GCP Kubernetes Audit - Security Checks
Checks Performed
- Alias IP Ranges Should Be Enabled
- Automatic Node Repair Should Be Enabled
- Automatic Node Upgrades Should Be Enabled
- Autoscaling Profile For Clusters Should Be Set To Optimize_Utilization or Balanced
- Basic Authentication Should Be Disabled
- Client Certificate Authentication Should Not Be Used For Users
- Cluster Master Endpoint Should Not Be Global
- Cluster Should Have Limited Service Account Access
- Cluster Should Use Node Local DNS Cache
- Clusters Should Have Network Policies Or Dataplane V2 Enabled
- Consider GKE Sandbox For Running Untrusted Workloads
- Container-Optimized OS Should Be Enabled
- Control Plane Endpoint Access Should Be Limited To Authorized Networks
- Default Service Accounts Should Not Be Used
- Enable Regional Redundancy For Maximum Availability
- Enable VPC Flow Logs And Intranode Visibility
- Ensure Alpha Clusters Are Not Used For Production
- Ensure Authentication Using Client Certificates Is Disabled
- Ensure Clusters Use Stable Release Channels
- Ensure GKE Clusters Are Not Using Default Service Account
- Ensure Image Vulnerability Scanning Is Performed
- Ensure Integrity Monitoring For Shielded GKE Nodes Is Enabled
- Ensure Kubernetes Secrets Are Encrypted Using KMS Keys
- Ensure Kubernetes Web UI Is Disabled
- Ensure Legacy Compute Engine Instance Metadata APIs Are Disabled
- Ensure Stackdriver Kubernetes Logging And Monitoring Is Enabled
- Ensure The GKE Metadata Server Is Enabled
- Ensure Use Of Binary Authorization
- Ensure Use Of VPC-Native Clusters
- For Large Clusters L4 ILB Subsetting Should Be Used
- Integrity Monitoring Should Be Enabled For Kubernetes Node Pools
- Kubernetes Boot Disk Should Be Encrypted With Customer Managed Keys
- Kubernetes Node Pool Autoscaling Should Be Enabled
- Latest Kubernetes Version Should Be Used
- Legacy Authorization Should Be Disabled
- Logging Should Be Enabled
- Manage Kubernetes RBAC Users With Google Groups
- Master Authorized Network Should Be Enabled
- Minimize Cluster Access To Read-Only For GCR
- Minimize Container Registries To Only Approved Ones
- Monitoring Should Be Enabled
- Network Policy Should Be Enabled
- Node Pools Should Be Regional For High Availability
- Pod Security Policy Should Be Enabled
- Private Cluster Should Be Enabled
- Private Endpoints Should Be Enabled
- Schedule Maintenance Windows And Exclusions
- Secure Boot Should Be Enabled For Kubernetes Node Pools
- Shielded Nodes Should Be Used For Kubernetes Cluster
- Upgrades And Updates Should Be Enabled
- Use Dedicated GCP Service Accounts And Workload Identity For Clusters
- Web Dashboard Should Be Disabled
- Workload Identity Should Be Enabled