Use custom least privilege service accounts for GKE node pools

Kako se proverava

Metod provere: Komanda ljuske

out=$(gcloud container node-pools list --cluster "${GKE_CLUSTER:?set GKE_CLUSTER}" --location "${GKE_LOCATION:?set GKE_LOCATION}" ${GKE_PROJECT:+--project=$GKE_PROJECT} --format='value(name,config.serviceAccount)') || exit 1
bad=$(printf '%s\n' "$out" | awk -F '\t' 'NF && !($2!="" && $2!="default" && $2 !~ /-compute@developer\.gserviceaccount\.com$/) {print $1 ": " $2}')
if [ -z "$bad" ]; then echo compliant; else printf '%s\n' "$bad"; fi

Očekivani izlaz

compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Create a dedicated custom IAM service account for GKE Standard node pools that are using the Compute Engine default service account or a service account with excessive permissions. The custom node service account should be used for node level system tasks and should be granted only the permissions required for GKE node operation. gcloud iam service-accounts create $NODE_SA_ACCOUNT \ --project=$PROJECT_ID \ --display-name="GKE Node Service Account" Grant the custom node service account the current baseline GKE node role, roles/container.defaultNodeServiceAccount. This role is intended to provide the required permissions for GKE node operation, replacing the older approach of separately assigning logging and monitoring roles.

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

tmaegis scan --target gke