Enable the GKE security posture dashboard for cluster security insights

낮음레벨 2자동gke

설명

Enable the GKE security posture dashboard to surface cluster and workload security insights, including workload configuration auditing, actionable security concerns, and security bulletin related findings. The dashboard provides a centralized view of security posture findings so teams can identify, prioritize, and remediate issues across eligible GKE clusters and workloads. Requires gcloud with container.clusters.get; the cluster comes from GKE_CLUSTER and GKE_LOCATION (optional GKE_PROJECT, else the gcloud default project).

점검 방법

감사 방식: 셸 명령

shell

v=$(gcloud container clusters describe "${GKE_CLUSTER:?set GKE_CLUSTER}" --location "${GKE_LOCATION:?set GKE_LOCATION}" ${GKE_PROJECT:+--project=$GKE_PROJECT} --format='value(securityPostureConfig.mode)') || exit 1
if case "$v" in BASIC|ENTERPRISE) true;; *) false;; esac; then echo compliant; else echo "noncompliant: securityPostureConfig.mode=$v"; fi

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

Enable the GKE security posture dashboard for workload configuration auditing when the audit shows that securityPostureConfig.mode is not BASIC. GKE supports enabling configuration auditing on existing clusters by setting the security posture mode to standard, which maps to BASIC in the cluster configuration. gcloud container clusters update $CLUSTER_NAME \ --location $LOCATION \ --project $PROJECT_ID \ --security-posture=standard For new clusters, include --security-posture=standard during cluster creation when this setting must be explicitly enforced. Rerun the audit command and confirm that securityPostureConfig.mode returns BASIC. Initial configuration audit results can take several minutes to appear in the security posture dashboard and related logs.

속성

운영 체제: 모두
태그: gkemanaged-services
참고 자료: CIS Google Kubernetes Engine (GKE) Benchmark v2.0.0 - 5.10.3 Enable the GKE security posture dashboard for cluster security insights

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target gke --level 2