Enable GKE metadata server on Standard node pools

How it is checked

Audit method: Shell command

wp=$(gcloud container clusters describe "${GKE_CLUSTER:?set GKE_CLUSTER}" --location "${GKE_LOCATION:?set GKE_LOCATION}" ${GKE_PROJECT:+--project=$GKE_PROJECT} --format='value(workloadIdentityConfig.workloadPool)') || exit 1
[ -n "$wp" ] || { echo "noncompliant: Workload Identity not enabled"; exit 0; }
out=$(gcloud container node-pools list --cluster "${GKE_CLUSTER:?set GKE_CLUSTER}" --location "${GKE_LOCATION:?set GKE_LOCATION}" ${GKE_PROJECT:+--project=$GKE_PROJECT} --format='value(name,config.workloadMetadataConfig.mode)') || exit 1
bad=$(printf '%s\n' "$out" | awk -F '\t' 'NF && $2!="GKE_METADATA" {print $1 ": " $2}')
if [ -z "$bad" ]; then echo compliant; else printf '%s\n' "$bad"; fi

Expected output

compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Enable Workload Identity Federation for GKE on the cluster if the audit shows that no workload pool is configured. This is required before the GKE metadata server can be enabled on Standard node pools. gcloud container clusters update $CLUSTER_NAME \ --location=$LOCATION \ --project=$PROJECT_ID \ --workload-pool=$PROJECT_ID.svc.id.goog Enable the GKE metadata server on existing node pools that require workload access to Google Cloud APIs. Existing node pools are not automatically updated when the cluster setting is enabled, so each existing node pool must be updated or replaced. gcloud container node-pools update $NODE_POOL \ --cluster=$CLUSTER_NAME \ --location=$LOCATION \ --project=$PROJECT_ID \ --workload-metadata=GKE_METADATA After remediation, rerun the audit command and confirm that each applicable node pool reports GKE_METADATA.

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

tmaegis scan --target gke --level 2