Azure AKS cluster Azure CNI networking not enabled misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC2_AZURE_29
Category - Subcategory	Public Exposure - VPC VCN VNet
Provider	AZURE
Severity	LOW
Framework	Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	bc288480-0d31-4ccc-bc0e-3c4dc185f5a1

Impact

This rule is checking to ensure that an Azure Kubernetes Service (AKS) cluster has Azure Container Network Interface (CNI) networking enabled. If not enabled, it presents a security risk. Azure CNI is a networking interface for connecting containers managed by Kubernetes. It allows them to have an IP address that is safe and secure from the Azure network, allowing the pods to directly access services over the Azure Virtual Network infrastructure. This reduces the risk of network intrusion and simplifies the network management within the cluster, thereby improving overall security.

How to Fix

Resource: azurerm_kubernetes_cluster

• Arguments: network_profile.network_plugin

To fix this issue, you need to specify azure as the value of network_plugin in the network_profile block under azurerm_kubernetes_cluster resource.

The above code is secure because it uses Azure Container Networking Interface (CNI) for networking which provides VNET networking capabilities to Pods in Azure Kubernetes Service(AKS). This grants pods with their own IP addresses from a subnet and full network access to other network resources. This can be essential for running security-sensitive workloads or workloads requiring network policies. [source,go]

resource "azurerm_kubernetes_cluster" "aks_example" { // other configuration

network_profile { network_plugin = "azure" // other configuration } }