Use DNS based access or private GKE control plane endpoints

Nasıl denetlenir

Denetim yöntemi: Kabuk komutu

out=$(gcloud container clusters describe "${GKE_CLUSTER:?set GKE_CLUSTER}" --location "${GKE_LOCATION:?set GKE_LOCATION}" ${GKE_PROJECT:+--project=$GKE_PROJECT} --format='value(controlPlaneEndpointsConfig.ipEndpointsConfig.enabled,controlPlaneEndpointsConfig.ipEndpointsConfig.enablePublicEndpoint,controlPlaneEndpointsConfig.dnsEndpointConfig.endpoint,controlPlaneEndpointsConfig.dnsEndpointConfig.allowExternalTraffic)') || exit 1
set -- $(printf '%s' "$out" | tr '\t' '|' | awk -F '|' '{for(i=1;i<=4;i++) printf "%s ", ($i=="" ? "-" : $i)}')
if [ "$2" = False ]; then echo compliant
elif [ "$1" = False ] && [ "$3" != - ] && [ "$4" = True ]; then echo compliant
else echo "noncompliant: ipEndpoints=$1 publicEndpoint=$2 dnsEndpoint=$3 allowExternalTraffic=$4"; fi

Beklenen çıktı

compliant

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

Remediate existing GKE clusters by updating the control plane access configuration. Recreating the cluster is not required for this control. Choose the access model that matches the organization’s approved management path. Method 1: Use DNS based control plane access and disable IP based endpoint access where appropriate: gcloud container clusters update $CLUSTER_NAME \ --location $LOCATION \ --project $PROJECT_ID \ --enable-dns-access \ --no-enable-ip-access Method 2: Use IP based access with the external endpoint disabled and the private endpoint enabled: gcloud container clusters update $CLUSTER_NAME \ --location $LOCATION \ --project $PROJECT_ID \ --enable-ip-access \ --enable-private-endpoint If the public IP based endpoint must remain enabled, restrict it with authorized networks and use only approved CIDR ranges.

Bu ana makineyi denetle

Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.

tmaegis scan --target gke --level 2