C-0249 - Restrict untrusted workloads
Prerequisites
Run Kubescape with host sensor (see here)
Framework
cis-aks-t1.2.0
Severity
Medium
Description of the the issue
It is Best Practice to restrict or fence untrusted workloads when running in a multi-tenant environment. Azure Container Instances is a great solution for any scenario that can operate in isolated containers, including simple applications, task automation, and build jobs.
Related resources
What does this control test
Restricting unstrusted workloads can be achieved by using ACI along with AKS.
What is ACI?
ACI lets you quickly deploy container instances without additional infrastructure overhead. When you connect with AKS, ACI becomes a secured, logical extension of your AKS cluster. The virtual nodes component, which is based on Virtual Kubelet, is installed in your AKS cluster that presents ACI as a virtual Kubernetes node. Kubernetes can then schedule pods that run as ACI instances through virtual nodes, not as pods on VM nodes directly in your AKS cluster.
Your application requires no modification to use virtual nodes. Deployments can scale across AKS and ACI and with no delay as cluster autoscaler deploys new nodes in your AKS cluster.
Virtual nodes are deployed to an additional subnet in the same virtual network as your AKS cluster. This virtual network configuration allows the traffic between ACI and AKS to be secured. Like an AKS cluster, an ACI instance is a secure, logical compute resource that is isolated from other users.
How to check it manually
Remediation
Impact Statement
Default Value
ACI is not a default component of the AKS
Example
No example
Updated 3 months ago