Enable the GKE security posture dashboard for cluster security insights

低レベル 2自動gke

説明

Enable the GKE security posture dashboard to surface cluster and workload security insights, including workload configuration auditing, actionable security concerns, and security bulletin related findings. The dashboard provides a centralized view of security posture findings so teams can identify, prioritize, and remediate issues across eligible GKE clusters and workloads. Requires gcloud with container.clusters.get; the cluster comes from GKE_CLUSTER and GKE_LOCATION (optional GKE_PROJECT, else the gcloud default project).

チェック方法

監査方法: シェルコマンド

shell

v=$(gcloud container clusters describe "${GKE_CLUSTER:?set GKE_CLUSTER}" --location "${GKE_LOCATION:?set GKE_LOCATION}" ${GKE_PROJECT:+--project=$GKE_PROJECT} --format='value(securityPostureConfig.mode)') || exit 1
if case "$v" in BASIC|ENTERPRISE) true;; *) false;; esac; then echo compliant; else echo "noncompliant: securityPostureConfig.mode=$v"; fi

期待される出力: compliant

修正方法

修正方法: ガイダンスまたは IaC パッチ

Enable the GKE security posture dashboard for workload configuration auditing when the audit shows that securityPostureConfig.mode is not BASIC. GKE supports enabling configuration auditing on existing clusters by setting the security posture mode to standard, which maps to BASIC in the cluster configuration. gcloud container clusters update $CLUSTER_NAME \ --location $LOCATION \ --project $PROJECT_ID \ --security-posture=standard For new clusters, include --security-posture=standard during cluster creation when this setting must be explicitly enforced. Rerun the audit command and confirm that securityPostureConfig.mode returns BASIC. Initial configuration audit results can take several minutes to appear in the security posture dashboard and related logs.

プロパティ

オペレーティングシステム: すべて
タグ: gkemanaged-services
参照: CIS Google Kubernetes Engine (GKE) Benchmark v2.0.0 - 5.10.3 Enable the GKE security posture dashboard for cluster security insights

このホストをチェック

監査が許可されているマシンで実行してください。スキャンは読み取り専用です。

shell

tmaegis scan --target gke --level 2