Ensure that basic authentication is disabled for your ACK clusters in order to enhance cluster security and meet regulatory compliance requirements.
Security Basic authentication allows a user to authenticate to the ACK cluster using a username and password, which is stored in plain text without encryption. The basic authentication credentials are not rotated, and changing the password requires restarting the Kubernetes API server. By disabling basic authentication you can protect your ACK clusters against malicious activities such as brute-force attacks. Instead of employing basic authentication with common credentials (i.e. username and password), you can use client certificates. A client certificate is a public certificate encoded in base64, utilized by clients for authentication at the cluster endpoint. In an ACK cluster, the system automatically generates a client certificate for each logging user.
Audit
To determine if basic authentication is disabled for ACK clusters, perform the following operations:
Getting API server authentication configuration information via Alibaba Cloud CLI (aliyun) is not currently supported.Remediation / Resolution
To disable API server basic authentication for your ACK clusters, perform the following operations:
Disabling basic authentication via Alibaba Cloud CLI (aliyun) is not currently supported.