Ensure that Azure Kubernetes Service (AKS) clusters are configured to use the Azure Container Networking Interface (CNI) mode instead of the default Kubenet networking mode in order to enhance the segregation of resources and controls in an enterprise environment.
excellence
Choosing the appropriate network model for your AKS clusters is vital. In production, the Azure Container Networking Interface (CNI) is useful for enabling the segregation of control and resource management. This separation is particularly important for maintaining security, as different teams are often responsible for managing and safeguarding these resources. Azure CNI networking allows direct connectivity to various entities, such as existing Azure resources, on-premises resources, or other services, through individual IP addresses assigned to each pod. By utilizing Azure CNI networking, the virtual network resource resides in a distinct resource group from the AKS cluster. To grant access and administration privileges for these resources, delegate permissions to the AKS cluster identity. The AKS cluster must possess, at a minimum, Network Contributor permissions on the subnet within your virtual network.
Audit
To determine if Azure CNI networking mode is configured for your AKS clusters, perform the following actions:
Remediation / Resolution
To configure Azure CNI networking mode for your AKS clusters, you have to re-create your clusters. To relaunch your AKS clusters with the required networking configuration, perform the following actions:
References
- Azure Official Documentation
- Network concepts for applications in Azure Kubernetes Service (AKS)
- Best practices for network connectivity and security in Azure Kubernetes Service (AKS)
- Configure Azure CNI networking in Azure Kubernetes Service (AKS)
- Azure PowerShell Documentation
- az aks list
- az aks show
- az aks create
Unlock the Remediation Steps
Free 30-day Trial
Automatically audit your configurations with Conformity
and gain access to our cloud security platform.
You are auditing:
Use Azure Container Networking Interface (CNI) for AKS Clusters
Risk Level: Medium