Google Kubernetes Engine (GKE)
TMA-GKE-5.8.3
Ensure Legacy Authorization (ABAC) is Disabled
Mô tả
Keep legacy ABAC authorization disabled for GKE clusters. ABAC is a legacy Kubernetes authorization method that has been superseded by Kubernetes RBAC, which provides fine grained authorization through Role, ClusterRole, RoleBinding, and ClusterRoleBinding resources. Requires gcloud with container.clusters.get; the cluster comes from GKE_CLUSTER and GKE_LOCATION (optional GKE_PROJECT, else the gcloud default project).
Cách kiểm tra
Phương pháp kiểm tra: Lệnh shell
v=$(gcloud container clusters describe "${GKE_CLUSTER:?set GKE_CLUSTER}" --location "${GKE_LOCATION:?set GKE_LOCATION}" ${GKE_PROJECT:+--project=$GKE_PROJECT} --format='value(legacyAbac.enabled)') || exit 1
if [ "$v" != True ]; then echo compliant; else echo "noncompliant: legacyAbac.enabled=$v"; fi- Đầu ra mong đợi
compliant
Cách khắc phục
Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng
Disable legacy ABAC authorization for any GKE cluster where the audit result returns true. Before disabling ABAC, confirm that required users, groups, service accounts, workloads, and automation have the necessary Kubernetes RBAC permissions through Role, ClusterRole, RoleBinding, and ClusterRoleBinding resources. gcloud container clusters update $CLUSTER_NAME \ --location $LOCATION \ --project $PROJECT_ID \ --no-enable-legacy-authorization Rerun the audit command and confirm that .legacyAbac.enabled returns false or null. Validate representative access with kubectl auth can-i to confirm legitimate users and automation still have the required RBAC access.
Thuộc tính
- Hệ điều hành
- Bất kỳ
- Thẻ
- gkemanaged-services
- Tham chiếu
- CIS Google Kubernetes Engine (GKE) Benchmark v2.0.0 - 5.8.3 Ensure Legacy Authorization (ABAC) is Disabled
Kiểm tra máy này
Chạy lệnh này trên máy bạn được phép kiểm tra. Lần quét chỉ ở chế độ đọc.
tmaegis scan --target gke