"Temp disks and cache for agent node pools in Azure Kubernetes Service clusters should be encrypted at host" Does not get applied to additional nodepools
Nobody has claimed this yet.
- Dominant language
- Open Policy Agent
- Stars
- 1.7k
- Forks
- 1.2k
- Avg merge
- 2d 54m
- Merged PRs (30d)
- 3
Description
Policy does not prevent adding new nodepools without enableEncryptionAtHost enable.
i can add additional nodepool don't have have the "enableEncryptionAtHost": true parameter. I could create this nodepool despite the policy is active to the cluster.
Details of the scenario you tried and the problem that is occurring
Steps to reproduce:
- Deploy an AKS. You can deploy with attaching a diskencryptionset but that will be applied only for the first nodepool.
- Activate the policy
- Create a new simple nodepool on the portal or via Azure CLI (that will be created without any issue).
At this point the new nodepool does not have disk encryption. . I expect that at least the policy would prevent the creation so this is a policy bug.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the scenario with an Azure Kubernetes Service cluster and an additional node pool created through the Azure portal or Azure CLI. Inspect the built-in policy definition named in the issue and verify that creating a node pool without host encryption is prevented or that the required encryption setting is enforced.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, kubernetes
- Domain
- cloud, infrastructure, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100