Kubernetes clusters should be accessible only over HTTPS

What does the recommendation "Kubernetes clusters should be accessible only over HTTPS" check?

Inspects the Ingress objects running inside an AKS cluster and flags any that accept plain HTTP, meaning the Ingress has no 'spec.tls' block to terminate traffic over TLS. The check is enforced by the Azure Policy add-on, which extends Gatekeeper and Open Policy Agent to evaluate the cluster against the built-in definition 'Kubernetes clusters should be accessible only over HTTPS' (mode Microsoft.Kubernetes.Data). It looks only at in-cluster Ingress resources: it does not assess the AKS API server endpoint, LoadBalancer Services that bypass an Ingress, NodePorts, or whether your TLS certificate is valid, current or strong. A cluster with the policy add-on missing is reported as not assessed rather than compliant, and the rule applies equally to AKS and to Azure Arc-enabled Kubernetes, where it is offered in preview. Because it is enforced through an admission webhook, it can audit existing Ingress objects and block non-compliant new ones at creation time.

Why does "Kubernetes clusters should be accessible only over HTTPS" matter?

An Ingress that serves HTTP sends session cookies, bearer tokens and request bodies as clear text across the network, so anyone positioned between the client and the cluster can read or alter them. On a shared or internet-facing load balancer that is a realistic path to credential theft and request tampering, and it undermines the authentication every service behind the Ingress depends on. For a regulated workload, unencrypted transport of personal or payment data is also a direct compliance failure that can stall an audit or trigger reporting obligations. Requiring TLS on every Ingress closes that exposure at the edge of the cluster, where most traffic actually enters, and it forces teams to provision and rotate a real certificate rather than quietly shipping an HTTP listener to production.

How do I fix "Kubernetes clusters should be accessible only over HTTPS"?

1. Enable the Azure Policy add-on so the rule can be enforced: 'az aks enable-addons --addons azure-policy --name <cluster> --resource-group <rg>'.
2. Add a 'spec.tls' block to every Ingress, referencing a Kubernetes secret that holds the certificate and key, and set the redirect annotation appropriate to your ingress controller (for example 'appgw.ingress.kubernetes.io/ssl-redirect: "true"' with the Application Gateway Ingress Controller) so HTTP is redirected to HTTPS.
3. Assign the built-in policy in deny mode across your clusters so non-compliant Ingress objects are rejected at admission: 'pid=$(az policy definition list --query "[?displayName=='Kubernetes clusters should be accessible only over HTTPS'].name" -o tsv)' then 'az policy assignment create --name aks-https-only --policy "$pid" --params '{"effect":{"value":"deny"}}' --scope <scope>'.

# Close the highest-impact plaintext doors first: the Redis non-SSL port,
# then HTTPS-only + a modern TLS floor on every web app.

# Redis: disable the non-SSL port 6379 and require TLS 1.2 (clients use 6380).
for cache in $(az redis list --query "[?enableNonSslPort].name" -o tsv); do
  rg=$(az redis list --query "[?name=='$cache'].resourceGroup" -o tsv)
  az redis update --name "$cache" --resource-group "$rg" \
    --set enableNonSslPort=false minimumTlsVersion=1.2
  echo "$cache: non-SSL port disabled, min TLS 1.2"
done

# Web apps: enforce HTTPS only and raise the TLS floor.
for app in $(az webapp list --query "[?httpsOnly==\`false\`].name" -o tsv); do
  rg=$(az webapp list --query "[?name=='$app'].resourceGroup" -o tsv)
  az webapp update --name "$app" --resource-group "$rg" --https-only true
  az webapp config set --name "$app" --resource-group "$rg" --min-tls-version 1.2
  echo "$app: HTTPS only, min TLS 1.2"
done

# Functions follow the same pattern with az functionapp update --set httpsOnly=true.

# Ratchet it shut: assign the built-in deny policy for web apps over HTTPS only.
az policy assignment create \
  --name require-https-webapp \
  --policy a4af4a39-4135-47fb-b175-47fbdf85311d \
  --scope "/subscriptions/00000000-0000-0000-0000-000000000000"