Verify Shielded GKE Nodes are enabled for GKE clusters

How it is checked

Audit method: Shell command

v=$(gcloud container clusters describe "${GKE_CLUSTER:?set GKE_CLUSTER}" --location "${GKE_LOCATION:?set GKE_LOCATION}" ${GKE_PROJECT:+--project=$GKE_PROJECT} --format='value(shieldedNodes.enabled)') || exit 1
if [ "$v" = True ]; then echo compliant; else echo "noncompliant: shieldedNodes.enabled=$v"; fi

Expected output

compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Enable Shielded GKE Nodes for any GKE cluster where the audit result is not true. This updates the cluster so worker nodes are recreated as Shielded VMs and can be cryptographically verified by the GKE control plane before joining the cluster. gcloud container clusters update $CLUSTER_NAME \ --location $LOCATION \ --project $PROJECT_ID \ --enable-shielded-nodes Rerun the audit command and confirm that shieldedNodes.enabled returns true. Enabling Shielded GKE Nodes on an existing cluster immediately recreates the control plane and recreates worker nodes in a rolling manner while respecting maintenance availability, so plan the change during an approved maintenance window.

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

tmaegis scan --target gke