> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# K8s cluster least privilege remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration "Cluster Should Have Limited Service Account Access" for GCP using GCP console, follow these steps:

        1. Open the Google Kubernetes Engine (GKE) console.
        2. Select the cluster that needs to be remediated.
        3. Click on the "Security" tab.
        4. Scroll down to the "Service Accounts" section.
        5. Click on the "Edit" button.
        6. In the "Service Accounts" section, select the option "Limit service account access to this cluster".
        7. Select the service account that needs access to the cluster.
        8. Click on the "Save" button to save the changes.

        By following these steps, the cluster will have limited service account access and only the selected service account will have access to the cluster.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration "Cluster Should Have Limited Service Account Access" for GCP using GCP CLI, you can follow the below steps:

        Step 1: Open the Cloud Shell from the GCP console or install the GCP CLI on your local machine.

        Step 2: Authenticate with your GCP account using the below command:

        ```
        gcloud auth login
        ```

        Step 3: Set the project where the cluster is located using the below command:

        ```
        gcloud config set project [PROJECT_ID]
        ```

        Step 4: Get the name of the cluster that needs to be remediated using the below command:

        ```
        gcloud container clusters list
        ```

        Step 5: Fetch the current IAM policy for the cluster using the below command:

        ```
        gcloud container clusters get-iam-policy [CLUSTER_NAME] --zone [ZONE]
        ```

        Step 6: Identify the service accounts that have access to the cluster and need to be removed from the IAM policy.

        Step 7: Remove the service accounts from the IAM policy using the below command:

        ```
        gcloud container clusters set-iam-policy [CLUSTER_NAME] --zone [ZONE] --remove-service-account [SERVICE_ACCOUNT_EMAIL_1],[SERVICE_ACCOUNT_EMAIL_2],...
        ```

        Step 8: Verify the changes by fetching the updated IAM policy using the below command:

        ```
        gcloud container clusters get-iam-policy [CLUSTER_NAME] --zone [ZONE]
        ```

        By following these steps, you can remediate the misconfiguration "Cluster Should Have Limited Service Account Access" for GCP using GCP CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration "Cluster Should Have Limited Service Account Access" for GCP using Python, follow these steps:

        1. Install the required libraries:
           ```
           pip install google-auth google-auth-oauthlib google-auth-httplib2 google-cloud-container google-cloud-logging
           ```

        2. Authenticate to GCP:
           ```
           from google.oauth2 import service_account
           credentials = service_account.Credentials.from_service_account_file('<path_to_service_account_file>')
           ```

        3. Retrieve the cluster object:
           ```
           from google.cloud import container_v1
           client = container_v1.ClusterManagerClient(credentials=credentials)
           project_id = '<your_project_id>'
           zone = '<your_zone>'
           cluster_id = '<your_cluster_id>'
           cluster = client.get_cluster(project_id, zone, cluster_id)
           ```

        4. Update the cluster's `master_auth` field to limit service account access:
           ```
           cluster.master_auth.cluster_ca_certificate = '<your_cluster_ca_certificate>'
           cluster.master_auth.username = '<your_username>'
           cluster.master_auth.password = '<your_password>'
           cluster.master_auth.client_certificate = '<your_client_certificate>'
           cluster.master_auth.client_key = '<your_client_key>'
           cluster.master_auth.client_certificate_config = {
               'issue_client_certificate': False,
           }
           cluster.master_auth.client_certificate_config.allowed_client_certificates = [
               '<your_allowed_client_certificate_1>',
               '<your_allowed_client_certificate_2>',
           ]
           update_mask = {
               'paths': [
                   'master_auth.cluster_ca_certificate',
                   'master_auth.username',
                   'master_auth.password',
                   'master_auth.client_certificate',
                   'master_auth.client_key',
                   'master_auth.client_certificate_config.issue_client_certificate',
                   'master_auth.client_certificate_config.allowed_client_certificates',
               ]
           }
           operation = client.update_cluster(project_id, zone, cluster_id, cluster, update_mask)
           ```

        5. Verify that the update was successful:
           ```
           operation.result()
           ```

        Note: The above steps assume that you have a GCP service account with sufficient permissions to access the cluster. Replace the placeholders (`<...>`) with your own values.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "google_container_cluster" "GKE_CLUSTER" {
          name     = "GKE_CLUSTER_NAME"    # Replace with your cluster name
          location = "GCP_REGION_OR_ZONE"  # Replace with your region/zone (e.g. "us-central1")

          # Replace with your project ID
          project = "GCP_PROJECT_ID"

          # Minimal node config with limited service account scopes
          node_config {
            service_account = "GKE_NODE_SERVICE_ACCOUNT_EMAIL" # Replace with the node SA email

            # REMOVE any broad "cloud-platform" scope and list only the specific scopes required.
            # Example: basic logging/monitoring plus read-only storage; adjust to your needs.
            oauth_scopes = [
              "https://www.googleapis.com/auth/logging.write",
              "https://www.googleapis.com/auth/monitoring",
              "https://www.googleapis.com/auth/devstorage.read_only",
            ]
          }

          # other cluster settings...
        }
        ```

        Changing `oauth_scopes` on the default node configuration forces replacement of the default node pool, which is disruptive and can cause an outage if not coordinated (or the whole cluster if using an in-place default).

        For verification, `terraform plan` should show the old broad scope (typically including `https://www.googleapis.com/auth/cloud-platform`) being removed and only the limited list of `oauth_scopes` being added, along with a recreate of the affected node pool.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>