-
Notifications
You must be signed in to change notification settings - Fork 25
Create aks2.tf #2
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: master
Are you sure you want to change the base?
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,25 @@ | ||
| resource azurerm_kubernetes_cluster "k8s_cluster" { | ||
| dns_prefix = "terragoat-${var.environment}" | ||
| location = var.location | ||
| name = "terragoat-aks-${var.environment}" | ||
| resource_group_name = azurerm_resource_group.example.name | ||
| identity { | ||
| type = "SystemAssigned" | ||
| } | ||
| default_node_pool { | ||
| name = "default" | ||
| vm_size = "Standard_D2_v2" | ||
| node_count = 2 | ||
| } | ||
| addon_profile { | ||
| oms_agent { | ||
| enabled = false | ||
| } | ||
| kube_dashboard { | ||
| enabled = true | ||
| } | ||
| } | ||
| role_based_access_control { | ||
| enabled = false | ||
| } | ||
| } | ||
|
Comment on lines
+1
to
+25
Check failureCode scanning / defsec Ensure AKS has an API Server Authorized IP Ranges enabled Error
Cluster does not limit API access to specific IP addresses.
Comment on lines
+1
to
+25
Check warningCode scanning / defsec Ensure AKS logging to Azure Monitoring is Configured Warning
Cluster does not have logging enabled via OMS Agent.
Comment on lines
+1
to
+25
Check failureCode scanning / defsec Ensure RBAC is enabled on AKS clusters Error
Cluster has RBAC disabled
Comment on lines
+1
to
+25
Check failureCode scanning / bridgecrew Ensure ephemeral disks are used for OS disks Error
Ensure ephemeral disks are used for OS disks
Comment on lines
+1
to
+25
Check failureCode scanning / bridgecrew Ensure that the AKS cluster encrypt temp disks, caches, and data flows between Compute and Storage resources Error
Ensure that the AKS cluster encrypt temp disks, caches, and data flows between Compute and Storage resources
Comment on lines
+1
to
+25
Check failureCode scanning / bridgecrew Ensure autorotation of Secrets Store CSI Driver secrets for AKS clusters Error
Ensure autorotation of Secrets Store CSI Driver secrets for AKS clusters
Comment on lines
+1
to
+25
Check failureCode scanning / bridgecrew Ensure AKS logging to Azure Monitoring is Configured Error
Ensure AKS logging to Azure Monitoring is Configured
Comment on lines
+1
to
+25
Check failureCode scanning / bridgecrew Ensure AKS has an API Server Authorized IP Ranges enabled Error
Ensure AKS has an API Server Authorized IP Ranges enabled
Comment on lines
+1
to
+25
Check failureCode scanning / bridgecrew Ensure Kubernetes Dashboard is disabled Error
Ensure Kubernetes Dashboard is disabled
Comment on lines
+1
to
+25
Check failureCode scanning / bridgecrew Ensure that AKS uses Azure Policies Add-on Error
Ensure that AKS uses Azure Policies Add-on
Comment on lines
+1
to
+25
Check failureCode scanning / bridgecrew Ensure AKS cluster upgrade channel is chosen Error
Ensure AKS cluster upgrade channel is chosen
Comment on lines
+1
to
+25
Check failureCode scanning / bridgecrew Ensure AKS local admin account is disabled Error
Ensure AKS local admin account is disabled
Comment on lines
+1
to
+25
Check failureCode scanning / bridgecrew Ensure that AKS enables private clusters Error
Ensure that AKS enables private clusters
Comment on lines
+1
to
+25
Check failureCode scanning / bridgecrew Ensure RBAC is enabled on AKS clusters Error
Ensure RBAC is enabled on AKS clusters
Comment on lines
+1
to
+25
Check failureCode scanning / bridgecrew Ensure Azure Kubernetes Cluster (AKS) nodes should use a minimum number of 50 pods. Error
Ensure Azure Kubernetes Cluster (AKS) nodes should use a minimum number of 50 pods.
Comment on lines
+1
to
+25
Check failureCode scanning / bridgecrew Ensure that AKS use the Paid Sku for its SLA Error
Ensure that AKS use the Paid Sku for its SLA
Comment on lines
+1
to
+25
Check failureCode scanning / bridgecrew Ensure AKS cluster has Network Policy configured Error
Ensure AKS cluster has Network Policy configured
Comment on lines
+1
to
+25
Check failureCode scanning / bridgecrew Ensure that only critical system pods run on system nodes Error
Ensure that only critical system pods run on system nodes
Comment on lines
+1
to
+25
Check failureCode scanning / bridgecrew Ensure that AKS uses disk encryption set Error
Ensure that AKS uses disk encryption set
Comment on lines
+1
to
+25
Check failureCode scanning / bridgecrew Ensure AKS cluster has Azure CNI networking enabled Error
Ensure AKS cluster has Azure CNI networking enabled
|
||
Check failure
Code scanning / defsec
Ensure AKS cluster has Network Policy configured Error