Verify Shielded GKE Nodes are enabled for GKE clusters

Méthode de vérification

Méthode d'audit: Commande shell

v=$(gcloud container clusters describe "${GKE_CLUSTER:?set GKE_CLUSTER}" --location "${GKE_LOCATION:?set GKE_LOCATION}" ${GKE_PROJECT:+--project=$GKE_PROJECT} --format='value(shieldedNodes.enabled)') || exit 1
if [ "$v" = True ]; then echo compliant; else echo "noncompliant: shieldedNodes.enabled=$v"; fi

Sortie attendue

compliant

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

Enable Shielded GKE Nodes for any GKE cluster where the audit result is not true. This updates the cluster so worker nodes are recreated as Shielded VMs and can be cryptographically verified by the GKE control plane before joining the cluster. gcloud container clusters update $CLUSTER_NAME \ --location $LOCATION \ --project $PROJECT_ID \ --enable-shielded-nodes Rerun the audit command and confirm that shieldedNodes.enabled returns true. Enabling Shielded GKE Nodes on an existing cluster immediately recreates the control plane and recreates worker nodes in a rolling manner while respecting maintenance availability, so plan the change during an approved maintenance window.

Vérifier cet hôte

Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.

tmaegis scan --target gke