Use DNS based access or private GKE control plane endpoints

Как проверяется

Метод проверки: Команда оболочки

out=$(gcloud container clusters describe "${GKE_CLUSTER:?set GKE_CLUSTER}" --location "${GKE_LOCATION:?set GKE_LOCATION}" ${GKE_PROJECT:+--project=$GKE_PROJECT} --format='value(controlPlaneEndpointsConfig.ipEndpointsConfig.enabled,controlPlaneEndpointsConfig.ipEndpointsConfig.enablePublicEndpoint,controlPlaneEndpointsConfig.dnsEndpointConfig.endpoint,controlPlaneEndpointsConfig.dnsEndpointConfig.allowExternalTraffic)') || exit 1
set -- $(printf '%s' "$out" | tr '\t' '|' | awk -F '|' '{for(i=1;i<=4;i++) printf "%s ", ($i=="" ? "-" : $i)}')
if [ "$2" = False ]; then echo compliant
elif [ "$1" = False ] && [ "$3" != - ] && [ "$4" = True ]; then echo compliant
else echo "noncompliant: ipEndpoints=$1 publicEndpoint=$2 dnsEndpoint=$3 allowExternalTraffic=$4"; fi

Ожидаемый вывод

compliant

Как исправляется

Метод исправления: Рекомендация или патч инфраструктуры

Remediate existing GKE clusters by updating the control plane access configuration. Recreating the cluster is not required for this control. Choose the access model that matches the organization’s approved management path. Method 1: Use DNS based control plane access and disable IP based endpoint access where appropriate: gcloud container clusters update $CLUSTER_NAME \ --location $LOCATION \ --project $PROJECT_ID \ --enable-dns-access \ --no-enable-ip-access Method 2: Use IP based access with the external endpoint disabled and the private endpoint enabled: gcloud container clusters update $CLUSTER_NAME \ --location $LOCATION \ --project $PROJECT_ID \ --enable-ip-access \ --enable-private-endpoint If the public IP based endpoint must remain enabled, restrict it with authorized networks and use only approved CIDR ranges.

Проверить этот хост

Выполните команду на компьютере, аудит которого вам разрешён. Сканирование работает только на чтение.

tmaegis scan --target gke --level 2