Verify Shielded GKE Node integrity monitoring is enabled

Méthode de vérification

Méthode d'audit: Commande shell

out=$(gcloud container node-pools list --cluster "${GKE_CLUSTER:?set GKE_CLUSTER}" --location "${GKE_LOCATION:?set GKE_LOCATION}" ${GKE_PROJECT:+--project=$GKE_PROJECT} --format='value(name,config.shieldedInstanceConfig.enableIntegrityMonitoring)') || exit 1
bad=$(printf '%s\n' "$out" | awk -F '\t' 'NF && !($2=="True") {print $1 ": " $2}')
if [ -z "$bad" ]; then echo compliant; else printf '%s\n' "$bad"; fi

Sortie attendue

compliant

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

Create a replacement node pool with Shielded GKE Node integrity monitoring enabled. Integrity monitoring is enabled by default for new GKE node pools, but it can also be explicitly enabled during node pool creation by using the --shielded-integrity-monitoring option. gcloud container node-pools create $POOL_NAME \ --cluster $CLUSTER_NAME \ --location $LOCATION \ --project $PROJECT_ID \ --shielded-integrity-monitoring Migrate workloads from the noncompliant node pool to the new node pool, validate workload health, and then drain and delete the old node pool. After remediation, rerun the audit command and confirm that enableIntegrityMonitoring returns true.

Vérifier cet hôte

Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.

tmaegis scan --target gke