Ensure private GKE nodes are configured without external IP addresses

높음레벨 1자동gke

설명

Configure GKE nodes without external IP addresses so worker nodes are reachable only through internal network paths. Private nodes reduce direct exposure of the node network interface to external clients while still allowing the cluster to run workloads and communicate with the control plane through internal connectivity. Requires gcloud with container.clusters.get; the cluster comes from GKE_CLUSTER and GKE_LOCATION (optional GKE_PROJECT, else the gcloud default project). Every node pool is checked.

점검 방법

감사 방식: 셸 명령

shell

c=$(gcloud container clusters describe "${GKE_CLUSTER:?set GKE_CLUSTER}" --location "${GKE_LOCATION:?set GKE_LOCATION}" ${GKE_PROJECT:+--project=$GKE_PROJECT} --format='value(privateClusterConfig.enablePrivateNodes)') || exit 1
out=$(gcloud container node-pools list --cluster "${GKE_CLUSTER:?set GKE_CLUSTER}" --location "${GKE_LOCATION:?set GKE_LOCATION}" ${GKE_PROJECT:+--project=$GKE_PROJECT} --format='value(name,networkConfig.enablePrivateNodes)') || exit 1
bad=$(printf '%s\n' "$out" | awk -F '\t' 'NF && $2!="True" {print $1}')
if [ "$c" = True ] && [ -z "$bad" ]; then echo compliant; else echo "noncompliant: cluster=$c pools:" $bad; fi

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

Remediate by enabling private nodes at the cluster level for new node pools and at the node pool level for existing node pools. Private nodes provision GKE nodes with internal IP addresses only. GKE does not automatically modify existing node pools when the cluster level setting is changed, so existing node pools must be updated separately. Enable private nodes as the cluster level default for new node pools: gcloud container clusters update $CLUSTER_NAME \ --location $LOCATION \ --project $PROJECT_ID \ --enable-private-nodes \ --enable-ip-alias Enable private nodes on an existing node pool: gcloud container node-pools update $POOL_NAME \ --cluster $CLUSTER_NAME \ --location $LOCATION \ --project $PROJECT_ID \ --enable-private-nodes \ --enable-ip-alias • Note: After remediation, rerun the audit commands and confirm that the cluster level default and each applicable node pool return ...

속성

운영 체제: 모두
태그: gkemanaged-servicesnetwork
참고 자료: CIS Google Kubernetes Engine (GKE) Benchmark v2.0.0 - 5.6.5 Ensure private GKE nodes are configured without external IP addresses

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target gke