Use CMEK protected StorageClasses for GKE Persistent Disk volumes

보통레벨 2수동 검토gke

설명

Use CMEK protected StorageClass objects for GKE Persistent Disk volumes so newly provisioned Persistent Disks are encrypted with an approved Cloud KMS key. This applies to dynamically provisioned Persistent Disk volumes that use the Compute Engine Persistent Disk CSI driver and the disk-encryption-kms-key parameter. The benchmark marks this recommendation Manual.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

Review GKE StorageClass objects and verify that Persistent Disk classes use the Compute Engine Persistent Disk CSI driver with an approved Cloud KMS key. The disk-encryption-kms-key parameter should contain the fully qualified Cloud KMS key resource path used to encrypt newly provisioned Persistent Disk volumes.

조치 방법

조치 방식: 가이드 또는 인프라 패치

Remediate any StorageClass or Persistent Disk that does not use an approved Cloud KMS key. CMEK for GKE Persistent Disk volumes is applied through a CMEK protected StorageClass for new dynamically provisioned volumes. Existing Persistent Disks cannot be converted to CMEK in place, so noncompliant volumes must be replaced or migrated. • Grant the Compute Engine service agent for the cluster project roles/cloudkms.cryptoKeyEncrypterDecrypter on the approved Cloud KMS key. • Create a new CMEK protected StorageClass using the Persistent Disk CSI driver, pd.csi.storage.gke.io, and the approved disk-encryption-kms-key value. • Update new PersistentVolumeClaims to use the CMEK protected StorageClass. If this should be the default storage option, mark the CMEK protected StorageClass as the default only after validating the key, location, and access permissions.

속성

운영 체제: 모두
태그: gkemanaged-servicessecrets
참고 자료: CIS Google Kubernetes Engine (GKE) Benchmark v2.0.0 - 5.9.1 Use CMEK protected StorageClasses for GKE Persistent Disk volumes