Restrict GKE control plane access with authorized networks

Kako se proverava

Metod provere: Komanda ljuske

out=$(gcloud container clusters describe "${GKE_CLUSTER:?set GKE_CLUSTER}" --location "${GKE_LOCATION:?set GKE_LOCATION}" ${GKE_PROJECT:+--project=$GKE_PROJECT} --format='value(masterAuthorizedNetworksConfig.enabled,masterAuthorizedNetworksConfig.gcpPublicCidrsAccessEnabled)') || exit 1
cidrs=$(gcloud container clusters describe "${GKE_CLUSTER:?set GKE_CLUSTER}" --location "${GKE_LOCATION:?set GKE_LOCATION}" ${GKE_PROJECT:+--project=$GKE_PROJECT} --format='value(masterAuthorizedNetworksConfig.cidrBlocks[].cidrBlock)') || exit 1
set -- $(printf '%s' "$out" | tr '\t' ' ')
if [ "${1:-}" = True ] && [ "${2:-False}" != True ] && [ -n "$cidrs" ] && ! printf '%s' "$cidrs" | grep -q '0\.0\.0\.0/0'; then echo compliant; else echo "noncompliant: enabled=${1:-} gcpPublicCidrs=${2:-} cidrs=$cidrs"; fi

Očekivani izlaz

compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Enable control plane authorized networks when the audit shows that masterAuthorizedNetworksConfig is missing, does not show authorized networks as enabled, does not include approved cidrBlocks, or includes broad ranges such as 0.0.0.0/0. Authorized networks should include only trusted administrative, bastion, VPN, CI/CD, or automation source ranges that require access to the GKE control plane IP endpoint, and use authorized networks when IP based control plane endpoints are enabled. gcloud container clusters update $CLUSTER_NAME \ --location $LOCATION \ --project $PROJECT_ID \ --enable-master-authorized-networks \ --master-authorized-networks <authorized-cidrs> If broad access from Google Cloud external IP addresses is not explicitly approved, disable that access so external IP addresses from Google Cloud are not automatically allowed to reach the control plane.

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

tmaegis scan --target gke --level 2