Apply least privilege firewall rules to GKE worker nodes

MediaNivel 2Revisión manualgke

Descripción

Apply least privilege VPC firewall rules and firewall policies to GKE worker nodes to restrict ingress and egress traffic to approved sources, destinations, ports, and protocols. Firewall rules should target only the intended GKE nodes by using appropriate network tags, service accounts, or other approved targeting methods. The benchmark marks this recommendation Manual.

Cómo se verifica

Método de auditoría: Revisión manual

Esta recomendación no se puede verificar automáticamente. Un escaneo la lista con estas instrucciones cuando se pasa --include-manual.

Review the GKE cluster and identify the VPC network, subnet, node pool network tags, and node service accounts used by the cluster. These values are used to determine which VPC firewall rules or firewall policies apply to the GKE worker nodes. gcloud container clusters describe $CLUSTER_NAME \ --location $LOCATION \ --project $PROJECT_ID \ --format json | jq '{ network: .network, subnetwork: .subnetwork, nodePools: [ .nodePools[] | { name: .name, tags: (.config.tags // []), serviceAccount: .config.serviceAccount } ] }' • Expected output: Firewall rules that apply to the cluster VPC ...

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Apply least privilege firewall controls to GKE worker nodes by reducing broad ingress and egress access while preserving required cluster functionality. Firewall rules should be targeted carefully so they protect the intended node pools without unintentionally affecting unrelated VM instances in the same VPC. • Update GKE worker node firewall rules so only approved sources, destinations, ports, and protocols are allowed. • Target firewall rules to the specific GKE node tags or node service accounts used by the cluster. Avoid rules that apply broadly to the entire VPC unless there is a documented requirement. • Remove or replace overly permissive rules, especially rules that allow broad ingress from 0.0.0.0/0, unnecessary management ports, broad NodePort ranges, or unrestricted egress.

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: gkemanaged-servicesnetwork
Referencia: CIS Google Kubernetes Engine (GKE) Benchmark v2.0.0 - 5.6.6 Apply least privilege firewall rules to GKE worker nodes