Use Google managed SSL certificates for GKE Ingress TLS

チェック方法

監査方法: 手動レビュー

この推奨事項は自動ではチェックできません。--include-manual を指定すると、スキャン結果にこの手順付きで一覧表示されます。

Review public application exposure and identify workloads using Service objects of type LoadBalancer. Google managed SSL certificates for GKE Ingress apply to HTTPS load balancers created through Ingress, not TCP or UDP load balancers created directly from Service objects. Public HTTP or HTTPS workloads exposed through LoadBalancer services should be reviewed to determine whether GKE Ingress is the better TLS termination pattern.

修正方法

修正方法: ガイダンスまたは IaC パッチ

Remediate public HTTPS workloads by using GKE Ingress with Google managed SSL certificates where this pattern is appropriate. This applies to HTTPS traffic terminated by the external Application Load Balancer through GKE Ingress and does not apply to TCP or UDP workloads exposed through Service objects of type LoadBalancer. • For public HTTP or HTTPS workloads exposed directly through Service objects of type LoadBalancer, evaluate whether they should be exposed through GKE Ingress so Google managed SSL certificates can be used. • Create a ManagedCertificate object in the same namespace as the Ingress and define the approved non wildcard domain names for the certificate. • Update the Ingress metadata to include the networking.gke.io/managed-certificates annotation with the ManagedCertificate resource name. Multiple managed certificates can be listed as comma separated values when needed.