Verify Shielded GKE Nodes are enabled for GKE clusters

Nasıl denetlenir

Denetim yöntemi: Kabuk komutu

v=$(gcloud container clusters describe "${GKE_CLUSTER:?set GKE_CLUSTER}" --location "${GKE_LOCATION:?set GKE_LOCATION}" ${GKE_PROJECT:+--project=$GKE_PROJECT} --format='value(shieldedNodes.enabled)') || exit 1
if [ "$v" = True ]; then echo compliant; else echo "noncompliant: shieldedNodes.enabled=$v"; fi

Beklenen çıktı

compliant

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

Enable Shielded GKE Nodes for any GKE cluster where the audit result is not true. This updates the cluster so worker nodes are recreated as Shielded VMs and can be cryptographically verified by the GKE control plane before joining the cluster. gcloud container clusters update $CLUSTER_NAME \ --location $LOCATION \ --project $PROJECT_ID \ --enable-shielded-nodes Rerun the audit command and confirm that shieldedNodes.enabled returns true. Enabling Shielded GKE Nodes on an existing cluster immediately recreates the control plane and recreates worker nodes in a rolling manner while respecting maintenance availability, so plan the change during an approved maintenance window.

Bu ana makineyi denetle

Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.

tmaegis scan --target gke