cis-oke-v180-5-4-1

name	cis-oke-v180-5.4.1
description	Restrict Access to the Control Plane Endpoint (Automated)
category	cis-oke
version	1.8.0
author	cyberstrike-official
tags	["cis","oke","kubernetes","oci","managed-services","cluster-networking","control-plane","api-server","authorized-ip-cidrs"]
cis_id	5.4.1
cis_benchmark	CIS Oracle Cloud Infrastructure Container Engine for Kubernetes (OKE) Benchmark v1.8.0
tech_stack	["kubernetes","oci","oke"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

5.4.1 Restrict Access to the Control Plane Endpoint (Automated)

Profile Applicability

• Level 1

Description

Enable Authorized IP CIDRs endpointConfig.authorizedIpCidrs, used together with isPublicIpEnabled to restrict or disable control-plane access. These settings define which IP CIDRs can reach the Kubernetes API server (control plane endpoint).

Rationale

Restricting access to the Oracle Kubernetes Engine (OKE) cluster control plane through the Authorized IP CIDRs list (endpointConfig.authorizedIpCidrs), in combination with the isPublicIpEnabled setting, is a critical security control that ensures only trusted administrative networks or systems can reach the Kubernetes API server.

By default, enabling a public control plane endpoint without restrictions exposes the cluster's management interface to the internet, increasing the risk of unauthorized access, brute-force attacks, or exploitation of exposed API vulnerabilities. The Authorized IP CIDRs list acts as a network-level allowlist, explicitly defining which external IP address ranges are permitted to communicate with the cluster's API server.

When used together with isPublicIpEnabled=false, this configuration can completely isolate the control plane within the Virtual Cloud Network (VCN), allowing only internal traffic or secure connections via bastion hosts or VPNs. In cases where isPublicIpEnabled=true is required for operational purposes, defining a precise Authorized IP CIDR range ensures that only approved administrators or automation systems can manage the cluster remotely.

Impact

Failure to implement the Authorized IP CIDRs list in conjunction with isPublicIpEnabled exposes the OKE cluster control plane to unauthorized network access. This increases the risk of external attacks, including credential theft, denial-of-service attempts, or exploitation of API vulnerabilities. Conversely, enforcing these settings significantly reduces the cluster's attack surface, ensuring that only trusted networks and administrators can interact with the Kubernetes API, thereby maintaining the integrity and confidentiality of the cluster's management plane.

Audit

Below is a command-line audit procedure to verify that each OKE cluster control plane (master endpoint) is properly restricted using the Authorized IP CIDRs list (endpointConfig.authorizedIpCidrs) and the isPublicIpEnabled setting.

echo -e "NAME\tPUBLIC\tAUTHORIZED_CIDRS" && \
oci ce cluster list --compartment-id  --all --output json \
| jq -r