Google Kubernetes Engine (GKE)
TMA-GKE-5.6.7
Use Google managed SSL certificates for GKE Ingress TLS
설명
Use Google managed SSL certificates for GKE Ingress TLS to encrypt client traffic between external users and the Google Cloud load balancer. Google provisions and renews these certificates for the configured domains, reducing manual certificate lifecycle management for supported GKE Ingress use cases. The benchmark marks this recommendation Manual.
점검 방법
감사 방식: 수동 검토
Review public application exposure and identify workloads using Service objects of type LoadBalancer. Google managed SSL certificates for GKE Ingress apply to HTTPS load balancers created through Ingress, not TCP or UDP load balancers created directly from Service objects. Public HTTP or HTTPS workloads exposed through LoadBalancer services should be reviewed to determine whether GKE Ingress is the better TLS termination pattern.
조치 방법
조치 방식: 가이드 또는 인프라 패치
Remediate public HTTPS workloads by using GKE Ingress with Google managed SSL certificates where this pattern is appropriate. This applies to HTTPS traffic terminated by the external Application Load Balancer through GKE Ingress and does not apply to TCP or UDP workloads exposed through Service objects of type LoadBalancer. • For public HTTP or HTTPS workloads exposed directly through Service objects of type LoadBalancer, evaluate whether they should be exposed through GKE Ingress so Google managed SSL certificates can be used. • Create a ManagedCertificate object in the same namespace as the Ingress and define the approved non wildcard domain names for the certificate. • Update the Ingress metadata to include the networking.gke.io/managed-certificates annotation with the ManagedCertificate resource name. Multiple managed certificates can be listed as comma separated values when needed.
속성
- 운영 체제
- 모두
- 태그
- gkemanaged-services
- 참고 자료
- CIS Google Kubernetes Engine (GKE) Benchmark v2.0.0 - 5.6.7 Use Google managed SSL certificates for GKE Ingress TLS