Ensure Secure Boot is enabled for Shielded GKE node pools

Kako se proverava

Metod provere: Komanda ljuske

out=$(gcloud container node-pools list --cluster "${GKE_CLUSTER:?set GKE_CLUSTER}" --location "${GKE_LOCATION:?set GKE_LOCATION}" ${GKE_PROJECT:+--project=$GKE_PROJECT} --format='value(name,config.shieldedInstanceConfig.enableSecureBoot)') || exit 1
bad=$(printf '%s\n' "$out" | awk -F '\t' 'NF && !($2=="True") {print $1 ": " $2}')
if [ -z "$bad" ]; then echo compliant; else printf '%s\n' "$bad"; fi

Očekivani izlaz

compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Create a replacement node pool with Secure Boot enabled for any node pool where the audit result is not true. Secure Boot is disabled by default for node pools and should be explicitly enabled when creating the replacement node pool. gcloud container node-pools create $POOL_NAME \ --cluster $CLUSTER_NAME \ --location $LOCATION \ --project $PROJECT_ID \ --shielded-secure-boot • Before migrating workloads, validate that Secure Boot will not block required boot components or node level dependencies. On Ubuntu nodes, Secure Boot blocks unsigned third party kernel modules from loading. Migrate workloads from the noncompliant node pool to the new Secure Boot enabled node pool, validate workload health, and then drain and delete the old node pool. After remediation, rerun the audit command and confirm that enableSecureBoot returns true.

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

tmaegis scan --target gke --level 2