Disable workload identity at cluster creation remediation

Using Console

To remediate the misconfiguration of disabling workload identity at cluster creation on GCP using GCP console, you can follow these step-by-step instructions:

Open the GCP console and navigate to the Kubernetes Engine page.
Select the cluster on which you want to enable workload identity.
Click on the “Edit” button at the top of the page.
Scroll down to the “Workload Identity” section.
Click on the “Enable” button to turn on workload identity for the cluster.
Click on the “Save” button at the bottom of the page to apply the changes.

After completing these steps, workload identity will be enabled for your cluster, and you will be able to use it to securely authenticate your applications and services running on GCP.

Using CLI

To remediate the misconfiguration of disabling Workload Identity at Cluster Creation in GCP using GCP CLI, you can follow the below steps:Step 1: Open the Cloud Shell from the GCP Console.Step 2: Run the following command to check if Workload Identity is enabled or not:

gcloud container clusters describe [CLUSTER_NAME] --zone [ZONE] | grep workloadIdentityConfig

Step 3: If the output shows workloadIdentityConfig: {}, then Workload Identity is not enabled for the cluster.Step 4: To enable Workload Identity for the cluster, run the following command:

gcloud container clusters update [CLUSTER_NAME] --zone [ZONE] --workload-pool=[PROJECT_ID].svc.id.goog

Note: Replace [CLUSTER_NAME], [ZONE], and [PROJECT_ID] with the appropriate values.Step 5: Verify that Workload Identity is enabled for the cluster by running the following command:

gcloud container clusters describe [CLUSTER_NAME] --zone [ZONE] | grep workloadIdentityConfig

Step 6: If the output shows workloadIdentityConfig: workloadPool: [PROJECT_ID].svc.id.goog, then Workload Identity is enabled for the cluster.By following these steps, you can remediate the misconfiguration of disabling Workload Identity at Cluster Creation in GCP using GCP CLI.

Using Python

To remediate the “Disable Workload Identity at Cluster Creation” misconfiguration in GCP using Python, you can follow the below steps:

Install the Google Cloud SDK by following the instructions provided in the GCP documentation.
Once the SDK is installed, authenticate with your GCP account using the following command:

gcloud auth login

Create a Python script to enable Workload Identity at Cluster Creation. You can use the following code as a starting point:

from googleapiclient import discovery
from oauth2client.client import GoogleCredentials

# Set the project ID and zone
project_id = 'YOUR_PROJECT_ID'
zone = 'YOUR_ZONE'

# Authenticate with GCP
credentials = GoogleCredentials.get_application_default()
service = discovery.build('container', 'v1', credentials=credentials)

# Set the cluster name
cluster_name = 'YOUR_CLUSTER_NAME'

# Get the current cluster configuration
cluster = service.projects().zones().clusters().get(projectId=project_id, zone=zone, clusterId=cluster_name).execute()

# Enable Workload Identity
cluster['workloadIdentityConfig'] = {'enabled': True}

# Update the cluster configuration
response = service.projects().zones().clusters().update(projectId=project_id, zone=zone, clusterId=cluster_name, body=cluster).execute()

# Print the response
print(response)

Replace the placeholders with your own project ID, zone, and cluster name.
Run the Python script using the following command:

python script.py

Verify that Workload Identity has been enabled for the cluster by checking the cluster configuration in the GCP Console or using the following command:

gcloud container clusters describe YOUR_CLUSTER_NAME --zone YOUR_ZONE --project YOUR_PROJECT_ID

Note: Make sure you have the necessary permissions to make changes to the GCP resources before running the script.

Using Terraform

resource "google_org_policy_policy" "disable_workload_identity_at_cluster_creation" {
  # Substitute YOUR_ORG_ID with the numeric organization ID, e.g. "123456789012"
  parent = "organizations/YOUR_ORG_ID"

  # Substitute CONSTRAINT_NAME with the exact constraint identifier
  # for "Disable Workload Identity at Cluster Creation",
  # e.g. "constraints/container.SOME_EXACT_NAME_FROM_DOCS"
  name = "organizations/YOUR_ORG_ID/policies/CONSTRAINT_NAME"

  spec {
    rules {
      # For a boolean org policy constraint, enforcing the policy is done with:
      enforce = true
    }
  }
}

Substitute:

YOUR_ORG_ID with your GCP organization ID.
CONSTRAINT_NAME with the exact org policy constraint for disabling Workload Identity at cluster creation (copy it from the Organization Policies page in the GCP Console; the Terraform provider uses that same string).

This does not force replacement of any existing GKE clusters; it only affects future cluster creations.To verify, terraform plan should show creation (or update) of a single google_org_policy_policy.disable_workload_identity_at_cluster_creation resource with enforce = true under the correct CONSTRAINT_NAME.

GCP Introduction

GCP Pricing

GCP Threats

GCP Misconfigurations

Resources

GCP Threats

Disable workload identity at cluster creation remediation

Triage and Remediation

Remediation

​Triage and Remediation

​Remediation

​

Triage and Remediation

Remediation