Use DNS based access or private GKE control plane endpoints

Cách kiểm tra

Phương pháp kiểm tra: Lệnh shell

out=$(gcloud container clusters describe "${GKE_CLUSTER:?set GKE_CLUSTER}" --location "${GKE_LOCATION:?set GKE_LOCATION}" ${GKE_PROJECT:+--project=$GKE_PROJECT} --format='value(controlPlaneEndpointsConfig.ipEndpointsConfig.enabled,controlPlaneEndpointsConfig.ipEndpointsConfig.enablePublicEndpoint,controlPlaneEndpointsConfig.dnsEndpointConfig.endpoint,controlPlaneEndpointsConfig.dnsEndpointConfig.allowExternalTraffic)') || exit 1
set -- $(printf '%s' "$out" | tr '\t' '|' | awk -F '|' '{for(i=1;i<=4;i++) printf "%s ", ($i=="" ? "-" : $i)}')
if [ "$2" = False ]; then echo compliant
elif [ "$1" = False ] && [ "$3" != - ] && [ "$4" = True ]; then echo compliant
else echo "noncompliant: ipEndpoints=$1 publicEndpoint=$2 dnsEndpoint=$3 allowExternalTraffic=$4"; fi

Đầu ra mong đợi

compliant

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

Remediate existing GKE clusters by updating the control plane access configuration. Recreating the cluster is not required for this control. Choose the access model that matches the organization’s approved management path. Method 1: Use DNS based control plane access and disable IP based endpoint access where appropriate: gcloud container clusters update $CLUSTER_NAME \ --location $LOCATION \ --project $PROJECT_ID \ --enable-dns-access \ --no-enable-ip-access Method 2: Use IP based access with the external endpoint disabled and the private endpoint enabled: gcloud container clusters update $CLUSTER_NAME \ --location $LOCATION \ --project $PROJECT_ID \ --enable-ip-access \ --enable-private-endpoint If the public IP based endpoint must remain enabled, restrict it with authorized networks and use only approved CIDR ranges.

Kiểm tra máy này

Chạy lệnh này trên máy bạn được phép kiểm tra. Lần quét chỉ ở chế độ đọc.

tmaegis scan --target gke --level 2