Use dedicated Kubernetes service accounts with Workload Identity Federation for GKE

中レベル 2手動レビューgke

説明

Use Workload Identity Federation for GKE to give GKE workloads distinct, least privilege identities when they need access to Google Cloud APIs. Workloads should use dedicated Kubernetes service accounts and IAM allow policies instead of relying on node service account permissions or long lived IAM service account keys. The benchmark marks this recommendation Manual.

チェック方法

監査方法: 手動レビュー

この推奨事項は自動ではチェックできません。--include-manual を指定すると、スキャン結果にこの手順付きで一覧表示されます。

Review the GKE Standard cluster and verify that Workload Identity Federation for GKE is enabled at the cluster level. The cluster should have a workload pool configured in the format $PROJECT_ID.svc.id.goog. gcloud container clusters describe $CLUSTER_NAME \ --location=$LOCATION \ --project=$PROJECT_ID \ --format='value(workloadIdentityConfig.workloadPool)' • Expected ouput: $PROJECT_ID.svc.id.goog Review each node pool and verify that it is configured to use the GKE metadata server.

修正方法

修正方法: ガイダンスまたは IaC パッチ

This remediation is important when GKE Standard workloads rely on node service account permissions, mounted IAM service account keys, or shared Kubernetes service accounts to access Google Cloud APIs. Enabling Workload Identity Federation for GKE and using dedicated Kubernetes service accounts allows each workload to receive only the Google Cloud permissions it needs, reducing reliance on broad node level permissions and improving workload level identity separation. Enable Workload Identity Federation for GKE on the GKE Standard cluster if the workload pool is not configured. gcloud container clusters update $CLUSTER_NAME \ --location=$LOCATION \ --project=$PROJECT_ID \ --workload-pool=$PROJECT_ID.svc.id.goog Enable the GKE metadata server on existing node pools that run workloads requiring Google Cloud API access.

プロパティ

オペレーティングシステム: すべて
タグ: gkemanaged-servicesrbac
参照: CIS Google Kubernetes Engine (GKE) Benchmark v2.0.0 - 5.2.2 Use dedicated Kubernetes service accounts with Workload Identity Federation for GKE