Restrict GKE control plane access with authorized networks

Како се проверава

Метод провере: Команда љуске

out=$(gcloud container clusters describe "${GKE_CLUSTER:?set GKE_CLUSTER}" --location "${GKE_LOCATION:?set GKE_LOCATION}" ${GKE_PROJECT:+--project=$GKE_PROJECT} --format='value(masterAuthorizedNetworksConfig.enabled,masterAuthorizedNetworksConfig.gcpPublicCidrsAccessEnabled)') || exit 1
cidrs=$(gcloud container clusters describe "${GKE_CLUSTER:?set GKE_CLUSTER}" --location "${GKE_LOCATION:?set GKE_LOCATION}" ${GKE_PROJECT:+--project=$GKE_PROJECT} --format='value(masterAuthorizedNetworksConfig.cidrBlocks[].cidrBlock)') || exit 1
set -- $(printf '%s' "$out" | tr '\t' ' ')
if [ "${1:-}" = True ] && [ "${2:-False}" != True ] && [ -n "$cidrs" ] && ! printf '%s' "$cidrs" | grep -q '0\.0\.0\.0/0'; then echo compliant; else echo "noncompliant: enabled=${1:-} gcpPublicCidrs=${2:-} cidrs=$cidrs"; fi

Очекивани излаз

compliant

Како се исправља

Метод исправке: Смерница или закрпа инфраструктуре

Enable control plane authorized networks when the audit shows that masterAuthorizedNetworksConfig is missing, does not show authorized networks as enabled, does not include approved cidrBlocks, or includes broad ranges such as 0.0.0.0/0. Authorized networks should include only trusted administrative, bastion, VPN, CI/CD, or automation source ranges that require access to the GKE control plane IP endpoint, and use authorized networks when IP based control plane endpoints are enabled. gcloud container clusters update $CLUSTER_NAME \ --location $LOCATION \ --project $PROJECT_ID \ --enable-master-authorized-networks \ --master-authorized-networks <authorized-cidrs> If broad access from Google Cloud external IP addresses is not explicitly approved, disable that access so external IP addresses from Google Cloud are not automatically allowed to reach the control plane.

Проверите овај рачунар

Покрените ово на рачунару за који имате дозволу за проверу. Скенирање ради у режиму само за читање.

tmaegis scan --target gke --level 2