Disable legacy client certificate authentication for the GKE API server

VisokaNivo 1Automatskagke

Opis

Disable legacy client certificate authentication for the GKE API server by ensuring GKE does not issue a pre provisioned client certificate for cluster access. Use supported identity based authentication methods, such as OAuth tokens through gcloud, service account bearer tokens, or approved external identity provider authentication instead of long lived static client certificates. Requires gcloud with container.clusters.get; the cluster comes from GKE_CLUSTER and GKE_LOCATION (optional GKE_PROJECT, else the gcloud default project).

Kako se proverava

Metod provere: Komanda ljuske

shell

v=$(gcloud container clusters describe "${GKE_CLUSTER:?set GKE_CLUSTER}" --location "${GKE_LOCATION:?set GKE_LOCATION}" ${GKE_PROJECT:+--project=$GKE_PROJECT} --format='value(masterAuth.clientCertificate)') || exit 1
if [ -z "$v" ]; then echo compliant; else echo "noncompliant: masterAuth.clientCertificate=$v"; fi

Očekivani izlaz: compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

For new clusters, create the cluster without issuing a legacy client certificate by using the --no-issue-client-certificate flag. gcloud container clusters create $CLUSTER_NAME \ --location $LOCATION \ --project $PROJECT_ID \ --no-issue-client-certificate For existing clusters where a legacy client certificate was already issued, GKE does not provide a direct method to remove that client certificate from the cluster. To fully remediate the setting, create a replacement cluster with --no-issue-client-certificate, migrate workloads, validate access, and decommission the old cluster after migration. Note: If immediate replacement is not practical, reduce risk on the existing cluster by ensuring RBAC is enabled and that the legacy client certificate has no Kubernetes RBAC permissions.

Svojstva

Operativni sistemi: Bilo koji
Oznake: gkemanaged-servicesapi-server
Referenca: CIS Google Kubernetes Engine (GKE) Benchmark v2.0.0 - 5.8.1 Disable legacy client certificate authentication for the GKE API server

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target gke