Use dedicated Kubernetes service accounts with Workload Identity Federation for GKE

보통레벨 2수동 검토gke

설명

Use Workload Identity Federation for GKE to give GKE workloads distinct, least privilege identities when they need access to Google Cloud APIs. Workloads should use dedicated Kubernetes service accounts and IAM allow policies instead of relying on node service account permissions or long lived IAM service account keys. The benchmark marks this recommendation Manual.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

Review the GKE Standard cluster and verify that Workload Identity Federation for GKE is enabled at the cluster level. The cluster should have a workload pool configured in the format $PROJECT_ID.svc.id.goog. gcloud container clusters describe $CLUSTER_NAME \ --location=$LOCATION \ --project=$PROJECT_ID \ --format='value(workloadIdentityConfig.workloadPool)' • Expected ouput: $PROJECT_ID.svc.id.goog Review each node pool and verify that it is configured to use the GKE metadata server.

조치 방법

조치 방식: 가이드 또는 인프라 패치

This remediation is important when GKE Standard workloads rely on node service account permissions, mounted IAM service account keys, or shared Kubernetes service accounts to access Google Cloud APIs. Enabling Workload Identity Federation for GKE and using dedicated Kubernetes service accounts allows each workload to receive only the Google Cloud permissions it needs, reducing reliance on broad node level permissions and improving workload level identity separation. Enable Workload Identity Federation for GKE on the GKE Standard cluster if the workload pool is not configured. gcloud container clusters update $CLUSTER_NAME \ --location=$LOCATION \ --project=$PROJECT_ID \ --workload-pool=$PROJECT_ID.svc.id.goog Enable the GKE metadata server on existing node pools that run workloads requiring Google Cloud API access.

속성

운영 체제: 모두
태그: gkemanaged-servicesrbac
참고 자료: CIS Google Kubernetes Engine (GKE) Benchmark v2.0.0 - 5.2.2 Use dedicated Kubernetes service accounts with Workload Identity Federation for GKE