Google Kubernetes Engine (GKE)
TMA-GKE-5.8.2
Use Google Groups to centrally manage Kubernetes RBAC access for GKE clusters
Descripción
Use Google Groups for RBAC to centrally manage Kubernetes RBAC access for GKE clusters. Cluster administrators should assign Kubernetes RoleBinding and ClusterRoleBinding permissions to approved Google Groups rather than directly binding access to individual user email addresses. The benchmark marks this recommendation Manual.
Cómo se verifica
Método de auditoría: Revisión manual
Review the GKE cluster and verify that Google Groups for RBAC is enabled and configured with the required security group. Google Groups for RBAC lets Kubernetes RBAC permissions be assigned to Google Groups managed in Google Workspace or Cloud Identity, rather than binding access directly to individual user email addresses.
Cómo se corrige
Método de corrección: Guía o parche de infraestructura
Enable Google Groups for RBAC when the audit shows that authenticatorGroupsConfig.enabled is not true, or when securityGroupis missing or incorrect. The required security group must be named gke-security-groups@DOMAIN, and approved access groups should be nested under that security group before they are referenced in Kubernetes RBAC bindings. gcloud container clusters update $CLUSTER_NAME \ --location $LOCATION \ --project $PROJECT_ID \ --security-group=gke-security-groups@$DOMAIN After Google Groups for RBAC is enabled, update Kubernetes RoleBinding and ClusterRoleBinding objects to reference approved Google Groups as kind: Group subjects. Replace direct User bindings with group based bindings where practical, while preserving required ServiceAccount bindings for workloads, controllers, and automation.
Propiedades
- Sistemas operativos
- Cualquiera
- Etiquetas
- gkemanaged-servicesrbac
- Referencia
- CIS Google Kubernetes Engine (GKE) Benchmark v2.0.0 - 5.8.2 Use Google Groups to centrally manage Kubernetes RBAC access for GKE clusters