Ensure Clusters Are Created With Private Endpoint Enabled And Public Access Disabled

#!/usr/bin/env bash
#
# Report OKE cluster endpoint exposure across compartments and regions.
# Requirements:
#   - OCI CLI installed and configured (https://docs.oracle.com/en-us/iaas/Content/API/SDKDocs/cliinstall.htm)
#   - jq installed
#
# Run location:
#   - Any machine with OCI CLI access and permissions to list compartments and clusters.

set -euo pipefail

# ----- CONFIGURATION -----
# Optional: limit to specific regions or compartments by editing these arrays.
REGIONS=()         # e.g. REGIONS=("eu-frankfurt-1" "us-ashburn-1")
COMPARTMENT_OCIDS=() # e.g. COMPARTMENT_OCIDS=("ocid1.compartment.oc1..xxxx")

# ----- HELPER FUNCTIONS -----
oci_json() {
  oci "$@" --output json
}

get_all_regions() {
  if ((${#REGIONS[@]} > 0)); then
    printf '%s\n' "${REGIONS[@]}"
  else
    oci_json iam region list | jq -r '.data[].name'
  fi
}

get_all_compartments() {
  # Returns all active compartments in the tenancy (excluding root),
  # unless COMPARTMENT_OCIDS is explicitly set.
  if ((${#COMPARTMENT_OCIDS[@]} > 0)); then
    printf '%s\n' "${COMPARTMENT_OCIDS[@]}"
  else
    local tenancy_ocid
    tenancy_ocid="$(oci_json iam compartment list --compartment-id-in-subtree false --all | jq -r '.data[] | select(.["compartment-id"] == null) | .id')"

    oci_json iam compartment list \
      --compartment-id "${tenancy_ocid}" \
      --compartment-id-in-subtree true \
      --all \
      | jq -r '.data[] | select(.lifecycle-state=="ACTIVE") | .id'
  fi
}

echo "Scanning OKE clusters for API endpoint exposure..."
echo

header="region,compartment_name,cluster_name,cluster_ocid,endpoint_public_hostname,endpoint_private_endpoint_ip,endpoint_is_public_ip_enabled,endpoint_is_private_endpoint,has_public_access_issue"
echo "${header}"

for region in $(get_all_regions); do
  export OCI_CLI_REGION="${region}"

  # Map compartment OCID -> name (for readability in output)
  declare -A COMP_NAME
  while read -r cid cname; do
    COMP_NAME["$cid"]="$cname"
  done < <(
    oci_json iam compartment list --compartment-id-in-subtree true --all \
      | jq -r '.data[] | select(.lifecycle-state=="ACTIVE") | "\(.id) \(.name)"'
  )

  for compartment in $(get_all_compartments); do
    clusters_json="$(oci_json ce cluster list --compartment-id "${compartment}" --all 2>/dev/null || echo '{}')"
    cluster_count="$(jq '.data | length' <<<"${clusters_json}")"
    if [[ "${cluster_count}" -eq 0 ]]; then
      continue
    fi

    echo "${clusters_json}" | jq -c '.data[]' | while read -r c; do
      cluster_id="$(jq -r '.id' <<<"${c}")"
      cluster_name="$(jq -r '.name' <<<"${c}")"

      # Get full cluster details (includes endpoint config)
      detail="$(oci_json ce cluster get --cluster-id "${cluster_id}" 2>/dev/null | jq -c '.data')"

      ep_host="$(jq -r '.endpoints.kubernetes' <<<"${detail}" 2>/dev/null || echo "null")"
      ep_public_ip_enabled="$(jq -r '.endpoint-config.is-public-ip-enabled // "unknown"' <<<"${detail}" 2>/dev/null)"
      ep_is_private_endpoint="$(jq -r '.endpoint-config.is-private-endpoint // "unknown"' <<<"${detail}" 2>/dev/null)"
      ep_private_ip="$(jq -r '.endpoint-config.private-endpoint-ip // "null"' <<<"${detail}" 2>/dev/null)"

      # Define "problem" per CIS: public endpoint enabled (is-public-ip-enabled == true)
      # or not using private endpoint (is-private-endpoint != true) when private connectivity is possible.
      issue="false"
      if [[ "${ep_public_ip_enabled}" == "true" ]]; then
        issue="true"
      fi

      comp_name="${COMP_NAME[${compartment}]:-unknown}"

      printf '%s,%s,%s,%s,%s,%s,%s,%s,%s\n' \
        "${region}" \
        "${comp_name}" \
        "${cluster_name}" \
        "${cluster_id}" \
        "${ep_host}" \
        "${ep_private_ip}" \
        "${ep_public_ip_enabled}" \
        "${ep_is_private_endpoint}" \
        "${issue}"
    done
  done
done

cat <<'EOF'

INTERPRETING RESULTS
--------------------
Each line describes an OKE cluster:

- endpoint_is_public_ip_enabled:
    - "true"  -> The Kubernetes API is reachable via a public IP (POTENTIAL PROBLEM)
    - "false" -> Public IP disabled
    - "unknown" -> Could not determine (review in console/CLI manually)

- endpoint_is_private_endpoint:
    - "true"  -> Cluster uses a private endpoint in your VCN
    - "false" -> Private endpoint not used
    - "unknown" -> Could not determine (review manually)

- has_public_access_issue:
    - "true"  -> Fails the intent of CIS OKE 5.4.2: public API access is enabled
    - "false" -> Does not obviously violate the control, but still confirm design intent

Flagged rows ("has_public_access_issue=true") should be reviewed to decide if:
  - Public API access is strictly required for operations, AND
  - Compensating controls (IP allowlisting, VPN, bastion, etc.) are in place.

This script only reports configuration; disabling public access or switching to a private
endpoint must be done manually via OCI Console/CLI/Terraform following your change process.
EOF