Use custom least privilege service accounts for GKE node pools

Cara pemeriksaan

Metode audit: Perintah shell

out=$(gcloud container node-pools list --cluster "${GKE_CLUSTER:?set GKE_CLUSTER}" --location "${GKE_LOCATION:?set GKE_LOCATION}" ${GKE_PROJECT:+--project=$GKE_PROJECT} --format='value(name,config.serviceAccount)') || exit 1
bad=$(printf '%s\n' "$out" | awk -F '\t' 'NF && !($2!="" && $2!="default" && $2 !~ /-compute@developer\.gserviceaccount\.com$/) {print $1 ": " $2}')
if [ -z "$bad" ]; then echo compliant; else printf '%s\n' "$bad"; fi

Output yang diharapkan

compliant

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

Create a dedicated custom IAM service account for GKE Standard node pools that are using the Compute Engine default service account or a service account with excessive permissions. The custom node service account should be used for node level system tasks and should be granted only the permissions required for GKE node operation. gcloud iam service-accounts create $NODE_SA_ACCOUNT \ --project=$PROJECT_ID \ --display-name="GKE Node Service Account" Grant the custom node service account the current baseline GKE node role, roles/container.defaultNodeServiceAccount. This role is intended to provide the required permissions for GKE node operation, replacing the older approach of separately assigning logging and monitoring roles.

Periksa host ini

Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.

tmaegis scan --target gke