Use Google Groups to centrally manage Kubernetes RBAC access for GKE clusters

中レベル 2手動レビューgke

説明

Use Google Groups for RBAC to centrally manage Kubernetes RBAC access for GKE clusters. Cluster administrators should assign Kubernetes RoleBinding and ClusterRoleBinding permissions to approved Google Groups rather than directly binding access to individual user email addresses. The benchmark marks this recommendation Manual.

チェック方法

監査方法: 手動レビュー

この推奨事項は自動ではチェックできません。--include-manual を指定すると、スキャン結果にこの手順付きで一覧表示されます。

Review the GKE cluster and verify that Google Groups for RBAC is enabled and configured with the required security group. Google Groups for RBAC lets Kubernetes RBAC permissions be assigned to Google Groups managed in Google Workspace or Cloud Identity, rather than binding access directly to individual user email addresses.

修正方法

修正方法: ガイダンスまたは IaC パッチ

Enable Google Groups for RBAC when the audit shows that authenticatorGroupsConfig.enabled is not true, or when securityGroupis missing or incorrect. The required security group must be named gke-security-groups@DOMAIN, and approved access groups should be nested under that security group before they are referenced in Kubernetes RBAC bindings. gcloud container clusters update $CLUSTER_NAME \ --location $LOCATION \ --project $PROJECT_ID \ --security-group=gke-security-groups@$DOMAIN After Google Groups for RBAC is enabled, update Kubernetes RoleBinding and ClusterRoleBinding objects to reference approved Google Groups as kind: Group subjects. Replace direct User bindings with group based bindings where practical, while preserving required ServiceAccount bindings for workloads, controllers, and automation.

プロパティ

オペレーティングシステム: すべて
タグ: gkemanaged-servicesrbac
参照: CIS Google Kubernetes Engine (GKE) Benchmark v2.0.0 - 5.8.2 Use Google Groups to centrally manage Kubernetes RBAC access for GKE clusters