Ensure private GKE nodes are configured without external IP addresses

OrtaDüzey 2Otomatikgke-autopilot

Açıklama

Configure GKE Autopilot nodes without external IP addresses so worker nodes are reachable only through internal network paths. Private nodes reduce direct exposure of the node network interface to external clients while still allowing the cluster to run workloads and communicate with the control plane through internal connectivity. Requires gcloud with container.clusters.get; the cluster comes from GKE_CLUSTER and GKE_LOCATION (optional GKE_PROJECT, else the gcloud default project).

Nasıl denetlenir

Denetim yöntemi: Kabuk komutu

shell

v=$(gcloud container clusters describe "${GKE_CLUSTER:?set GKE_CLUSTER}" --location "${GKE_LOCATION:?set GKE_LOCATION}" ${GKE_PROJECT:+--project=$GKE_PROJECT} --format='value(privateClusterConfig.enablePrivateNodes)') || exit 1
if [ "$v" = True ]; then echo compliant; else echo "noncompliant: privateClusterConfig.enablePrivateNodes=$v"; fi

Beklenen çıktı: compliant

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

Remediate by enabling private nodes at the cluster level for GKE Autopilot workloads. Private nodes provision GKE nodes with internal IP addresses only. For Autopilot clusters, update the cluster level private node configuration instead of updating individual node pools. The cluster update takes effect after GKE reschedules workloads onto nodes that match the configuration. Enable private nodes as the cluster level default for GKE Autopilot workloads: gcloud container clusters update $CLUSTER_NAME \ --location $LOCATION \ --project $PROJECT_ID \ --enable-private-nodes \ --enable-ip-alias If workload level placement is required, configure the workload to schedule on private nodes by using the cloud.google.com/private-node=true node selector. Note: After remediation, rerun the audit command and confirm that the cluster level default returns true.

Özellikler

İşletim sistemleri: Herhangi biri
Etiketler: gke-autopilotmanaged-servicesnetwork
Referans: CIS Google Kubernetes Engine (GKE) Autopilot Benchmark v2.0.0 - 5.4.4 Ensure private GKE nodes are configured without external IP addresses

Bu ana makineyi denetle

Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.

shell

tmaegis scan --target gke-autopilot --level 2