​
Event Information

  1. The Microsoft.ContainerService.managedClusters.secrets.delete event in Azure for Azure Container Service indicates that a secret associated with a managed cluster in Azure Container Service has been deleted.
  2. This event typically occurs when a user or an automated process deletes a secret that was previously stored and used by the managed cluster.
  3. It is important to monitor and track these events to ensure that secrets are properly managed and to investigate any unauthorized or accidental deletions that may occur.

​
Examples

  1. Unauthorized access: If security is impacted with Microsoft.ContainerService.managedClusters.secrets.delete in Azure for Azure Container Service, it could potentially allow unauthorized users to delete secrets associated with managed clusters. This could lead to a compromise of sensitive information or credentials, potentially resulting in unauthorized access to the containerized applications or services running on the cluster.

  2. Data loss or corruption: Deleting secrets associated with managed clusters can result in data loss or corruption if the secrets are critical for the proper functioning of the containers or applications. For example, if a secret contains database credentials or encryption keys, deleting it could lead to the loss of access to the database or the inability to decrypt sensitive data.

  3. Service disruption: Deleting secrets used by the managed clusters can cause service disruption if the secrets are required for the cluster to function properly. For instance, if a secret contains authentication tokens or certificates necessary for communication with external services or APIs, deleting it could result in the cluster being unable to establish connections, leading to service outages or degraded performance.

​
Remediation

​
Using Console

To remediate the issues for Azure Container Service using the Azure console, you can follow these step-by-step instructions:

  1. Enable Azure Security Center:

    • Go to the Azure portal and search for “Security Center” in the search bar.
    • Select “Security Center” from the results and click on it.
    • In the Security Center dashboard, click on “Pricing & settings” in the left menu.
    • Select the subscription and resource group where your Azure Container Service is located.
    • Click on “Apply to all resources” to enable Security Center for all resources in the selected subscription and resource group.
    • Click on “Save” to apply the changes.

  2. Configure Network Security Groups (NSGs):

    • Go to the Azure portal and search for “Virtual machines” in the search bar.
    • Select “Virtual machines” from the results and click on it.
    • Select the virtual machine associated with your Azure Container Service.
    • In the virtual machine’s settings, click on “Networking” in the left menu.
    • Under “Inbound port rules”, review the existing rules and remove any unnecessary open ports.
    • Click on “Add inbound port rule” to add specific rules for required ports.
    • Configure the NSG rules based on the recommendations provided in the previous response.
    • Click on “Save” to apply the changes.

  3. Implement Azure Monitor for Containers:

    • Go to the Azure portal and search for “Monitor” in the search bar.
    • Select “Monitor” from the results and click on it.
    • In the Monitor dashboard, click on “Containers” in the left menu.
    • Click on “Enable Azure Monitor for containers” to start the setup process.
    • Select the Azure Container Service you want to monitor and click on “Enable”.
    • Wait for the deployment to complete and then click on “Go to Azure Monitor for containers”.
    • Review the monitoring data and configure alerts, if required, based on the recommendations provided in the previous response.

These steps will help you remediate the issues for Azure Container Service using the Azure console.

​
Using CLI

To remediate the issue with Azure Container Service using Azure CLI, you can follow these steps:

  1. Upgrade the Azure Container Service:

    • Use the az aks upgrade command to upgrade the Azure Kubernetes Service (AKS) cluster to the latest version.
    • Example: az aks upgrade --name <aks-cluster-name> --resource-group <resource-group-name>

  2. Enable Azure Monitor for Containers:

    • Use the az aks enable-addons command to enable Azure Monitor for Containers on the AKS cluster.
    • Example: az aks enable-addons --name <aks-cluster-name> --resource-group <resource-group-name> --addons monitoring

  3. Configure Log Analytics workspace:

    • Use the az monitor log-analytics workspace create command to create a Log Analytics workspace.
    • Example: az monitor log-analytics workspace create --resource-group <resource-group-name> --workspace-name <workspace-name> --location <location>

Note: Replace <aks-cluster-name>, <resource-group-name>, <workspace-name>, and <location> with the appropriate values specific to your environment.

​
Using Python

To remediate the issue with Azure Container Service using Python, you can follow these steps:

  1. Use the Azure SDK for Python to interact with Azure Container Service.

    • Install the required package: pip install azure-mgmt-containerinstance
    • Import the necessary modules in your Python script: 
      from azure.identity import DefaultAzureCredential
from azure.mgmt.containerinstance import ContainerInstanceManagementClient

  2. Authenticate with Azure using the appropriate credentials.

    • Create an instance of the DefaultAzureCredential class to authenticate with Azure: 
      credential = DefaultAzureCredential()

  3. Use the Azure Container Instance Management client to perform remediation actions.

    • Create an instance of the ContainerInstanceManagementClient class: 
      container_client = ContainerInstanceManagementClient(credential, subscription_id)
    • Use the client to perform actions such as deleting a container group or scaling the number of instances: 
      # Delete a container group
container_client.container_groups.delete(resource_group_name, container_group_name)

# Scale the number of instances in a container group
container_client.container_groups.update(resource_group_name, container_group_name, container_group)

Please note that the provided code snippets are just examples and may need to be adapted to your specific use case. Make sure to replace the placeholders (subscription_id, resource_group_name, container_group_name, etc.) with the actual values relevant to your Azure environment.