Enable GKE metadata server on Standard node pools

Cara pemeriksaan

Metode audit: Perintah shell

wp=$(gcloud container clusters describe "${GKE_CLUSTER:?set GKE_CLUSTER}" --location "${GKE_LOCATION:?set GKE_LOCATION}" ${GKE_PROJECT:+--project=$GKE_PROJECT} --format='value(workloadIdentityConfig.workloadPool)') || exit 1
[ -n "$wp" ] || { echo "noncompliant: Workload Identity not enabled"; exit 0; }
out=$(gcloud container node-pools list --cluster "${GKE_CLUSTER:?set GKE_CLUSTER}" --location "${GKE_LOCATION:?set GKE_LOCATION}" ${GKE_PROJECT:+--project=$GKE_PROJECT} --format='value(name,config.workloadMetadataConfig.mode)') || exit 1
bad=$(printf '%s\n' "$out" | awk -F '\t' 'NF && $2!="GKE_METADATA" {print $1 ": " $2}')
if [ -z "$bad" ]; then echo compliant; else printf '%s\n' "$bad"; fi

Output yang diharapkan

compliant

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

Enable Workload Identity Federation for GKE on the cluster if the audit shows that no workload pool is configured. This is required before the GKE metadata server can be enabled on Standard node pools. gcloud container clusters update $CLUSTER_NAME \ --location=$LOCATION \ --project=$PROJECT_ID \ --workload-pool=$PROJECT_ID.svc.id.goog Enable the GKE metadata server on existing node pools that require workload access to Google Cloud APIs. Existing node pools are not automatically updated when the cluster setting is enabled, so each existing node pool must be updated or replaced. gcloud container node-pools update $NODE_POOL \ --cluster=$CLUSTER_NAME \ --location=$LOCATION \ --project=$PROJECT_ID \ --workload-metadata=GKE_METADATA After remediation, rerun the audit command and confirm that each applicable node pool reports GKE_METADATA.

Periksa host ini

Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.

tmaegis scan --target gke --level 2