OCI OKE Hardening

Enhanced Cluster (default for this page): private API endpoint is enabled via endpoint_config.is_public_ip_enabled = false with an NSG attached to the API endpoint subnet. Basic Cluster: a private API endpoint is also supported, but the absence of Enhanced-only controls (Workload Identity, image verification) means the cluster fails the page baseline regardless of this control's status.

Disable the public IP on the Kubernetes API endpoint so the kube-apiserver is reachable only from authorized subnets via Network Security Group rules. Use private DNS for API resolution and bastion-mediated access for human operators. A public OKE control-plane endpoint is the number-one credential-leak blast amplifier — any leaked kubeconfig becomes immediately exploitable from the internet without network-level checks.

Remediation — Terraform

# Terraform OCI provider ~> 6.0
terraform {
  required_providers {
    oci = {
      source  = "oracle/oci"
      version = "~> 6.0"
    }
  }
}

resource "oci_containerengine_cluster" "hardened" {
  compartment_id     = var.compartment_id
  name               = "hardened-cluster"
  kubernetes_version = "v1.30.0"
  vcn_id             = oci_core_vcn.k8s.id
  type               = "ENHANCED_CLUSTER"

  endpoint_config {
    is_public_ip_enabled = false
    subnet_id            = oci_core_subnet.api.id
    nsg_ids              = [oci_core_network_security_group.api.id]
  }
}

Remediation — OCI CLI

oci ce cluster create \
  --compartment-id <COMPARTMENT-OCID> \
  --name hardened-cluster \
  --kubernetes-version v1.30.0 \
  --vcn-id <VCN-OCID> \
  --type ENHANCED_CLUSTER \
  --endpoint-public-ip-enabled false \
  --endpoint-subnet-id <PRIV-SUBNET-OCID> \
  --endpoint-nsg-ids '["<NSG-OCID>"]'

Remediation — OCI Resource Manager

# Submit the Terraform block above to OCI Resource Manager via a configured
# Git source-provider. Variables are entered through the Console UI (schema-driven
# by an optional schema.yaml); state is stored in OCI Object Storage automatically.
# This is an INVOCATION snippet — the .tf body is the existing Terraform block
# on this same control-box (do NOT duplicate HCL here).
oci resource-manager stack create-from-git-provider \
  --compartment-id "$COMPARTMENT_OCID" \
  --config-source-provider-id "$CONFIG_SRC_PROVIDER_OCID" \
  --repository-url "https://example.com/org/hardening-iac" \
  --branch-name "main" \
  --working-directory "modules/oci-k8s-01-private-api-endpoint" \
  --display-name "oci-k8s-01-private-api-endpoint" \
  --terraform-version "1.5.x"

# Plan + apply via the ORM job lifecycle (state stored in OCI automatically).
STACK_OCID=$(oci resource-manager stack list \
  --compartment-id "$COMPARTMENT_OCID" \
  --display-name "oci-k8s-01-private-api-endpoint" \
  --query 'data[0].id' --raw-output)
PLAN_JOB_OCID=$(oci resource-manager job create-plan-job \
  --stack-id "$STACK_OCID" --query 'data.id' --raw-output)
oci resource-manager job create-apply-job \
  --stack-id "$STACK_OCID" \
  --execution-plan-strategy FROM_PLAN_JOB \
  --execution-plan-job-id "$PLAN_JOB_OCID"

Remediation — Pulumi (TypeScript)

import * as pulumi from "@pulumi/pulumi";
import * as oci from "@pulumi/oci";

// OKE cluster with PRIVATE API endpoint (no public Kubernetes API surface).
const cfg = new pulumi.Config();
const compartmentId = cfg.require("compartmentOcid");
const vcnOcid = cfg.require("vcnOcid");
const privateApiSubnetOcid = cfg.require("privateApiSubnetOcid");
const apiNsgOcid = cfg.require("apiNsgOcid");

const cluster = new oci.containerengine.Cluster("hardened-oke", {
  compartmentId: compartmentId,
  vcnId: vcnOcid,
  kubernetesVersion: "v1.30.1",
  name: "hardened-oke",
  type: "ENHANCED_CLUSTER",  // enables more controls (audit, addons)
  endpointConfig: {
    subnetId: privateApiSubnetOcid,
    isPublicIpEnabled: false,        // PRIVATE endpoint
    nsgIds: [apiNsgOcid],            // restrict to bastion/jumpbox NSG
  },
  options: {
    serviceLbSubnetIds: [privateApiSubnetOcid],
    admissionControllerOptions: {
      isPodSecurityPolicyEnabled: false,  // PSP deprecated — Pod Security Standards via OPA-Gatekeeper
    },
  },
});

export const clusterOcid = cluster.id;

Compliance mapping

'Log Source' = 'OCI Audit Logs'
          and 'Service Name' = 'containerengine'
          and eventName in ('CreateCluster', 'UpdateCluster')
          | eval public_api = data.request.payload.endpointConfig.isPublicIpEnabled
          | where public_api = 'true'
          | stats count by 'User Name', data.target.cluster.id, 'Compartment Name'

Equivalent controls in other providers: GKE private cluster + authorized networks, EKS private endpoint, AKS private cluster.

Enhanced Cluster: OKE Workload Identity issues federated principals to pods via a ServiceAccount annotation, so each workload authenticates to OCI services with its own scoped identity. Basic Cluster: Workload Identity is NOT available — pods fall back to the node's instance principal (node-scoped IAM), which violates least-privilege because every pod on a node inherits the same permissions.

Enable OKE Workload Identity so a Kubernetes ServiceAccount authenticates to OCI services using a federated principal rather than sharing the node's instance principal. The cluster identity provider issues a short-lived token bound to the pod's ServiceAccount; OCI IAM policies can then grant permissions to the specific workload identity (cluster <cluster-ocid> + ServiceAccount) instead of to the entire node pool.

Remediation — Kubernetes ServiceAccount

apiVersion: v1
kind: ServiceAccount
metadata:
  name: app-sa
  namespace: production
  annotations:
    oci.oraclecloud.com/workload-identity: "true"

Remediation — OCI IAM policy granting access to the workload identity

oci iam policy create \
  --compartment-id <COMPARTMENT-OCID> \
  --name oke-workload-app-policy \
  --statements '["allow any-user to read objects in compartment APP where all { request.principal.type='\''workload'\'', request.principal.cluster_id='\''<CLUSTER-OCID>'\'', request.principal.namespace='\''production'\'', request.principal.service_account='\''app-sa'\'' }"]' \
  --description "OKE Workload Identity scoped grant for production/app-sa"

Remediation — Terraform (IAM side)

# Terraform OCI provider ~> 6.0
terraform {
  required_providers {
    oci = {
      source  = "oracle/oci"
      version = "~> 6.0"
    }
  }
}

resource "oci_identity_policy" "workload_identity_app" {
  compartment_id = var.compartment_id
  name           = "oke-workload-app-policy"
  description    = "OKE Workload Identity scoped grant"
  statements = [
    "allow any-user to read objects in compartment APP where all { request.principal.type='workload', request.principal.cluster_id='${oci_containerengine_cluster.hardened.id}', request.principal.namespace='production', request.principal.service_account='app-sa' }"
  ]
}

Remediation — OCI Resource Manager

# Submit the Terraform block above to OCI Resource Manager via a configured
# Git source-provider. Variables are entered through the Console UI (schema-driven
# by an optional schema.yaml); state is stored in OCI Object Storage automatically.
# This is an INVOCATION snippet — the .tf body is the existing Terraform block
# on this same control-box (do NOT duplicate HCL here).
oci resource-manager stack create-from-git-provider \
  --compartment-id "$COMPARTMENT_OCID" \
  --config-source-provider-id "$CONFIG_SRC_PROVIDER_OCID" \
  --repository-url "https://example.com/org/hardening-iac" \
  --branch-name "main" \
  --working-directory "modules/oci-k8s-02-workload-identity" \
  --display-name "oci-k8s-02-workload-identity" \
  --terraform-version "1.5.x"

# Plan + apply via the ORM job lifecycle (state stored in OCI automatically).
STACK_OCID=$(oci resource-manager stack list \
  --compartment-id "$COMPARTMENT_OCID" \
  --display-name "oci-k8s-02-workload-identity" \
  --query 'data[0].id' --raw-output)
PLAN_JOB_OCID=$(oci resource-manager job create-plan-job \
  --stack-id "$STACK_OCID" --query 'data.id' --raw-output)
oci resource-manager job create-apply-job \
  --stack-id "$STACK_OCID" \
  --execution-plan-strategy FROM_PLAN_JOB \
  --execution-plan-job-id "$PLAN_JOB_OCID"

Compliance mapping

'Log Source' = 'OCI Audit Logs'
          and 'Service Name' = 'containerengine'
          and eventName = 'UpdateCluster'
          | eval wi_disabled = if(data.request.payload.workloadIdentityConfig.workloadIdentityEnabled = 'false', 'YES', 'NO')
          | where wi_disabled = 'YES'
          | stats count by 'User Name', data.target.cluster.id

Equivalent controls in other providers: GKE Workload Identity Federation, EKS Pod Identity, AKS Workload Identity.

Enhanced Cluster: customer-managed key (CMK) envelope encryption for Kubernetes Secrets stored in OKE-managed etcd via OCI Vault. The cluster references the key OCID at create time through kms_key_id. Basic Cluster: CMK encryption is technically configurable but the full Enhanced-scoped key-rotation and audit integration depends on Enhanced Cluster features; treat as Enhanced-only for this guide.

Enable customer-managed key encryption for Kubernetes Secrets in OKE-managed etcd. Create a Vault and a Master Encryption Key (HSM or software protection mode); reference the key OCID on the cluster. Restrict access to the key with a vault-id-bound IAM condition so only the OKE cluster identity and break-glass administrators can use it.

Remediation — Terraform

# Terraform OCI provider ~> 6.0
terraform {
  required_providers {
    oci = {
      source  = "oracle/oci"
      version = "~> 6.0"
    }
  }
}

resource "oci_kms_vault" "oke" {
  compartment_id = var.compartment_id
  display_name   = "oke-secrets-vault"
  vault_type     = "DEFAULT"
}

resource "oci_kms_key" "oke_secrets" {
  compartment_id      = var.compartment_id
  display_name        = "oke-secrets-cmk"
  management_endpoint = oci_kms_vault.oke.management_endpoint
  key_shape {
    algorithm = "AES"
    length    = 32
  }
  protection_mode = "HSM"
}

resource "oci_containerengine_cluster" "hardened" {
  compartment_id     = var.compartment_id
  name               = "hardened-cluster"
  kubernetes_version = "v1.30.0"
  vcn_id             = oci_core_vcn.k8s.id
  type               = "ENHANCED_CLUSTER"
  kms_key_id         = oci_kms_key.oke_secrets.id
}

Remediation — OCI CLI

oci ce cluster create \
  --compartment-id <COMPARTMENT-OCID> \
  --name hardened-cluster \
  --kubernetes-version v1.30.0 \
  --vcn-id <VCN-OCID> \
  --type ENHANCED_CLUSTER \
  --kms-key-id <VAULT-KEY-OCID>

Remediation — OCI Resource Manager

# Submit the Terraform block above to OCI Resource Manager via a configured
# Git source-provider. Variables are entered through the Console UI (schema-driven
# by an optional schema.yaml); state is stored in OCI Object Storage automatically.
# This is an INVOCATION snippet — the .tf body is the existing Terraform block
# on this same control-box (do NOT duplicate HCL here).
oci resource-manager stack create-from-git-provider \
  --compartment-id "$COMPARTMENT_OCID" \
  --config-source-provider-id "$CONFIG_SRC_PROVIDER_OCID" \
  --repository-url "https://example.com/org/hardening-iac" \
  --branch-name "main" \
  --working-directory "modules/oci-k8s-03-vault-secrets-encryption" \
  --display-name "oci-k8s-03-vault-secrets-encryption" \
  --terraform-version "1.5.x"

# Plan + apply via the ORM job lifecycle (state stored in OCI automatically).
STACK_OCID=$(oci resource-manager stack list \
  --compartment-id "$COMPARTMENT_OCID" \
  --display-name "oci-k8s-03-vault-secrets-encryption" \
  --query 'data[0].id' --raw-output)
PLAN_JOB_OCID=$(oci resource-manager job create-plan-job \
  --stack-id "$STACK_OCID" --query 'data.id' --raw-output)
oci resource-manager job create-apply-job \
  --stack-id "$STACK_OCID" \
  --execution-plan-strategy FROM_PLAN_JOB \
  --execution-plan-job-id "$PLAN_JOB_OCID"

Compliance mapping

'Log Source' = 'OCI Audit Logs'
          and 'Service Name' = 'containerengine'
          and eventName in ('CreateCluster', 'UpdateCluster')
          | eval key = data.request.payload.kmsKeyId
          | where key is null
          | stats count by 'User Name', data.target.cluster.id, 'Compartment Name'

Equivalent controls in other providers: GKE application-layer secrets encryption, EKS KMS envelope encryption, AKS KMS etcd encryption.

Enhanced Cluster (REQUIRED for this guide): create with type = "ENHANCED_CLUSTER". Enhanced unlocks Workload Identity (oci-k8s-02), image verification policy (oci-k8s-05), full NSG attachment surface (oci-k8s-06), and OKE-managed add-on lifecycle (CoreDNS, kube-proxy, OCI VCN-Native Pod Networking). Basic Cluster: silently lacks the controls above. Migration from Basic to Enhanced is supported via in-place upgrade.

This is the explicit Enhanced Cluster gate control for the page. Deploy OKE with type = "ENHANCED_CLUSTER" to access the full security capability surface. Enhanced also enables OKE-managed add-on lifecycle — CoreDNS, kube-proxy, and OCI VCN-Native Pod Networking can be installed and version-managed via the oci_containerengine_addon resource, addressing the add-on lifecycle requirement (REQ OKE-10). Node OS hardening is a related concern handled in oci-k8s-09; reference that control for Oracle Linux 8 minimal images and private node pool placement.

Remediation — Terraform

# Terraform OCI provider ~> 6.0
terraform {
  required_providers {
    oci = {
      source  = "oracle/oci"
      version = "~> 6.0"
    }
  }
}

resource "oci_containerengine_cluster" "hardened" {
  compartment_id     = var.compartment_id
  name               = "hardened-cluster"
  kubernetes_version = "v1.30.0"
  vcn_id             = oci_core_vcn.k8s.id
  type               = "ENHANCED_CLUSTER"   # Enhanced gate
  cluster_pod_network_options {
    cni_type = "OCI_VCN_IP_NATIVE"
  }
}

# Managed add-on lifecycle (Enhanced-only)
resource "oci_containerengine_addon" "coredns" {
  cluster_id                       = oci_containerengine_cluster.hardened.id
  addon_name                       = "CoreDNS"
  remove_addon_resources_on_delete = false
}

resource "oci_containerengine_addon" "kube_proxy" {
  cluster_id                       = oci_containerengine_cluster.hardened.id
  addon_name                       = "KubeProxy"
  remove_addon_resources_on_delete = false
}

Remediation — OCI CLI

oci ce cluster create \
  --compartment-id <COMPARTMENT-OCID> \
  --name hardened-cluster \
  --kubernetes-version v1.30.0 \
  --vcn-id <VCN-OCID> \
  --type ENHANCED_CLUSTER

oci ce cluster install-addon \
  --cluster-id <CLUSTER-OCID> \
  --addon-name CoreDNS

oci ce cluster install-addon \
  --cluster-id <CLUSTER-OCID> \
  --addon-name KubeProxy

Remediation — OCI Resource Manager

# Submit the Terraform block above to OCI Resource Manager via a configured
# Git source-provider. Variables are entered through the Console UI (schema-driven
# by an optional schema.yaml); state is stored in OCI Object Storage automatically.
# This is an INVOCATION snippet — the .tf body is the existing Terraform block
# on this same control-box (do NOT duplicate HCL here).
oci resource-manager stack create-from-git-provider \
  --compartment-id "$COMPARTMENT_OCID" \
  --config-source-provider-id "$CONFIG_SRC_PROVIDER_OCID" \
  --repository-url "https://example.com/org/hardening-iac" \
  --branch-name "main" \
  --working-directory "modules/oci-k8s-04-enhanced-cluster" \
  --display-name "oci-k8s-04-enhanced-cluster" \
  --terraform-version "1.5.x"

# Plan + apply via the ORM job lifecycle (state stored in OCI automatically).
STACK_OCID=$(oci resource-manager stack list \
  --compartment-id "$COMPARTMENT_OCID" \
  --display-name "oci-k8s-04-enhanced-cluster" \
  --query 'data[0].id' --raw-output)
PLAN_JOB_OCID=$(oci resource-manager job create-plan-job \
  --stack-id "$STACK_OCID" --query 'data.id' --raw-output)
oci resource-manager job create-apply-job \
  --stack-id "$STACK_OCID" \
  --execution-plan-strategy FROM_PLAN_JOB \
  --execution-plan-job-id "$PLAN_JOB_OCID"

Remediation — Pulumi (TypeScript)

import * as pulumi from "@pulumi/pulumi";
import * as oci from "@pulumi/oci";

// ENHANCED_CLUSTER type — required for cluster add-ons (Calico, Kyverno, Audit-to-Logging).
const cfg = new pulumi.Config();
const compartmentId = cfg.require("compartmentOcid");
const vcnOcid = cfg.require("vcnOcid");
const apiSubnetOcid = cfg.require("apiSubnetOcid");

const enhancedCluster = new oci.containerengine.Cluster("oke-enhanced", {
  compartmentId: compartmentId,
  vcnId: vcnOcid,
  kubernetesVersion: "v1.30.1",
  name: "oke-enhanced",
  type: "ENHANCED_CLUSTER",   // BASIC_CLUSTER lacks add-on framework + per-cluster SLA
  endpointConfig: {
    subnetId: apiSubnetOcid,
    isPublicIpEnabled: false,
  },
  clusterPodNetworkOptions: [{
    cniType: "OCI_VCN_IP_NATIVE",  // native VCN CNI — required for NSG-per-pod
  }],
});

// Pin add-ons explicitly so version drift is impossible.
const calicoAddon = new oci.containerengine.Addon("calico", {
  clusterId: enhancedCluster.id,
  addonName: "Calico",
  removeAddonResourcesOnDelete: false,
  configurations: [{ key: "numOfReplicas", value: "1" }],
});

export const clusterOcid = enhancedCluster.id;

Compliance mapping

'Log Source' = 'OCI Audit Logs'
          and 'Service Name' = 'containerengine'
          and eventName = 'UpdateCluster'
          | eval tier = data.request.payload.type
          | where tier = 'BASIC'
          | stats count by 'User Name', data.target.cluster.id, 'Compartment Name'

Enhanced Cluster: configure image_policy_config with up to 5 KMS keys for signed-image enforcement at pod scheduling time. Pods whose images are not signed by a referenced key are rejected by admission. Basic Cluster: image verification policy is NOT available — any image the node can pull will run.

Enable sign-required image admission: pods are blocked from scheduling unless their container image is signed by an attested KMS key. Up to 5 KMS keys can be referenced per cluster, supporting trust hierarchies (per-team build pipelines plus a central security override key). Combine with OCIR repository policies that require signatures on push to close the supply-chain loop.

Remediation — Terraform

# Terraform OCI provider ~> 6.0
terraform {
  required_providers {
    oci = {
      source  = "oracle/oci"
      version = "~> 6.0"
    }
  }
}

resource "oci_kms_key" "image_signing" {
  compartment_id      = var.compartment_id
  display_name        = "oke-image-signing-key"
  management_endpoint = oci_kms_vault.oke.management_endpoint
  key_shape {
    algorithm = "RSA"
    length    = 512  # 4096-bit RSA
  }
  protection_mode = "HSM"
}

resource "oci_containerengine_cluster" "hardened" {
  compartment_id     = var.compartment_id
  name               = "hardened-cluster"
  kubernetes_version = "v1.30.0"
  vcn_id             = oci_core_vcn.k8s.id
  type               = "ENHANCED_CLUSTER"

  image_policy_config {
    is_policy_enabled = true
    key_details {
      kms_key_id = oci_kms_key.image_signing.id
    }
  }
}

Remediation — OCI CLI

oci ce cluster update \
  --cluster-id <CLUSTER-OCID> \
  --image-policy-config 'isPolicyEnabled=true,keyDetails=[{kmsKeyId=<KMS-KEY-OCID>}]'

Remediation — OCI Resource Manager

# Submit the Terraform block above to OCI Resource Manager via a configured
# Git source-provider. Variables are entered through the Console UI (schema-driven
# by an optional schema.yaml); state is stored in OCI Object Storage automatically.
# This is an INVOCATION snippet — the .tf body is the existing Terraform block
# on this same control-box (do NOT duplicate HCL here).
oci resource-manager stack create-from-git-provider \
  --compartment-id "$COMPARTMENT_OCID" \
  --config-source-provider-id "$CONFIG_SRC_PROVIDER_OCID" \
  --repository-url "https://example.com/org/hardening-iac" \
  --branch-name "main" \
  --working-directory "modules/oci-k8s-05-image-verification-policy" \
  --display-name "oci-k8s-05-image-verification-policy" \
  --terraform-version "1.5.x"

# Plan + apply via the ORM job lifecycle (state stored in OCI automatically).
STACK_OCID=$(oci resource-manager stack list \
  --compartment-id "$COMPARTMENT_OCID" \
  --display-name "oci-k8s-05-image-verification-policy" \
  --query 'data[0].id' --raw-output)
PLAN_JOB_OCID=$(oci resource-manager job create-plan-job \
  --stack-id "$STACK_OCID" --query 'data.id' --raw-output)
oci resource-manager job create-apply-job \
  --stack-id "$STACK_OCID" \
  --execution-plan-strategy FROM_PLAN_JOB \
  --execution-plan-job-id "$PLAN_JOB_OCID"

Compliance mapping

'Log Source' = 'OCI Audit Logs'
          and 'Service Name' = 'containerengine'
          and eventName in ('UpdateImagePolicyConfig', 'CreateImagePolicyConfig')
          | eval enabled = data.request.payload.imagePolicyConfig.isPolicyEnabled
          | where enabled = 'false'
          | stats count by 'User Name', data.target.cluster.id, 'Compartment Name'

Equivalent controls in other providers: GKE Binary Authorization (closest parallel).

Enhanced Cluster: attach NSGs at three layers — API endpoint subnet, node pool subnet, and pod subnet (when using OCI VCN-Native Pod Networking) — for granular east-west and egress control. Basic Cluster: NSG attachment at the pod-subnet layer is more limited; defense-in-depth is reduced.

Apply Network Security Groups at multiple layers — API endpoint subnet, node pool subnet, and pod subnet (VCN-Native Pod Networking) — for defense-in-depth network segmentation. Default-deny outbound to the public internet; allow only required egress, such as OCI service endpoints via a Service Gateway and the OKE management plane endpoints. NSGs complement (do not replace) Kubernetes NetworkPolicy (oci-k8s-09) — NSGs operate at the VCN layer; NetworkPolicy operates inside the cluster.

Remediation — Terraform

# Terraform OCI provider ~> 6.0
terraform {
  required_providers {
    oci = {
      source  = "oracle/oci"
      version = "~> 6.0"
    }
  }
}

resource "oci_core_network_security_group" "api" {
  compartment_id = var.compartment_id
  vcn_id         = oci_core_vcn.k8s.id
  display_name   = "oke-api-endpoint-nsg"
}

resource "oci_core_network_security_group_security_rule" "api_ingress_mgmt" {
  network_security_group_id = oci_core_network_security_group.api.id
  direction                 = "INGRESS"
  protocol                  = "6"   # TCP
  source                    = var.management_cidr
  source_type               = "CIDR_BLOCK"
  tcp_options {
    destination_port_range {
      min = 6443
      max = 6443
    }
  }
}

resource "oci_core_network_security_group" "nodes" {
  compartment_id = var.compartment_id
  vcn_id         = oci_core_vcn.k8s.id
  display_name   = "oke-node-pool-nsg"
}

resource "oci_containerengine_node_pool" "app" {
  cluster_id     = oci_containerengine_cluster.hardened.id
  compartment_id = var.compartment_id
  name           = "app-nodes"
  node_shape     = "VM.Standard.E4.Flex"
  node_config_details {
    placement_configs {
      availability_domain = var.ad_1
      subnet_id           = oci_core_subnet.nodes.id
    }
    nsg_ids = [oci_core_network_security_group.nodes.id]
    size    = 3
  }
}

Remediation — OCI CLI

oci network nsg create \
  --compartment-id <COMPARTMENT-OCID> \
  --vcn-id <VCN-OCID> \
  --display-name oke-node-pool-nsg

oci ce node-pool update \
  --node-pool-id <NODE-POOL-OCID> \
  --nsg-ids '["<NSG-OCID>"]'

Remediation — OCI Resource Manager

# Submit the Terraform block above to OCI Resource Manager via a configured
# Git source-provider. Variables are entered through the Console UI (schema-driven
# by an optional schema.yaml); state is stored in OCI Object Storage automatically.
# This is an INVOCATION snippet — the .tf body is the existing Terraform block
# on this same control-box (do NOT duplicate HCL here).
oci resource-manager stack create-from-git-provider \
  --compartment-id "$COMPARTMENT_OCID" \
  --config-source-provider-id "$CONFIG_SRC_PROVIDER_OCID" \
  --repository-url "https://example.com/org/hardening-iac" \
  --branch-name "main" \
  --working-directory "modules/oci-k8s-06-network-security-groups" \
  --display-name "oci-k8s-06-network-security-groups" \
  --terraform-version "1.5.x"

# Plan + apply via the ORM job lifecycle (state stored in OCI automatically).
STACK_OCID=$(oci resource-manager stack list \
  --compartment-id "$COMPARTMENT_OCID" \
  --display-name "oci-k8s-06-network-security-groups" \
  --query 'data[0].id' --raw-output)
PLAN_JOB_OCID=$(oci resource-manager job create-plan-job \
  --stack-id "$STACK_OCID" --query 'data.id' --raw-output)
oci resource-manager job create-apply-job \
  --stack-id "$STACK_OCID" \
  --execution-plan-strategy FROM_PLAN_JOB \
  --execution-plan-job-id "$PLAN_JOB_OCID"

Compliance mapping

'Log Source' = 'OCI Audit Logs'
          and 'Service Name' = 'core'
          and eventName = 'UpdateNetworkSecurityGroupSecurityRules'
          | eval rules = data.request.payload.securityRules
          | where rules like '%0.0.0.0/0%'
          | stats count by 'User Name', data.target.networkSecurityGroup.id, 'Compartment Name'

Equivalent controls in other providers: GKE Dataplane V2 NetworkPolicy, EKS VPC security groups, AKS network policy.

Enhanced Cluster / Basic Cluster: OCI Audit captures containerengine API operations by default. Kubernetes API audit log forwarding to OCI Logging is a separate stream — it requires a Log Group plus a Log object pointing at the cluster resource. It is NOT on by default.

OCI Audit captures all OCI-side operations on the cluster resource (create, update, scale node pool, update endpoint, install add-on). Kubernetes API audit logs are a separate stream — forward them to OCI Logging via a Log object on the cluster so in-cluster kubectl, controller, and webhook activity is durable and queryable. Configure log retention to match the organization's incident-investigation horizon.

Remediation — Terraform

# Terraform OCI provider ~> 6.0
terraform {
  required_providers {
    oci = {
      source  = "oracle/oci"
      version = "~> 6.0"
    }
  }
}

resource "oci_logging_log_group" "oke" {
  compartment_id = var.compartment_id
  display_name   = "oke-logs"
}

resource "oci_logging_log" "k8s_audit" {
  display_name = "k8s-audit"
  log_group_id = oci_logging_log_group.oke.id
  log_type     = "SERVICE"
  configuration {
    source {
      category    = "kubernetes-api-server-audit"
      resource    = oci_containerengine_cluster.hardened.id
      service     = "containerengine"
      source_type = "OCISERVICE"
    }
    compartment_id = var.compartment_id
  }
  is_enabled         = true
  retention_duration = 90
}

Remediation — OCI CLI

oci logging log-group create \
  --compartment-id <COMPARTMENT-OCID> \
  --display-name oke-logs

oci logging log create \
  --log-group-id <LOG-GROUP-OCID> \
  --display-name k8s-audit \
  --log-type SERVICE \
  --configuration '{"source":{"category":"kubernetes-api-server-audit","resource":"<CLUSTER-OCID>","service":"containerengine","sourceType":"OCISERVICE"},"compartmentId":"<COMPARTMENT-OCID>"}' \
  --is-enabled true \
  --retention-duration 90

Remediation — OCI Resource Manager

# Submit the Terraform block above to OCI Resource Manager via a configured
# Git source-provider. Variables are entered through the Console UI (schema-driven
# by an optional schema.yaml); state is stored in OCI Object Storage automatically.
# This is an INVOCATION snippet — the .tf body is the existing Terraform block
# on this same control-box (do NOT duplicate HCL here).
oci resource-manager stack create-from-git-provider \
  --compartment-id "$COMPARTMENT_OCID" \
  --config-source-provider-id "$CONFIG_SRC_PROVIDER_OCID" \
  --repository-url "https://example.com/org/hardening-iac" \
  --branch-name "main" \
  --working-directory "modules/oci-k8s-07-oci-audit-logging" \
  --display-name "oci-k8s-07-oci-audit-logging" \
  --terraform-version "1.5.x"

# Plan + apply via the ORM job lifecycle (state stored in OCI automatically).
STACK_OCID=$(oci resource-manager stack list \
  --compartment-id "$COMPARTMENT_OCID" \
  --display-name "oci-k8s-07-oci-audit-logging" \
  --query 'data[0].id' --raw-output)
PLAN_JOB_OCID=$(oci resource-manager job create-plan-job \
  --stack-id "$STACK_OCID" --query 'data.id' --raw-output)
oci resource-manager job create-apply-job \
  --stack-id "$STACK_OCID" \
  --execution-plan-strategy FROM_PLAN_JOB \
  --execution-plan-job-id "$PLAN_JOB_OCID"

Compliance mapping

'Log Source' = 'OCI Audit Logs'
          and 'Service Name' = 'logging'
          and eventName in ('DeleteLog', 'UpdateLog', 'DeleteLogGroup')
          | eval is_oke_log = if(data.target.log.displayName like '%kube-apiserver%' or data.target.log.displayName like '%oke-audit%', 'YES', 'NO')
          | where is_oke_log = 'YES'
          | stats count by 'User Name', data.target.log.displayName, eventName

Equivalent controls in other providers: GKE Cloud Audit Logs, EKS control-plane logs, AKS diagnostic settings (control-plane audit logs).

Enhanced Cluster / Basic Cluster: the built-in PodSecurity admission controller (K8s 1.23+) enforces Pod Security Standards profiles via namespace labels. No add-on is required — the controller is built into kube-apiserver and is active on all current OKE Kubernetes versions.

Use the built-in PodSecurity admission controller to enforce the Restricted or Baseline Pod Security Standards (PSS) profile at the namespace level. Target Restricted for application namespaces; reserve Baseline for namespaces that legitimately need broader pod capabilities (e.g. CNI components, log forwarders) — and document the exemption. PSS replaces the removed legacy admission mechanism; do not look for a separate cluster-level policy object.

Remediation — kubectl

kubectl label namespace production \
  pod-security.kubernetes.io/enforce=restricted \
  pod-security.kubernetes.io/enforce-version=latest

kubectl label namespace production \
  pod-security.kubernetes.io/audit=restricted \
  pod-security.kubernetes.io/warn=restricted

Remediation — Terraform

# Terraform OCI provider ~> 6.0
terraform {
  required_providers {
    oci = {
      source  = "oracle/oci"
      version = "~> 6.0"
    }
    kubernetes = {
      source  = "hashicorp/kubernetes"
      version = "~> 2.30"
    }
  }
}

resource "kubernetes_namespace" "production" {
  metadata {
    name = "production"
    labels = {
      "pod-security.kubernetes.io/enforce"         = "restricted"
      "pod-security.kubernetes.io/enforce-version" = "latest"
      "pod-security.kubernetes.io/audit"           = "restricted"
      "pod-security.kubernetes.io/warn"            = "restricted"
    }
  }
}

Remediation — OCI Resource Manager

# Submit the Terraform block above to OCI Resource Manager via a configured
# Git source-provider. Variables are entered through the Console UI (schema-driven
# by an optional schema.yaml); state is stored in OCI Object Storage automatically.
# This is an INVOCATION snippet — the .tf body is the existing Terraform block
# on this same control-box (do NOT duplicate HCL here).
oci resource-manager stack create-from-git-provider \
  --compartment-id "$COMPARTMENT_OCID" \
  --config-source-provider-id "$CONFIG_SRC_PROVIDER_OCID" \
  --repository-url "https://example.com/org/hardening-iac" \
  --branch-name "main" \
  --working-directory "modules/oci-k8s-08-pod-security-standards" \
  --display-name "oci-k8s-08-pod-security-standards" \
  --terraform-version "1.5.x"

# Plan + apply via the ORM job lifecycle (state stored in OCI automatically).
STACK_OCID=$(oci resource-manager stack list \
  --compartment-id "$COMPARTMENT_OCID" \
  --display-name "oci-k8s-08-pod-security-standards" \
  --query 'data[0].id' --raw-output)
PLAN_JOB_OCID=$(oci resource-manager job create-plan-job \
  --stack-id "$STACK_OCID" --query 'data.id' --raw-output)
oci resource-manager job create-apply-job \
  --stack-id "$STACK_OCID" \
  --execution-plan-strategy FROM_PLAN_JOB \
  --execution-plan-job-id "$PLAN_JOB_OCID"

Compliance mapping

'Log Source' = 'OCI Audit Logs'
          and data.kubernetesAudit.verb = 'update'
          and data.kubernetesAudit.objectRef.resource = 'namespaces'
          | eval enforce = data.kubernetesAudit.requestObject.metadata.labels."pod-security.kubernetes.io/enforce"
          | where enforce in ('privileged', '')
          | stats count by 'User Name', data.kubernetesAudit.objectRef.name, enforce

Equivalent controls in other providers: GKE PSS, EKS PSS, AKS Azure Policy add-on.

Enhanced Cluster / Basic Cluster: install Calico CNI for NetworkPolicy enforcement on OKE. OCI VCN-Native Pod Networking plus Calico for policy is the typical pairing. Node OS hardening: Oracle Linux 8 minimal is the default OKE node image; private node pools must have no public IPs on node VNICs.

Apply a default-deny NetworkPolicy in every namespace, then add explicit allow rules for required east-west and egress paths. Calico is the NetworkPolicy enforcer on OKE — install via the documented manifest or Helm chart after cluster create. This control also covers REQ OKE-09 node-hardening requirements: select Oracle Linux 8 minimal as the node image; place node pools in private subnets with no public IPs on node VNICs.

Remediation — default-deny NetworkPolicy

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
  namespace: production
spec:
  podSelector: {}
  policyTypes:
    - Ingress
    - Egress

Remediation — Terraform (private node pool, Oracle Linux 8 minimal)

# Terraform OCI provider ~> 6.0
terraform {
  required_providers {
    oci = {
      source  = "oracle/oci"
      version = "~> 6.0"
    }
  }
}

data "oci_core_images" "ol8_minimal" {
  compartment_id           = var.compartment_id
  operating_system         = "Oracle Linux"
  operating_system_version = "8"
  shape                    = "VM.Standard.E4.Flex"
  sort_by                  = "TIMECREATED"
  sort_order               = "DESC"
}

resource "oci_containerengine_node_pool" "app" {
  cluster_id         = oci_containerengine_cluster.hardened.id
  compartment_id     = var.compartment_id
  name               = "app-nodes"
  kubernetes_version = "v1.30.0"
  node_shape         = "VM.Standard.E4.Flex"

  node_source_details {
    source_type = "IMAGE"
    image_id    = data.oci_core_images.ol8_minimal.images[0].id
  }

  node_config_details {
    placement_configs {
      availability_domain = var.ad_1
      subnet_id           = oci_core_subnet.nodes_private.id
    }
    nsg_ids                             = [oci_core_network_security_group.nodes.id]
    is_pv_encryption_in_transit_enabled = true
    size                                = 3
  }
}

Remediation — OCI Resource Manager

# Submit the Terraform block above to OCI Resource Manager via a configured
# Git source-provider. Variables are entered through the Console UI (schema-driven
# by an optional schema.yaml); state is stored in OCI Object Storage automatically.
# This is an INVOCATION snippet — the .tf body is the existing Terraform block
# on this same control-box (do NOT duplicate HCL here).
oci resource-manager stack create-from-git-provider \
  --compartment-id "$COMPARTMENT_OCID" \
  --config-source-provider-id "$CONFIG_SRC_PROVIDER_OCID" \
  --repository-url "https://example.com/org/hardening-iac" \
  --branch-name "main" \
  --working-directory "modules/oci-k8s-09-network-policy-calico" \
  --display-name "oci-k8s-09-network-policy-calico" \
  --terraform-version "1.5.x"

# Plan + apply via the ORM job lifecycle (state stored in OCI automatically).
STACK_OCID=$(oci resource-manager stack list \
  --compartment-id "$COMPARTMENT_OCID" \
  --display-name "oci-k8s-09-network-policy-calico" \
  --query 'data[0].id' --raw-output)
PLAN_JOB_OCID=$(oci resource-manager job create-plan-job \
  --stack-id "$STACK_OCID" --query 'data.id' --raw-output)
oci resource-manager job create-apply-job \
  --stack-id "$STACK_OCID" \
  --execution-plan-strategy FROM_PLAN_JOB \
  --execution-plan-job-id "$PLAN_JOB_OCID"

Compliance mapping

'Log Source' = 'OCI Audit Logs'
          and 'Service Name' = 'containerengine'
          and eventName in ('UpdateClusterAddon', 'DisableAddon')
          | eval addon = data.request.payload.addonName
          | where addon like '%Calico%' or addon = 'NetworkPolicy'
          | stats count by 'User Name', data.target.cluster.id, addon, eventName

Equivalent controls in other providers: GKE Dataplane V2 NetworkPolicy, EKS default-deny NetworkPolicy, AKS network policy.

Enhanced Cluster / Basic Cluster: scope OCI IAM dynamic groups to compartments using least-privilege allow dynamic-group ... to manage ... in compartment ... rules. Avoid manage all-resources in tenancy for any cluster identity.

Use OCI IAM dynamic groups to grant the cluster control plane and node pool exactly the permissions required — never tenancy-wide. Scope each statement to a specific compartment (APP for application resources; NET for networking; SHARED for shared KMS keys with a vault-id-bound condition). Where a grant must reach beyond a single compartment, prefer a where condition that restricts the target by OCID rather than a broader compartment scope.

NEVER: allow dynamic-group ... to manage all-resources in tenancy — this collapses the entire compartment hierarchy into a single trust boundary.

Remediation — Terraform

# Terraform OCI provider ~> 6.0
terraform {
  required_providers {
    oci = {
      source  = "oracle/oci"
      version = "~> 6.0"
    }
  }
}

resource "oci_identity_dynamic_group" "oke_cluster" {
  compartment_id = var.tenancy_ocid
  name           = "oke-cluster-dyn-group"
  description    = "OKE cluster + node-pool identities"
  matching_rule  = "ANY {ALL {instance.compartment.id = '${var.compartment_id}', tag.oke.cluster.value = '${oci_containerengine_cluster.hardened.id}'}}"
}

resource "oci_identity_policy" "oke_cluster" {
  compartment_id = var.tenancy_ocid
  name           = "oke-cluster-policy"
  description    = "Least-privilege OKE cluster + node-pool grants"
  statements = [
    "allow dynamic-group oke-cluster-dyn-group to use cluster-family in compartment APP",
    "allow dynamic-group oke-cluster-dyn-group to manage instances in compartment APP",
    "allow dynamic-group oke-cluster-dyn-group to use vaults in compartment SHARED where target.vault.id = '${oci_kms_vault.oke.id}'",
  ]
}

Remediation — OCI CLI

oci iam dynamic-group create \
  --compartment-id <TENANCY-OCID> \
  --name oke-cluster-dyn-group \
  --description "OKE cluster + node-pool identities" \
  --matching-rule "ANY {ALL {instance.compartment.id = '<COMPARTMENT-OCID>', tag.oke.cluster.value = '<CLUSTER-OCID>'}}"

oci iam policy create \
  --compartment-id <TENANCY-OCID> \
  --name oke-cluster-policy \
  --description "Least-privilege OKE grants" \
  --statements '["allow dynamic-group oke-cluster-dyn-group to use cluster-family in compartment APP", "allow dynamic-group oke-cluster-dyn-group to manage instances in compartment APP", "allow dynamic-group oke-cluster-dyn-group to use vaults in compartment SHARED where target.vault.id = '\''<VAULT-OCID>'\''"]'

Remediation — OCI Resource Manager

# Submit the Terraform block above to OCI Resource Manager via a configured
# Git source-provider. Variables are entered through the Console UI (schema-driven
# by an optional schema.yaml); state is stored in OCI Object Storage automatically.
# This is an INVOCATION snippet — the .tf body is the existing Terraform block
# on this same control-box (do NOT duplicate HCL here).
oci resource-manager stack create-from-git-provider \
  --compartment-id "$COMPARTMENT_OCID" \
  --config-source-provider-id "$CONFIG_SRC_PROVIDER_OCID" \
  --repository-url "https://example.com/org/hardening-iac" \
  --branch-name "main" \
  --working-directory "modules/oci-k8s-10-iam-least-privilege-cluster-access" \
  --display-name "oci-k8s-10-iam-least-privilege-cluster-access" \
  --terraform-version "1.5.x"

# Plan + apply via the ORM job lifecycle (state stored in OCI automatically).
STACK_OCID=$(oci resource-manager stack list \
  --compartment-id "$COMPARTMENT_OCID" \
  --display-name "oci-k8s-10-iam-least-privilege-cluster-access" \
  --query 'data[0].id' --raw-output)
PLAN_JOB_OCID=$(oci resource-manager job create-plan-job \
  --stack-id "$STACK_OCID" --query 'data.id' --raw-output)
oci resource-manager job create-apply-job \
  --stack-id "$STACK_OCID" \
  --execution-plan-strategy FROM_PLAN_JOB \
  --execution-plan-job-id "$PLAN_JOB_OCID"

Compliance mapping

'Log Source' = 'OCI Audit Logs'
          and 'Service Name' = 'identity'
          and eventName in ('CreatePolicy', 'UpdatePolicy')
          | eval stmt = data.request.payload.statements
          | where stmt like '%manage cluster-family%' or stmt like '%use cluster-content-read%'
          | stats count by 'User Name', data.target.policy.name, 'Compartment Name'

Equivalent controls in other providers: GKE IAM identity layer (Workload Identity Federation), EKS access entries / node IAM, AKS Entra ID + Kubernetes RBAC.