> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Alias IP Ranges Should Be Enabled ### More Info: Ensures all Kubernetes clusters have alias IP ranges enabled. Alias IP ranges allow users to assign ranges of internal IP addresses as alias to a network interface. ### Risk Level Low ### Address Security ### Compliance Standards * CIS GKE ### Triage and Remediation ### Remediation To remediate the "Alias IP Ranges Should Be Enabled" misconfiguration for GCP using the GCP console, follow these steps: 1. Open the GCP console and navigate to the VPC network that you want to remediate. 2. Click on the "Edit" button next to the VPC network. 3. Scroll down to the "Subnet" section and click on the subnet that you want to remediate. 4. Click on the "Edit" button next to the subnet. 5. In the "Secondary IP ranges" section, click on the "Add secondary IP range" button. 6. Enter a name for the secondary IP range and specify the IP address range that you want to use. 7. Click on the "Save" button to save the changes. 8. Repeat steps 5-7 for any additional secondary IP ranges that you want to add. 9. Click on the "Save" button to save the changes to the subnet. 10. Repeat steps 3-9 for any additional subnets that you want to remediate. By following these steps, you have enabled the "Alias IP Ranges" feature for the selected subnets in your GCP VPC network. # To remediate the "Alias IP Ranges Should Be Enabled" misconfiguration in GCP using GCP CLI, follow these steps: 1. Open the Cloud Shell in the GCP Console. 2. Run the following command to list all the VPC networks in your project: ``` gcloud compute networks list ``` 3. Identify the VPC network for which you want to enable alias IP ranges. 4. Run the following command to enable alias IP ranges for the identified VPC network: ``` gcloud compute networks update [NETWORK_NAME] --enable-ip-alias ``` Replace `[NETWORK_NAME]` with the name of the identified VPC network. 5. Verify that alias IP ranges have been enabled for the VPC network by running the following command: ``` gcloud compute networks describe [NETWORK_NAME] --format="table(aliasIpRanges)" ``` Replace `[NETWORK_NAME]` with the name of the identified VPC network. The command should return a table with the alias IP ranges for the VPC network. 6. Repeat steps 3-5 for all other VPC networks in your project. By following these steps, you will have successfully remediated the "Alias IP Ranges Should Be Enabled" misconfiguration in GCP using GCP CLI. To remediate the misconfiguration "Alias IP Ranges Should Be Enabled" in GCP using Python, follow the below steps: Step 1: Import the necessary libraries and authenticate to GCP. ```python theme={null} from google.oauth2 import service_account from googleapiclient.discovery import build credentials = service_account.Credentials.from_service_account_file( 'path/to/service_account.json') service = build('compute', 'v1', credentials=credentials) ``` Step 2: Get the list of all subnetworks in the project. ```python theme={null} project = 'your-project-id' subnetworks = service.subnetworks().list(project=project).execute() ``` Step 3: For each subnetwork, check if Alias IP Ranges is enabled. If not, enable it. ```python theme={null} for subnetwork in subnetworks['items']: subnetwork_name = subnetwork['name'] region = subnetwork['region'].split('/')[-1] subnetwork_selfLink = subnetwork['selfLink'] subnetwork_obj = service.subnetworks().get(project=project, region=region, subnetwork=subnetwork_name).execute() if 'enableFlowLogs' not in subnetwork_obj or not subnetwork_obj['enableFlowLogs']: subnetwork_obj['enableFlowLogs'] = True update_mask = 'enableFlowLogs' service.subnetworks().patch(project=project, region=region, subnetwork=subnetwork_name, body=subnetwork_obj, updateMask=update_mask).execute() ``` Step 4: Verify that the Alias IP Ranges is enabled for all subnetworks. ```python theme={null} for subnetwork in subnetworks['items']: subnetwork_name = subnetwork['name'] region = subnetwork['region'].split('/')[-1] subnetwork_selfLink = subnetwork['selfLink'] subnetwork_obj = service.subnetworks().get(project=project, region=region, subnetwork=subnetwork_name).execute() if 'enableFlowLogs' not in subnetwork_obj or not subnetwork_obj['enableFlowLogs']: print(f"Alias IP Ranges is not enabled for subnetwork {subnetwork_name}") else: print(f"Alias IP Ranges is enabled for subnetwork {subnetwork_name}") ``` This should remediate the misconfiguration "Alias IP Ranges Should Be Enabled" in GCP using Python. ```hcl theme={null} resource "google_container_cluster" "PRIMARY_CLUSTER" { name = "PRIMARY_CLUSTER_NAME" # replace with your cluster name location = "PRIMARY_CLUSTER_LOCATION" # replace with your region or zone project = "GCP_PROJECT_ID" # replace with your project ID # ... other cluster settings ... ip_allocation_policy { # This is the key setting: turns on alias IP ranges use_ip_aliases = true # Replace these with existing or desired secondary ranges on the VPC subnet cluster_secondary_range_name = "CLUSTER_SECONDARY_RANGE_NAME" services_secondary_range_name = "SERVICES_SECONDARY_RANGE_NAME" } network = "VPC_NETWORK_NAME" # e.g. "projects/PROJECT/global/networks/NETWORK" subnetwork = "VPC_SUBNETWORK_NAME" # e.g. "projects/PROJECT/regions/REGION/subnetworks/SUBNET" } ``` Enabling `use_ip_aliases` on a GKE cluster that was created without alias IPs forces replacement of the cluster in Terraform (the old cluster is destroyed and a new one is created); plan carefully for any resulting outage. To verify, run `terraform plan` and confirm it shows `ip_allocation_policy.use_ip_aliases` being set to `true` (and, if it was previously disabled, that the cluster resource is marked for replacement). ### Additional Reading: * [https://cloud.google.com/monitoring/kubernetes-engine/](https://cloud.google.com/monitoring/kubernetes-engine/)