Use dedicated Kubernetes service accounts with Workload Identity Federation for GKE

SedangLevel 2Tinjauan manualgke

Deskripsi

Use Workload Identity Federation for GKE to give GKE workloads distinct, least privilege identities when they need access to Google Cloud APIs. Workloads should use dedicated Kubernetes service accounts and IAM allow policies instead of relying on node service account permissions or long lived IAM service account keys. The benchmark marks this recommendation Manual.

Cara pemeriksaan

Metode audit: Tinjauan manual

Rekomendasi ini tidak dapat diperiksa secara otomatis. Pemindaian akan menampilkannya beserta petunjuk ini saat Anda memberikan opsi --include-manual.

Review the GKE Standard cluster and verify that Workload Identity Federation for GKE is enabled at the cluster level. The cluster should have a workload pool configured in the format $PROJECT_ID.svc.id.goog. gcloud container clusters describe $CLUSTER_NAME \ --location=$LOCATION \ --project=$PROJECT_ID \ --format='value(workloadIdentityConfig.workloadPool)' • Expected ouput: $PROJECT_ID.svc.id.goog Review each node pool and verify that it is configured to use the GKE metadata server.

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

This remediation is important when GKE Standard workloads rely on node service account permissions, mounted IAM service account keys, or shared Kubernetes service accounts to access Google Cloud APIs. Enabling Workload Identity Federation for GKE and using dedicated Kubernetes service accounts allows each workload to receive only the Google Cloud permissions it needs, reducing reliance on broad node level permissions and improving workload level identity separation. Enable Workload Identity Federation for GKE on the GKE Standard cluster if the workload pool is not configured. gcloud container clusters update $CLUSTER_NAME \ --location=$LOCATION \ --project=$PROJECT_ID \ --workload-pool=$PROJECT_ID.svc.id.goog Enable the GKE metadata server on existing node pools that run workloads requiring Google Cloud API access.

Properti

Sistem operasi: Apa saja
Tag: gkemanaged-servicesrbac
Referensi: CIS Google Kubernetes Engine (GKE) Benchmark v2.0.0 - 5.2.2 Use dedicated Kubernetes service accounts with Workload Identity Federation for GKE