75+ "name" : " user"
76+ "osDiskSizeGB" : 0 ,
77+ "minCount" : 3 ,
78+ "maxCount" : 20 ,
79+ "enableAutoScaling" : true ,
80+ "maxPods" : 50 ,
81+ "vmSize" : " Standard_D4s_v5"
82+ "type" : " VirtualMachineScaleSets"
83+ "vnetSubnetID" : " [parameters('clusterSubnetId')]"
84+ "mode" : " User"
85+ "osDiskType" : " Ephemeral"
86+ }
87+ ],
88+ "aadProfile" : {
89+ "managed" : true ,
90+ "enableAzureRBAC" : true ,
91+ "adminGroupObjectIDs" : " [parameters('clusterAdmins')]"
92+ "tenantID" : " [subscription().tenantId]"
5393 },
54- "properties" : {
55- "kubernetesVersion" : " [parameters('kubernetesVersion')]"
56- "enableRBAC" : true ,
57- "dnsPrefix" : " [parameters('dnsPrefix')]"
58- "agentPoolProfiles" : " [variables('allPools')]"
59- "aadProfile" : {
60- "managed" : true ,
61- "enableAzureRBAC" : true ,
62- "adminGroupObjectIDs" : " [parameters('clusterAdmins')]"
63- "tenantID" : " [subscription().tenantId]"
64- },
65- "networkProfile" : {
66- "networkPlugin" : " azure"
67- "networkPolicy" : " azure"
68- "loadBalancerSku" : " standard"
69- "serviceCidr" : " [variables('serviceCidr')]"
70- "dnsServiceIP" : " [variables('dnsServiceIP')]"
71- "dockerBridgeCidr" : " [variables('dockerBridgeCidr')]"
72- },
73- "autoUpgradeProfile" : {
74- "upgradeChannel" : " stable"
75- },
76- "addonProfiles" : {
77- "httpApplicationRouting" : {
78- "enabled" : false
79- },
80- "azurepolicy" : {
81- "enabled" : true ,
82- "config" : {
83- "version" : " v2"
84- }
85- },
86- "omsagent" : {
87- "enabled" : true ,
88- "config" : {
89- "logAnalyticsWorkspaceResourceID" : " [parameters('workspaceId')]"
90- }
91- },
92- "kubeDashboard" : {
93- "enabled" : false
94- },
95- "azureKeyvaultSecretsProvider" : {
96- "enabled" : true ,
97- "config" : {
98- "enableSecretRotation" : " true"
99- }
100- }
101- },
102- "podIdentityProfile" : {
103- "enabled" : true
104- }
94+ "networkProfile" : {
95+ "networkPlugin" : " azure"
96+ "networkPolicy" : " azure"
97+ "loadBalancerSku" : " standard"
98+ "serviceCidr" : " [variables('serviceCidr')]"
99+ "dnsServiceIP" : " [variables('dnsServiceIP')]"
105100 },
106- "tags" : " [parameters('tags')]"
107- "dependsOn" : [
108- " [resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('identityName'))]"
109- ]
101+ "apiServerAccessProfile" : {
102+ "enablePrivateCluster" : true ,
103+ "enablePrivateClusterPublicFQDN" : false
104+ },
105+ "autoUpgradeProfile" : {
106+ "upgradeChannel" : " stable"
107+ },
108+ "oidcIssuerProfile" : {
109+ "enabled" : true
110+ },
111+ "addonProfiles" : {
112+ "azurepolicy" : {
113+ "enabled" : true
114+ },
115+ "omsagent" : {
116+ "enabled" : true ,
117+ "config" : {
118+ "logAnalyticsWorkspaceResourceID" : " [parameters('workspaceId')]"
119+ }
120+ },
121+ "azureKeyvaultSecretsProvider" : {
122+ "enabled" : true ,
123+ "config" : {
124+ "enableSecretRotation" : " true"
125+ }
126+ }
127+ }
128+ },
129+ "dependsOn" : [
130+ " [resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('identityName'))]"
131+ ]
110132}
111133```
112134
@@ -119,9 +141,9 @@ To deploy AKS clusters that pass this rule:
119141For example:
120142
121143``` bicep
122- resource cluster 'Microsoft.ContainerService/managedClusters@2021-10 -01' = {
144+ resource privateCluster 'Microsoft.ContainerService/managedClusters@2024-01 -01' = {
123145 location: location
124- name: clusterName
146+ name: name
125147 identity: {
126148 type: 'UserAssigned'
127149 userAssignedIdentities: {
@@ -130,9 +152,37 @@ resource cluster 'Microsoft.ContainerService/managedClusters@2021-10-01' = {
130152 }
131153 properties: {
132154 kubernetesVersion: kubernetesVersion
155+ disableLocalAccounts: true
133156 enableRBAC: true
134157 dnsPrefix: dnsPrefix
135- agentPoolProfiles: allPools
158+ agentPoolProfiles: [
159+ {
160+ name: 'system'
161+ osDiskSizeGB: 0
162+ minCount: 3
163+ maxCount: 5
164+ enableAutoScaling: true
165+ maxPods: 50
166+ vmSize: 'Standard_D4s_v5'
167+ type: 'VirtualMachineScaleSets'
168+ vnetSubnetID: clusterSubnetId
169+ mode: 'System'
170+ osDiskType: 'Ephemeral'
171+ }
172+ {
173+ name: 'user'
174+ osDiskSizeGB: 0
175+ minCount: 3
176+ maxCount: 20
177+ enableAutoScaling: true
178+ maxPods: 50
179+ vmSize: 'Standard_D4s_v5'
180+ type: 'VirtualMachineScaleSets'
181+ vnetSubnetID: clusterSubnetId
182+ mode: 'User'
183+ osDiskType: 'Ephemeral'
184+ }
185+ ]
136186 aadProfile: {
137187 managed: true
138188 enableAzureRBAC: true
@@ -145,53 +195,55 @@ resource cluster 'Microsoft.ContainerService/managedClusters@2021-10-01' = {
145195 loadBalancerSku: 'standard'
146196 serviceCidr: serviceCidr
147197 dnsServiceIP: dnsServiceIP
148- dockerBridgeCidr: dockerBridgeCidr
198+ }
199+ apiServerAccessProfile: {
200+ enablePrivateCluster: true
201+ enablePrivateClusterPublicFQDN: false
149202 }
150203 autoUpgradeProfile: {
151204 upgradeChannel: 'stable'
152205 }
206+ oidcIssuerProfile: {
207+ enabled: true
208+ }
153209 addonProfiles: {
154- httpApplicationRouting: {
155- enabled: false
156- }
157210 azurepolicy: {
158211 enabled: true
159- config: {
160- version: 'v2'
161- }
162212 }
163213 omsagent: {
164214 enabled: true
165215 config: {
166216 logAnalyticsWorkspaceResourceID: workspaceId
167217 }
168218 }
169- kubeDashboard: {
170- enabled: false
171- }
172219 azureKeyvaultSecretsProvider: {
173220 enabled: true
174221 config: {
175222 enableSecretRotation: 'true'
176223 }
177224 }
178225 }
179- podIdentityProfile: {
180- enabled: true
181- }
182226 }
183- tags: tags
184227}
185228```
186229
230+ ### Configure with Azure Policy
231+
232+ To address this issue at runtime use the following policies:
233+
234+ - [ Azure Policy Add-on for Kubernetes service (AKS) should be installed and enabled on your clusters] ( https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Kubernetes/AKS_AzurePolicyAddOn_Audit.json )
235+ ` /providers/Microsoft.Authorization/policyDefinitions/0a15ec92-a229-4763-bb14-0ea34a568f8d `
236+ - [ Deploy Azure Policy Add-on to Azure Kubernetes Service clusters] ( https://github.com/Azure/azure-policy/blob/master/built-in-policies/policyDefinitions/Kubernetes/AKS_AzurePolicyAddOn_DINE.json )
237+ ` /providers/Microsoft.Authorization/policyDefinitions/a8eff44f-8c92-45c3-a3fb-9880802d67a7 `
238+
187239## NOTES
188240
189241Azure Policy for AKS clusters is generally available (GA).
190242Azure Policy for AKS Engine and Arc enabled Kubernetes are currently in preview.
191243
192244## LINKS
193245
194- - [ Governance, risk, and compliance ] ( https://learn.microsoft.com/azure/architecture/framework/ security/governance#audit-and-enforce-policy-compliance )
195- - [ Understand Azure Policy for Kubernetes clusters] ( https://docs .microsoft.com/azure/governance/policy/concepts/policy-for-kubernetes )
196- - [ Secure your cluster with Azure Policy] ( https://docs .microsoft.com/azure/aks/use-azure-policy )
197- - [ Azure deployment reference] ( https://docs .microsoft.com/azure/templates/microsoft.containerservice/managedclusters )
246+ - [ SE:08 Hardening resources ] ( https://learn.microsoft.com/azure/well-architected/ security/harden-resources )
247+ - [ Understand Azure Policy for Kubernetes clusters] ( https://learn .microsoft.com/azure/governance/policy/concepts/policy-for-kubernetes )
248+ - [ Secure your Azure Kubernetes Service (AKS) clusters with Azure Policy] ( https://learn .microsoft.com/azure/aks/use-azure-policy )
249+ - [ Azure deployment reference] ( https://learn .microsoft.com/azure/templates/microsoft.containerservice/managedclusters )
0 commit comments