TMA-GKE-5.3.1

Enable application-layer Secrets encryption with Cloud KMS keys

CaoCấp 2Tự độnggke

Mô tả

Enable application layer Secrets encryption for GKE Standard clusters using a Cloud KMS key. This control adds customer managed encryption for Kubernetes Secret resources stored in the cluster state database, providing an additional protection layer beyond Google managed encryption at rest. Requires gcloud with container.clusters.get; the cluster comes from GKE_CLUSTER and GKE_LOCATION (optional GKE_PROJECT, else the gcloud default project).

Cách kiểm tra

Phương pháp kiểm tra: Lệnh shell

shell

out=$(gcloud container clusters describe "${GKE_CLUSTER:?set GKE_CLUSTER}" --location "${GKE_LOCATION:?set GKE_LOCATION}" ${GKE_PROJECT:+--project=$GKE_PROJECT} --format='value(databaseEncryption.state,databaseEncryption.currentState,databaseEncryption.keyName)') || exit 1
set -- $(printf '%s' "$out" | tr '\t' ' ')
if [ "${1:-}" = ALL_OBJECTS_ENCRYPTION_ENABLED ] && [ "${2:-}" = CURRENT_STATE_ALL_OBJECTS_ENCRYPTION_ENABLED ] && [ -n "${3:-}" ]; then echo compliant; else echo "noncompliant: $out"; fi

Đầu ra mong đợi: compliant

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

Enable application layer encryption on the GKE Standard cluster when the audit shows that databaseEncryption.state is not ALL_OBJECTS_ENCRYPTION_ENABLED, databaseEncryption.currentState is not CURRENT_STATE_ALL_OBJECTS_ENCRYPTION_ENABLED, or databaseEncryption.keyName does not reference the approved Cloud KMS CryptoKey. In the Google Cloud console: • Open the GKE cluster • Select Edit and then go to the Security section • Edit Application-layer Secrets Encryption • Check Encrypt secrets at the application layer • Choose the approved Cloud KMS key.

Thuộc tính

Hệ điều hành: Bất kỳ
Thẻ: gkemanaged-servicessecrets
Tham chiếu: CIS Google Kubernetes Engine (GKE) Benchmark v2.0.0 - 5.3.1 Enable application-layer Secrets encryption with Cloud KMS keys

Kiểm tra máy này

Chạy lệnh này trên máy bạn được phép kiểm tra. Lần quét chỉ ở chế độ đọc.

shell

tmaegis scan --target gke --level 2