Enable application-layer Secrets encryption with Cloud KMS keys

높음레벨 2자동gke-autopilot

설명

Enable application layer Secrets encryption for GKE Autopilot clusters using a Cloud KMS key. This control adds customer managed encryption for Kubernetes Secret resources stored in the cluster state database, providing an additional protection layer beyond Google managed encryption at rest. Requires gcloud with container.clusters.get; the cluster comes from GKE_CLUSTER and GKE_LOCATION (optional GKE_PROJECT, else the gcloud default project).

점검 방법

감사 방식: 셸 명령

shell

out=$(gcloud container clusters describe "${GKE_CLUSTER:?set GKE_CLUSTER}" --location "${GKE_LOCATION:?set GKE_LOCATION}" ${GKE_PROJECT:+--project=$GKE_PROJECT} --format='value(databaseEncryption.state,databaseEncryption.currentState,databaseEncryption.keyName)') || exit 1
set -- $(printf '%s' "$out" | tr '\t' ' ')
if [ "${1:-}" = ALL_OBJECTS_ENCRYPTION_ENABLED ] && [ "${2:-}" = CURRENT_STATE_ALL_OBJECTS_ENCRYPTION_ENABLED ] && [ -n "${3:-}" ]; then echo compliant; else echo "noncompliant: $out"; fi

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

Enable application layer encryption on the GKE Autopilot cluster when the audit shows that databaseEncryption.state is not ALL_OBJECTS_ENCRYPTION_ENABLED or ENCRYPTED, databaseEncryption.currentState is not CURRENT_STATE_ALL_OBJECTS_ENCRYPTION_ENABLED or CURRENT_STATE_ENCRYPTED, or databaseEncryption.keyName does not reference the approved Cloud KMS CryptoKey. Before enabling encryption, grant the Kubernetes Engine Service Agent permission to use the Cloud KMS key. The service agent needs the Cloud KMS CryptoKey Encrypter/Decrypter role so GKE can encrypt and decrypt Kubernetes Secret data in the cluster state database.

속성

운영 체제: 모두
태그: gke-autopilotmanaged-servicessecrets
참고 자료: CIS Google Kubernetes Engine (GKE) Autopilot Benchmark v2.0.0 - 5.3.1 Enable application-layer Secrets encryption with Cloud KMS keys

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target gke-autopilot --level 2