-
Notifications
You must be signed in to change notification settings - Fork 29
Create aks2.tf #2
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: master
Are you sure you want to change the base?
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,25 @@ | ||
| resource azurerm_kubernetes_cluster "k8s_cluster" { | ||
| dns_prefix = "terragoat-${var.environment}" | ||
| location = var.location | ||
| name = "terragoat-aks-${var.environment}" | ||
| resource_group_name = azurerm_resource_group.example.name | ||
| identity { | ||
| type = "SystemAssigned" | ||
| } | ||
| default_node_pool { | ||
| name = "default" | ||
| vm_size = "Standard_D2_v2" | ||
| node_count = 2 | ||
| } | ||
| addon_profile { | ||
| oms_agent { | ||
| enabled = false | ||
| } | ||
| kube_dashboard { | ||
| enabled = true | ||
| } | ||
| } | ||
| role_based_access_control { | ||
| enabled = false | ||
| } | ||
| } | ||
|
Comment on lines
+1
to
+25
Check failureCode scanning / defsec Ensure AKS has an API Server Authorized IP Ranges enabled
Cluster does not limit API access to specific IP addresses.
Comment on lines
+1
to
+25
Check warningCode scanning / defsec Ensure AKS logging to Azure Monitoring is Configured
Cluster does not have logging enabled via OMS Agent.
Comment on lines
+1
to
+25
Check failureCode scanning / defsec Ensure RBAC is enabled on AKS clusters
Cluster has RBAC disabled
Comment on lines
+1
to
+25
Check failureCode scanning / bridgecrew Ensure ephemeral disks are used for OS disks
Ensure ephemeral disks are used for OS disks
Comment on lines
+1
to
+25
Check failureCode scanning / bridgecrew Ensure that the AKS cluster encrypt temp disks, caches, and data flows between Compute and Storage resources
Ensure that the AKS cluster encrypt temp disks, caches, and data flows between Compute and Storage resources
Comment on lines
+1
to
+25
Check failureCode scanning / bridgecrew Ensure autorotation of Secrets Store CSI Driver secrets for AKS clusters
Ensure autorotation of Secrets Store CSI Driver secrets for AKS clusters
Comment on lines
+1
to
+25
Check failureCode scanning / bridgecrew Ensure AKS logging to Azure Monitoring is Configured
Ensure AKS logging to Azure Monitoring is Configured
Comment on lines
+1
to
+25
Check failureCode scanning / bridgecrew Ensure AKS has an API Server Authorized IP Ranges enabled
Ensure AKS has an API Server Authorized IP Ranges enabled
Comment on lines
+1
to
+25
Check failureCode scanning / bridgecrew Ensure Kubernetes Dashboard is disabled
Ensure Kubernetes Dashboard is disabled
Comment on lines
+1
to
+25
Check failureCode scanning / bridgecrew Ensure that AKS uses Azure Policies Add-on
Ensure that AKS uses Azure Policies Add-on
Comment on lines
+1
to
+25
Check failureCode scanning / bridgecrew Ensure AKS cluster upgrade channel is chosen
Ensure AKS cluster upgrade channel is chosen
Comment on lines
+1
to
+25
Check failureCode scanning / bridgecrew Ensure AKS local admin account is disabled
Ensure AKS local admin account is disabled
Comment on lines
+1
to
+25
Check failureCode scanning / bridgecrew Ensure that AKS enables private clusters
Ensure that AKS enables private clusters
Comment on lines
+1
to
+25
Check failureCode scanning / bridgecrew Ensure RBAC is enabled on AKS clusters
Ensure RBAC is enabled on AKS clusters
Comment on lines
+1
to
+25
Check failureCode scanning / bridgecrew Ensure Azure Kubernetes Cluster (AKS) nodes should use a minimum number of 50 pods.
Ensure Azure Kubernetes Cluster (AKS) nodes should use a minimum number of 50 pods.
Comment on lines
+1
to
+25
Check failureCode scanning / bridgecrew Ensure that AKS use the Paid Sku for its SLA
Ensure that AKS use the Paid Sku for its SLA
Comment on lines
+1
to
+25
Check failureCode scanning / bridgecrew Ensure AKS cluster has Network Policy configured
Ensure AKS cluster has Network Policy configured
Comment on lines
+1
to
+25
Check failureCode scanning / bridgecrew Ensure that only critical system pods run on system nodes
Ensure that only critical system pods run on system nodes
Comment on lines
+1
to
+25
Check failureCode scanning / bridgecrew Ensure that AKS uses disk encryption set
Ensure that AKS uses disk encryption set
Comment on lines
+1
to
+25
Check failureCode scanning / bridgecrew Ensure AKS cluster has Azure CNI networking enabled
Ensure AKS cluster has Azure CNI networking enabled
|
||
Check failure
Code scanning / defsec
Ensure AKS cluster has Network Policy configured