turbot/azure_compliance

Query: kubernetes_cluster_node_restrict_public_access

Usage

powerpipe query azure_compliance.query.kubernetes_cluster_node_restrict_public_access

SQL

with public_node as (
select
distinct id
from
azure_kubernetes_cluster,
jsonb_array_elements(agent_pool_profiles) as p
where
p ->> 'enableNodePublicIP' = 'true'
group by
id
)
select
c.id as resource,
case
when n.id is null then 'ok'
else 'alarm'
end as status,
case
when n.id is null then c.name || ' has no public node.'
else c.name || ' has public node.'
end as reason
, c.resource_group as resource_group
, sub.display_name as subscription
from
azure_kubernetes_cluster c
left join public_node as n on n.id = c.id,
azure_subscription sub
where
sub.subscription_id = c.subscription_id;

Controls

The query is being used by the following controls: