Use CMEK protected StorageClasses for GKE Persistent Disk volumes

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

Review GKE StorageClass objects and verify that Persistent Disk classes use the Compute Engine Persistent Disk CSI driver with an approved Cloud KMS key. The disk-encryption-kms-key parameter should contain the fully qualified Cloud KMS key resource path used to encrypt newly provisioned Persistent Disk volumes.

How it is fixed

Fix method: Guidance or infrastructure patch

Remediate any StorageClass or Persistent Disk that does not use an approved Cloud KMS key. CMEK for GKE Persistent Disk volumes is applied through a CMEK protected StorageClass for new dynamically provisioned volumes. Existing Persistent Disks cannot be converted to CMEK in place, so noncompliant volumes must be replaced or migrated. • Grant the Compute Engine service agent for the cluster project roles/cloudkms.cryptoKeyEncrypterDecrypter on the approved Cloud KMS key. • Create a new CMEK protected StorageClass using the Persistent Disk CSI driver, pd.csi.storage.gke.io, and the approved disk-encryption-kms-key value. • Update new PersistentVolumeClaims to use the CMEK protected StorageClass. If this should be the default storage option, mark the CMEK protected StorageClass as the default only after validating the key, location, and access permissions.