Use CMEK protected StorageClasses for GKE Persistent Disk volumes

Как проверяется

Метод проверки: Ручная проверка

Эту рекомендацию нельзя проверить автоматически. Сканирование выводит её вместе с этими инструкциями при указании флага --include-manual.

Review GKE StorageClass objects and verify that Persistent Disk classes use the Compute Engine Persistent Disk CSI driver with an approved Cloud KMS key. The disk-encryption-kms-key parameter should contain the fully qualified Cloud KMS key resource path used to encrypt newly provisioned Persistent Disk volumes.

Как исправляется

Метод исправления: Рекомендация или патч инфраструктуры

Remediate any StorageClass or Persistent Disk that does not use an approved Cloud KMS key. CMEK for GKE Persistent Disk volumes is applied through a CMEK protected StorageClass for new dynamically provisioned volumes. Existing Persistent Disks cannot be converted to CMEK in place, so noncompliant volumes must be replaced or migrated. • Grant the Compute Engine service agent for the cluster project roles/cloudkms.cryptoKeyEncrypterDecrypter on the approved Cloud KMS key. • Create a new CMEK protected StorageClass using the Persistent Disk CSI driver, pd.csi.storage.gke.io, and the approved disk-encryption-kms-key value. • Update new PersistentVolumeClaims to use the CMEK protected StorageClass. If this should be the default storage option, mark the CMEK protected StorageClass as the default only after validating the key, location, and access permissions.