Use custom least privilege service accounts for GKE node pools

So wird geprüft

Prüfmethode: Shell-Befehl

out=$(gcloud container node-pools list --cluster "${GKE_CLUSTER:?set GKE_CLUSTER}" --location "${GKE_LOCATION:?set GKE_LOCATION}" ${GKE_PROJECT:+--project=$GKE_PROJECT} --format='value(name,config.serviceAccount)') || exit 1
bad=$(printf '%s\n' "$out" | awk -F '\t' 'NF && !($2!="" && $2!="default" && $2 !~ /-compute@developer\.gserviceaccount\.com$/) {print $1 ": " $2}')
if [ -z "$bad" ]; then echo compliant; else printf '%s\n' "$bad"; fi

Erwartete Ausgabe

compliant

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

Create a dedicated custom IAM service account for GKE Standard node pools that are using the Compute Engine default service account or a service account with excessive permissions. The custom node service account should be used for node level system tasks and should be granted only the permissions required for GKE node operation. gcloud iam service-accounts create $NODE_SA_ACCOUNT \ --project=$PROJECT_ID \ --display-name="GKE Node Service Account" Grant the custom node service account the current baseline GKE node role, roles/container.defaultNodeServiceAccount. This role is intended to provide the required permissions for GKE node operation, replacing the older approach of separately assigning logging and monitoring roles.

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

tmaegis scan --target gke