Ensure that the Public FQDN feature is disabled for your private Azure Kubernetes Service (AKS) clusters. A public Fully Qualified Domain Name (FQDN) is a domain name that can be accessed over the Internet and resolves to a specific resource, such as a server or service, including private resources such as Azure AKS clusters. In Azure cloud, a public FQDN is automatically created when an AKS cluster is provisioned. This FQDN allows access to the Kubernetes API server over the Internet, which can be useful for managing and interacting with the cluster remotely. However, it also exposes the cluster to potential security risks.
In private Azure Kubernetes Service (AKS) clusters, disabling the public FQDN enhances security by preventing external, unauthorized access. This ensures that the cluster is accessible only via a private endpoint, reducing the risk of exposure to attacks.
Audit
To determine if your private Azure AKS clusters are configured with a public FQDN, perform the following operations:
Checking the Public FQDN feature status for private Azure AKS clusters using Microsoft Azure Portal (Azure Console) is not currently supported.Remediation / Resolution
To ensure that your private Azure Kubernetes Service (AKS) clusters are not configured with a public FQDN, perform the following operations:
Disabling the Public FQDN feature for private Azure AKS clusters using Microsoft Azure Portal (Azure Console) is not currently supported.References
- Azure Official Documentation
- Create a private Azure Kubernetes Service (AKS) cluster
- Disable a public FQDN on an existing cluster
- Azure PowerShell Documentation
- az account list
- az account set
- az aks list
- az aks show
- az aks
Unlock the Remediation Steps
Free 30-day Trial
Automatically audit your configurations with Conformity
and gain access to our cloud security platform.
You are auditing:
Disable Public FQDN for Private AKS Clusters
Risk Level: Medium