Enable the GKE security posture dashboard for cluster security insights

Cómo se verifica

Método de auditoría: Comando de shell

v=$(gcloud container clusters describe "${GKE_CLUSTER:?set GKE_CLUSTER}" --location "${GKE_LOCATION:?set GKE_LOCATION}" ${GKE_PROJECT:+--project=$GKE_PROJECT} --format='value(securityPostureConfig.mode)') || exit 1
if case "$v" in BASIC|ENTERPRISE) true;; *) false;; esac; then echo compliant; else echo "noncompliant: securityPostureConfig.mode=$v"; fi

Salida esperada

compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Enable the GKE security posture dashboard for workload configuration auditing when the audit shows that securityPostureConfig.mode is not BASIC. GKE supports enabling configuration auditing on existing clusters by setting the security posture mode to standard, which maps to BASIC in the cluster configuration. gcloud container clusters update $CLUSTER_NAME \ --location $LOCATION \ --project $PROJECT_ID \ --security-posture=standard For new clusters, include --security-posture=standard during cluster creation when this setting must be explicitly enforced. Rerun the audit command and confirm that securityPostureConfig.mode returns BASIC. Initial configuration audit results can take several minutes to appear in the security posture dashboard and related logs.

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

tmaegis scan --target gke --level 2