> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # K8s enable ilb subsetting remediation ### Triage and Remediation ### Remediation To remediate the misconfiguration "For Large Clusters L4 ILB Subsetting Should Be Used" for GCP using GCP console, follow the below steps: 1. Log in to your GCP console and select the project where the misconfiguration exists. 2. Go to the "Kubernetes Engine" section from the main menu. 3. Click on the name of the cluster that you want to remediate. 4. Click on the "Edit" button. 5. Scroll down to the "Networking" section and click on "Advanced options". 6. Under "Load balancing", select "L4 Internal Load Balancer". 7. In the "Backend configuration" section, click on "Create a new backend configuration". 8. In the "Backend configuration" page, give a name to the backend configuration. 9. In the "Backend service" section, select the appropriate service from the dropdown. 10. In the "Backend instance group" section, select the instance group that you want to use. 11. In the "Health check" section, select the appropriate health check from the dropdown. 12. In the "Session affinity" section, select "None". 13. Click on the "Create" button to create the backend configuration. 14. Back in the "Load balancing" section, click on "Create a new load balancer". 15. In the "Create a Load Balancer" page, select "Internal" for the "Type" field. 16. Give a name to the load balancer. 17. In the "Backend configuration" section, select the backend configuration that you just created. 18. In the "Frontend configuration" section, select "HTTP(S)" for the "Protocol" field. 19. In the "IP address" section, select "Internal IP address". 20. Click on the "Create" button to create the load balancer. 21. Wait for a few minutes for the load balancer to be created. 22. Once the load balancer is created, go back to the "Kubernetes Engine" section and click on the name of the cluster. 23. Click on the "Edit" button. 24. Scroll down to the "Networking" section and click on "Advanced options". 25. Under "Load balancing", select the load balancer that you just created. 26. Click on the "Save" button to save the changes. By following these steps, you can remediate the misconfiguration "For Large Clusters L4 ILB Subsetting Should Be Used" for GCP using GCP console. # To remediate the misconfiguration "For Large Clusters L4 ILB Subsetting Should Be Used" for GCP using GCP CLI, you can follow the below steps: 1. Open the Cloud Shell in your GCP console. 2. Check if you have the latest version of gcloud CLI by running the command: `gcloud components update`. 3. Run the command `gcloud config set project [PROJECT_ID]` to set the project where the misconfiguration exists. 4. Run the command `gcloud compute backend-services list` to list all the backend services in the project. 5. Identify the backend service for which you want to enable L4 ILB subsetting. 6. Run the command `gcloud compute backend-services update [BACKEND_SERVICE_NAME] --load-balancing-scheme internal --load-balancing-mode UTILIZATION --max-utilization 0.8 --connection-draining-timeout 300 --session-affinity NONE --health-checks [HEALTH_CHECK_NAME] --enable-logging --global --subnet [SUBNET_NAME] --database-subnet [DATABASE_SUBNET_NAME] --enable-cdn --l4-ilb-subsetting-enabled` to enable L4 ILB subsetting for the backend service. Note: Replace the placeholders \[PROJECT\_ID], \[BACKEND\_SERVICE\_NAME], \[HEALTH\_CHECK\_NAME], \[SUBNET\_NAME], and \[DATABASE\_SUBNET\_NAME] with the actual values specific to your project and backend service. To remediate the misconfiguration "For Large Clusters L4 ILB Subsetting Should Be Used" in GCP using Python, follow the steps below: 1. Import the necessary libraries: ``` from google.cloud import compute_v1 ``` 2. Define the project ID and the zone where the instance is located: ``` project_id = 'your-project-id' zone = 'us-central1-a' ``` 3. Create a Compute Engine client: ``` compute_client = compute_v1.InstancesClient() ``` 4. Retrieve the instance resource: ``` instance_name = 'your-instance-name' instance = compute_client.get(project_id=project_id, zone=zone, instance=instance_name) ``` 5. Check if the instance has a network interface: ``` if instance.network_interfaces: ``` 6. Retrieve the network interface: ``` network_interface = instance.network_interfaces[0] ``` 7. Check if the network interface has an attached network endpoint group: ``` if network_interface.network_endpoint_groups: ``` 8. Retrieve the network endpoint group: ``` network_endpoint_group = network_interface.network_endpoint_groups[0] ``` 9. Check if the network endpoint group has a load balancing scheme of INTERNAL: ``` if network_endpoint_group.load_balancing_scheme == compute_v1.types.NetworkEndpointGroup.LoadBalancingScheme.INTERNAL: ``` 10. Check if the network endpoint group has a load balancing scheme of INTERNAL\_MANAGED: ``` if network_endpoint_group.load_balancing_scheme == compute_v1.types.NetworkEndpointGroup.LoadBalancingScheme.INTERNAL_MANAGED: ``` 11. Check if the network endpoint group has a load balancing scheme of INTERNAL\_SELF\_MANAGED: ``` if network_endpoint_group.load_balancing_scheme == compute_v1.types.NetworkEndpointGroup.LoadBalancingScheme.INTERNAL_SELF_MANAGED: ``` 12. Retrieve the health check: ``` health_check = network_endpoint_group.health_checks[0] ``` 13. Update the L4 ILB Subsetting setting: ``` network_endpoint_group.l4_ilb_subsetting = True network_endpoint_group.update_mask.add_field('l4_ilb_subsetting') compute_client.update_network_endpoint_group(project=project_id, zone=zone, networkEndpointGroup=network_endpoint_group.name, body=network_endpoint_group) ``` 14. Print a success message: ``` print('L4 ILB Subsetting has been enabled for the network endpoint group.') ``` By following these steps, you can remediate the "For Large Clusters L4 ILB Subsetting Should Be Used" misconfiguration in GCP using Python. The `google_container_cluster` resource does not expose any argument to enable GKE L4 ILB subsetting; this feature is configured on Kubernetes `Service` objects (via annotation), not at the cluster level, so this finding **cannot be remediated on the `gcp-containers-kubernetes-cluster`/`google_container_cluster` surface in Terraform**. To enable L4 ILB subsetting you must: * Update your internal `Service` manifests to add the appropriate GKE annotation (e.g. via `kubectl` or a GitOps tool), or manage those Services via Terraform using the Kubernetes provider. * There is no cluster-level flag in the current GCP/`google_container_cluster` API or Terraform provider for this setting, and no equivalent Console toggle on the cluster resource itself.