cis-oke-v180-5.4.1

5.4.1 Restrict Access to the Control Plane Endpoint (Automated)

Profile Applicability

• Level 1

Description

Enable Authorized IP CIDRs endpointConfig.authorizedIpCidrs, used together with isPublicIpEnabled to restrict or disable control-plane access. These settings define which IP CIDRs can reach the Kubernetes API server (control plane endpoint).

Rationale

Restricting access to the Oracle Kubernetes Engine (OKE) cluster control plane through the Authorized IP CIDRs list (endpointConfig.authorizedIpCidrs), in combination with the isPublicIpEnabled setting, is a critical security control that ensures only trusted administrative networks or systems can reach the Kubernetes API server.

By default, enabling a public control plane endpoint without restrictions exposes the cluster's management interface to the internet, increasing the risk of unauthorized access, brute-force attacks, or exploitation of exposed API vulnerabilities. The Authorized IP CIDRs list acts as a network-level allowlist, explicitly defining which external IP address ranges are permitted to communicate with the cluster's API server.

When used together with isPublicIpEnabled=false, this configuration can completely isolate the control plane within the Virtual Cloud Network (VCN), allowing only internal traffic or secure connections via bastion hosts or VPNs. In cases where isPublicIpEnabled=true is required for operational purposes, defining a precise Authorized IP CIDR range ensures that only approved administrators or automation systems can manage the cluster remotely.

Impact

Failure to implement the Authorized IP CIDRs list in conjunction with isPublicIpEnabled exposes the OKE cluster control plane to unauthorized network access. This increases the risk of external attacks, including credential theft, denial-of-service attempts, or exploitation of API vulnerabilities. Conversely, enforcing these settings significantly reduces the cluster's attack surface, ensuring that only trusted networks and administrators can interact with the Kubernetes API, thereby maintaining the integrity and confidentiality of the cluster's management plane.

Audit

Below is a command-line audit procedure to verify that each OKE cluster control plane (master endpoint) is properly restricted using the Authorized IP CIDRs list (endpointConfig.authorizedIpCidrs) and the isPublicIpEnabled setting.

echo -e "NAME\tPUBLIC\tAUTHORIZED_CIDRS" && \
oci ce cluster list --compartment-id "${COMPARTMENT_ID}" --all --output json \
| jq -r '
  .data[] |
  . as $c |
  ($c.endpointConfig.isPublicIpEnabled // false) as $pub |
  ($c.endpointConfig.authorizedIpCidrs // []) as $cidrs |
  [$c.name, $pub, ($cidrs | join(","))] | @tsv
'

Or check the following:

export CLUSTER_ID=<oke cluster id>
oci ce cluster get --cluster-id $CLUSTER_ID

Check for endpoint URL of the Kubernetes API Server in output.

Remediation

If the OKE cluster control plane is publicly accessible without an authorized IP allowlist, update the endpoint configuration to either disable public access or restrict it to specific trusted IP ranges. This ensures only approved administrative networks can reach the Kubernetes API server, reducing exposure to unauthorized access.

Restrict to Authorized IPs:

oci ce cluster update-endpoint-config \
  --cluster-id "${CLUSTER_ID}" \
  --is-public-ip-enabled true \
  --authorized-ip-cidrs '["203.0.113.10/32","198.51.100.0/24"]' \
  --force

Or make endpoint private only:

oci ce cluster update-endpoint-config \
  --cluster-id "${CLUSTER_ID}" \
  --is-public-ip-enabled false \
  --force

Default Value

isPublicIpEnabled is defaulted to true and authorizedIpCidrs is defaulted to [] (empty list).

CIS Controls