> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Cluster Master Endpoint Should Not Be Global ### More Info: Ensure that the endpoint of cluster master in not public ### Risk Level Medium ### Address Security ### Compliance Standards * Cloudanix Best Practice ### Triage and Remediation ### Remediation To remediate the misconfiguration "Cluster Master Endpoint Should Not Be Global" for GCP using GCP console, follow the below steps: 1. Go to the Google Kubernetes Engine (GKE) console. 2. Select the cluster for which you want to remediate the misconfiguration. 3. Click on the "Edit" button on the top of the page. 4. Scroll down to the "Endpoint" section. 5. Under the "Master endpoint" section, select the "Regional" option. 6. Select the region where your cluster is located. 7. Click on the "Save" button to apply the changes. Once you have completed these steps, your cluster master endpoint will no longer be global and will be limited to the selected region. This will help to reduce the attack surface and improve the security of your GKE cluster. # To remediate the misconfiguration "Cluster Master Endpoint Should Not Be Global" for GCP using GCP CLI, follow the below steps: 1. Open the Google Cloud Console and navigate to the Kubernetes Engine. 2. Select the cluster that you want to remediate. 3. Click on the "Edit" button at the top of the page. 4. Scroll down to the "Master endpoint" section. 5. Click on the "Customize" button next to the "Master endpoint" field. 6. Select "Regional" from the dropdown menu. 7. Choose the region where you want to create the endpoint. 8. Click on the "Save" button. 9. Verify that the endpoint has been updated to the regional endpoint by running the following command in the GCP CLI: ``` gcloud container clusters describe [CLUSTER_NAME] --zone [ZONE] ``` Replace \[CLUSTER\_NAME] and \[ZONE] with your cluster name and zone respectively. 10. Ensure that the endpoint is not global by running the following command: ``` gcloud container clusters describe [CLUSTER_NAME] --zone [ZONE] | grep endpoint ``` If the endpoint is not global, you will see the regional endpoint in the output. By following these steps, you will remediate the misconfiguration "Cluster Master Endpoint Should Not Be Global" for GCP using GCP CLI. To remediate the misconfiguration "Cluster Master Endpoint Should Not Be Global" for GCP using Python, you can follow the below steps: Step 1: Install the necessary libraries ``` !pip install google-cloud-container ``` Step 2: Import the necessary libraries ```python theme={null} from google.cloud import container_v1 from google.oauth2 import service_account ``` Step 3: Set up the credentials for authentication ```python theme={null} credentials = service_account.Credentials.from_service_account_file('path/to/your/credentials.json') ``` Step 4: Create a client object for the Container API ```python theme={null} client = container_v1.ClusterManagerClient(credentials=credentials) ``` Step 5: Get the cluster details ```python theme={null} project_id = 'your-project-id' zone = 'your-zone' cluster_id = 'your-cluster-id' cluster = client.get_cluster(project_id, zone, cluster_id) ``` Step 6: Check if the master endpoint is global ```python theme={null} if cluster.endpoint == 'global': cluster.endpoint = 'regional' update_request = container_v1.types.UpdateClusterRequest(cluster=cluster, update_mask={'paths':['endpoint']}) operation = client.update_cluster(update_request) operation.result() ``` Step 7: Verify if the master endpoint is updated to regional ```python theme={null} updated_cluster = client.get_cluster(project_id, zone, cluster_id) print(f"Master endpoint is now {updated_cluster.endpoint}") ``` By following these steps, you can remediate the misconfiguration "Cluster Master Endpoint Should Not Be Global" for GCP using Python. ```hcl theme={null} resource "google_container_cluster" "gke_private" { name = "CLUSTER_NAME" # e.g. "prod-gke" location = "GCP_REGION_OR_ZONE" # e.g. "us-central1" project = "PROJECT_ID" network = "VPC_NETWORK_NAME" # e.g. "prod-vpc" subnetwork = "VPC_SUBNETWORK_NAME" # e.g. "prod-gke-subnet" remove_default_node_pool = true initial_node_count = 1 # Ensure the master endpoint is NOT publicly accessible private_cluster_config { enable_private_nodes = true enable_private_endpoint = true # Replace with a /28 CIDR not overlapping your pod/service ranges master_ipv4_cidr_block = "MASTER_IPV4_CIDR_BLOCK" # e.g. "172.16.0.0/28" # Explicitly disable global (public) access to the control plane master_global_access_config { enabled = false } } # (Optional but recommended) restrict master authorized networks if you ever # re-enable a public endpoint in the future; do NOT include 0.0.0.0/0 # master_authorized_networks_config { # cidr_blocks { # cidr_block = "BASTION_IP/32" # display_name = "bastion" # } # } } ``` Changing an existing public cluster to use `private_cluster_config` (or changing these fields) forces replacement of the cluster in Terraform, which means control-plane and node recreation and associated downtime; plan this as a migration, not an in-place tweak. For verification, `terraform plan` should show `google_container_cluster.gke_private` with `private_cluster_config.enable_private_endpoint = true`, `private_cluster_config.enable_private_nodes = true`, a set `master_ipv4_cidr_block`, and `master_global_access_config.enabled = false`, with the cluster marked for recreation if it was previously public. ### Additional Reading: * [https://cloud.google.com/kubernetes-engine/docs/how-to/private-clusters](https://cloud.google.com/kubernetes-engine/docs/how-to/private-clusters)