Catégorie : Kubernetes (Page 15 of 37)

Hi,

In this article, I will show you how you can create an SSH connection to an AKS node, use kubectl debug to run a privileged container on your node. To list your nodes, use kubectl get nodes:

$ kubectl get nodes -o wide

NAME                                STATUS   ROLES   AGE     VERSION   INTERNAL-IP   EXTERNAL-IP   OS-IMAGE                         KERNEL-VERSION     CONTAINER-RUNTIME
aks-nodepool1-12345678-vmss000000   Ready    agent   13m     v1.19.9   10.240.0.4    <none>        Ubuntu 18.04.5 LTS               5.4.0-1046-azure   containerd://1.4.4+azure
aks-nodepool1-12345678-vmss000001   Ready    agent   13m     v1.19.9   10.240.0.35   <none>        Ubuntu 18.04.5 LTS               5.4.0-1046-azure   containerd://1.4.4+azure
aksnpwin000000                      Ready    agent   87s     v1.19.9   10.240.0.67   <none>        Windows Server 2019 Datacenter   10.0.17763.1935    docker://19.3.1

Use kubectl debug to run a container image on the node to connect to it.

kubectl debug node/aks-nodepool1-12345678-vmss000000 -it --image=mcr.microsoft.com/aks/fundamental/base-ubuntu:v0.0.11

This command starts a privileged container on your node and connects to it over SSH.

$ kubectl debug node/aks-nodepool1-12345678-vmss000000 -it --image=mcr.microsoft.com/aks/fundamental/base-ubuntu:v0.0.11
 Creating debugging pod node-debugger-aks-nodepool1-12345678-vmss000000-bkmmx with container debugger on node aks-nodepool1-12345678-vmss000000.
 If you don't see a command prompt, try pressing enter.
 root@aks-nodepool1-12345678-vmss000000:/#

This privileged container gives access to the node.

Maxime.

Hi,

The Federal Information Processing Standard (FIPS) 140-2 is a US government standard that defines minimum security requirements for cryptographic modules in information technology products and systems. AKS allows you to create Linux-based node pools with FIPS 140-2 enabled. Deployments running on FIPS-enabled node pools can use those cryptographic modules to provide increased security and help meet security controls as part of FedRAMP compliance. 

In this article, I will show you how you can add a FIPS Node pool to an existing AKS cluster:

Install the aks-preview extension
az extension add --name aks-preview

Update the extension to make sure you have the latest version installed
az extension update --name aks-preview
az feature register --namespace "Microsoft.ContainerService" --name "FIPSPreview"
az feature list -o table --query "[?contains(name,'Microsoft.ContainerService/FIPSPreview')].{Name:name,State:properties.state}"
az provider register --namespace Microsoft.ContainerService
 
Add FIPS Node Pool to an existing AKS cluster
az aks nodepool add \
     --resource-group myResourceGroup \
     --cluster-name myAKSCluster \
     --name fipsnp \
     --enable-fips-image

az aks show --resource-group myResourceGroup --cluster-name myAKSCluster --query="agentPoolProfiles[].{Name:name enableFips:enableFips}" -o table
 Name       enableFips
 ---------  ------------
 fipsnp     True
 nodepool1  False  

Maxime.

Hi,

When deploying an AKS Cluster, local accounts are enabled by default. Even when enabling RBAC or Azure Active Directory integration, –admin access still exists, essentially as a non-auditable backdoor option. With this in mind, AKS offers users the ability to disable local accounts via a flag, disable-local. A field, properties.disableLocalAccounts, has also been added to the managed cluster API to indicate whether the feature has been enabled on the cluster.

Requirements:

az feature register --namespace "Microsoft.ContainerService" --name "DisableLocalAccountsPreview"

az feature list -o table --query "[?contains(name, 'Microsoft.ContainerService/DisableLocalAccountsPreview')].{Name:name,State:properties.state}"

Disable local account on an existing AKS cluster:

az aks update -g -n --enable-aad --aad-admin-group-object-ids --disable-local

Create a new AKS cluster without any local account:

az aks create -g -n --enable-aad --aad-admin-group-object-ids --disable-local

Maxime.