Use Google managed SSL certificates for GKE Ingress TLS

Cara pemeriksaan

Metode audit: Tinjauan manual

Rekomendasi ini tidak dapat diperiksa secara otomatis. Pemindaian akan menampilkannya beserta petunjuk ini saat Anda memberikan opsi --include-manual.

Review public application exposure and identify workloads using Service objects of type LoadBalancer. Google managed SSL certificates for GKE Ingress apply to HTTPS load balancers created through Ingress, not TCP or UDP load balancers created directly from Service objects. Public HTTP or HTTPS workloads exposed through LoadBalancer services should be reviewed to determine whether GKE Ingress is the better TLS termination pattern.

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

Remediate public HTTPS workloads by using GKE Ingress with Google managed SSL certificates where this pattern is appropriate. This applies to HTTPS traffic terminated by the external Application Load Balancer through GKE Ingress and does not apply to TCP or UDP workloads exposed through Service objects of type LoadBalancer. • For public HTTP or HTTPS workloads exposed directly through Service objects of type LoadBalancer, evaluate whether they should be exposed through GKE Ingress so Google managed SSL certificates can be used. • Create a ManagedCertificate object in the same namespace as the Ingress and define the approved non wildcard domain names for the certificate. • Update the Ingress metadata to include the networking.gke.io/managed-certificates annotation with the ManagedCertificate resource name. Multiple managed certificates can be listed as comma separated values when needed.