Ensure private GKE nodes are configured without external IP addresses

So wird geprüft

Prüfmethode: Shell-Befehl

v=$(gcloud container clusters describe "${GKE_CLUSTER:?set GKE_CLUSTER}" --location "${GKE_LOCATION:?set GKE_LOCATION}" ${GKE_PROJECT:+--project=$GKE_PROJECT} --format='value(privateClusterConfig.enablePrivateNodes)') || exit 1
if [ "$v" = True ]; then echo compliant; else echo "noncompliant: privateClusterConfig.enablePrivateNodes=$v"; fi

Erwartete Ausgabe

compliant

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

Remediate by enabling private nodes at the cluster level for GKE Autopilot workloads. Private nodes provision GKE nodes with internal IP addresses only. For Autopilot clusters, update the cluster level private node configuration instead of updating individual node pools. The cluster update takes effect after GKE reschedules workloads onto nodes that match the configuration. Enable private nodes as the cluster level default for GKE Autopilot workloads: gcloud container clusters update $CLUSTER_NAME \ --location $LOCATION \ --project $PROJECT_ID \ --enable-private-nodes \ --enable-ip-alias If workload level placement is required, configure the workload to schedule on private nodes by using the cloud.google.com/private-node=true node selector. Note: After remediation, rerun the audit command and confirm that the cluster level default returns true.

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

tmaegis scan --target gke-autopilot --level 2