Skip to main content

Cluster Master Endpoint Should Not Be Global

More Info:​

Ensure that the endpoint of cluster master in not public

Risk Level​

Medium

Address​

Security

Compliance Standards​

  • Cloudanix Best Practice

Triage and Remediation​

Remediation​

Using Console

To remediate the misconfiguration "Cluster Master Endpoint Should Not Be Global" for GCP using GCP console, follow the below steps:

  1. Go to the Google Kubernetes Engine (GKE) console.
  2. Select the cluster for which you want to remediate the misconfiguration.
  3. Click on the "Edit" button on the top of the page.
  4. Scroll down to the "Endpoint" section.
  5. Under the "Master endpoint" section, select the "Regional" option.
  6. Select the region where your cluster is located.
  7. Click on the "Save" button to apply the changes.

Once you have completed these steps, your cluster master endpoint will no longer be global and will be limited to the selected region. This will help to reduce the attack surface and improve the security of your GKE cluster.

Using CLI

To remediate the misconfiguration "Cluster Master Endpoint Should Not Be Global" for GCP using GCP CLI, follow the below steps:

  1. Open the Google Cloud Console and navigate to the Kubernetes Engine.

  2. Select the cluster that you want to remediate.

  3. Click on the "Edit" button at the top of the page.

  4. Scroll down to the "Master endpoint" section.

  5. Click on the "Customize" button next to the "Master endpoint" field.

  6. Select "Regional" from the dropdown menu.

  7. Choose the region where you want to create the endpoint.

  8. Click on the "Save" button.

  9. Verify that the endpoint has been updated to the regional endpoint by running the following command in the GCP CLI:

gcloud container clusters describe [CLUSTER_NAME] --zone [ZONE]

Replace [CLUSTER_NAME] and [ZONE] with your cluster name and zone respectively.

  1. Ensure that the endpoint is not global by running the following command:
gcloud container clusters describe [CLUSTER_NAME] --zone [ZONE] | grep endpoint

If the endpoint is not global, you will see the regional endpoint in the output.

By following these steps, you will remediate the misconfiguration "Cluster Master Endpoint Should Not Be Global" for GCP using GCP CLI.

Using Python

To remediate the misconfiguration "Cluster Master Endpoint Should Not Be Global" for GCP using Python, you can follow the below steps:

Step 1: Install the necessary libraries

!pip install google-cloud-container

Step 2: Import the necessary libraries

from google.cloud import container_v1
from google.oauth2 import service_account

Step 3: Set up the credentials for authentication

credentials = service_account.Credentials.from_service_account_file('path/to/your/credentials.json')

Step 4: Create a client object for the Container API

client = container_v1.ClusterManagerClient(credentials=credentials)

Step 5: Get the cluster details

project_id = 'your-project-id'
zone = 'your-zone'
cluster_id = 'your-cluster-id'

cluster = client.get_cluster(project_id, zone, cluster_id)

Step 6: Check if the master endpoint is global

if cluster.endpoint == 'global':
    cluster.endpoint = 'regional'
    update_request = container_v1.types.UpdateClusterRequest(cluster=cluster, update_mask={'paths':['endpoint']})
    operation = client.update_cluster(update_request)
    operation.result()

Step 7: Verify if the master endpoint is updated to regional

updated_cluster = client.get_cluster(project_id, zone, cluster_id)
print(f"Master endpoint is now {updated_cluster.endpoint}")

By following these steps, you can remediate the misconfiguration "Cluster Master Endpoint Should Not Be Global" for GCP using Python.

Using Terraform
resource "google_container_cluster" "gke_private" {
  name     = "CLUSTER_NAME"        # e.g. "prod-gke"
  location = "GCP_REGION_OR_ZONE"  # e.g. "us-central1"

  project  = "PROJECT_ID"

  network    = "VPC_NETWORK_NAME"     # e.g. "prod-vpc"
  subnetwork = "VPC_SUBNETWORK_NAME"  # e.g. "prod-gke-subnet"

  remove_default_node_pool = true
  initial_node_count       = 1

  # Ensure the master endpoint is NOT publicly accessible
  private_cluster_config {
    enable_private_nodes    = true
    enable_private_endpoint = true

    # Replace with a /28 CIDR not overlapping your pod/service ranges
    master_ipv4_cidr_block = "MASTER_IPV4_CIDR_BLOCK" # e.g. "172.16.0.0/28"

    # Explicitly disable global (public) access to the control plane
    master_global_access_config {
      enabled = false
    }
  }

  # (Optional but recommended) restrict master authorized networks if you ever
  # re-enable a public endpoint in the future; do NOT include 0.0.0.0/0
  # master_authorized_networks_config {
  #   cidr_blocks {
  #     cidr_block   = "BASTION_IP/32"
  #     display_name = "bastion"
  #   }
  # }
}

Changing an existing public cluster to use private_cluster_config (or changing these fields) forces replacement of the cluster in Terraform, which means control-plane and node recreation and associated downtime; plan this as a migration, not an in-place tweak.

For verification, terraform plan should show google_container_cluster.gke_private with private_cluster_config.enable_private_endpoint = true, private_cluster_config.enable_private_nodes = true, a set master_ipv4_cidr_block, and master_global_access_config.enabled = false, with the cluster marked for recreation if it was previously public.

Additional Reading:​