Ensure private GKE nodes are configured without external IP addresses

How it is checked

Audit method: Shell command

v=$(gcloud container clusters describe "${GKE_CLUSTER:?set GKE_CLUSTER}" --location "${GKE_LOCATION:?set GKE_LOCATION}" ${GKE_PROJECT:+--project=$GKE_PROJECT} --format='value(privateClusterConfig.enablePrivateNodes)') || exit 1
if [ "$v" = True ]; then echo compliant; else echo "noncompliant: privateClusterConfig.enablePrivateNodes=$v"; fi

Expected output

compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Remediate by enabling private nodes at the cluster level for GKE Autopilot workloads. Private nodes provision GKE nodes with internal IP addresses only. For Autopilot clusters, update the cluster level private node configuration instead of updating individual node pools. The cluster update takes effect after GKE reschedules workloads onto nodes that match the configuration. Enable private nodes as the cluster level default for GKE Autopilot workloads: gcloud container clusters update $CLUSTER_NAME \ --location $LOCATION \ --project $PROJECT_ID \ --enable-private-nodes \ --enable-ip-alias If workload level placement is required, configure the workload to schedule on private nodes by using the cloud.google.com/private-node=true node selector. Note: After remediation, rerun the audit command and confirm that the cluster level default returns true.

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

tmaegis scan --target gke-autopilot --level 2