Use CMEK protected boot disks for GKE node pools

Como é verificado

Método de auditoria: Comando shell

out=$(gcloud container node-pools list --cluster "${GKE_CLUSTER:?set GKE_CLUSTER}" --location "${GKE_LOCATION:?set GKE_LOCATION}" ${GKE_PROJECT:+--project=$GKE_PROJECT} --format='value(name,config.bootDiskKmsKey)') || exit 1
bad=$(printf '%s\n' "$out" | awk -F '\t' 'NF && !($2!="") {print $1 ": " $2}')
if [ -z "$bad" ]; then echo compliant; else printf '%s\n' "$bad"; fi

Saída esperada

compliant

Como é corrigido

Método de correção: Orientação ou patch de infraestrutura

CMEK for node boot disks cannot be enabled, changed, or disabled in place for an existing node pool. To remediate a noncompliant node pool, create a replacement node pool with the approved Cloud KMS key, migrate workloads to the new node pool, validate workload health, and delete the old node pool after migration. Before creating the replacement node pool, grant the required Cloud KMS key access to the Compute Engine service agent for the cluster project. Create the replacement node pool with the approved boot disk type and Cloud KMS key. Current GKE CMEK boot disk guidance uses pd-standard or pd-ssd for this configuration.

Verificar este host

Execute isto em uma máquina que você tenha permissão para auditar. A varredura é somente leitura.

tmaegis scan --target gke --level 2