> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Integrity Monitoring Should Be Enabled For Kubernetes Node Pools

### More Info:

Ensure that kubernetes node pools have Integrity Monitoring enabled

### Risk Level

Medium

### Address

Performance Efficiency, Operational Excellence, Reliability, Security

### Compliance Standards

HITRUST, SOC2, NISTCSF

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        Sure, here are the step-by-step instructions to remediate the misconfiguration "Integrity Monitoring Should Be Enabled For Kubernetes Node Pools" for GCP using GCP console:

        1. Go to the GCP Console and select the project where the Kubernetes node pool is located.
        2. In the left navigation menu, select "Kubernetes Engine" and then select "Node pools".
        3. From the list of node pools, select the node pool that you want to enable Integrity Monitoring for.
        4. Click on the "Edit" button at the top of the page.
        5. Scroll down to the "Security" section and click on "Show".
        6. Find the option for "Integrity monitoring" and toggle it to "On".
        7. Click on the "Save" button at the bottom of the page to save your changes.

        After completing these steps, Integrity Monitoring will be enabled for the selected Kubernetes node pool on GCP.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration "Integrity Monitoring should be enabled for Kubernetes Node Pools" for GCP using GCP CLI, follow the below steps:

        1. Open the GCP Cloud Shell or open the terminal and connect to the GCP project using the command `gcloud auth login` and `gcloud config set project [PROJECT_ID]`.

        2. Run the following command to enable the integrity monitoring for Kubernetes node pools:

        ```
        gcloud container node-pools update [NODE_POOL_NAME] --cluster=[CLUSTER_NAME] --enable-intra-node-visibility --enable-integrity-monitoring
        ```

        Replace `[NODE_POOL_NAME]` with the name of the node pool and `[CLUSTER_NAME]` with the name of the cluster.

        3. Verify the integrity monitoring is enabled for the node pool by running the following command:

        ```
        gcloud container node-pools describe [NODE_POOL_NAME] --cluster=[CLUSTER_NAME] | grep integrity
        ```

        If the output shows `"integrityMonitoringEnabled: true"`, then the integrity monitoring is enabled for the node pool.

        4. Repeat the above steps for all the node pools in the cluster.

        By following the above steps, integrity monitoring will be enabled for Kubernetes node pools in GCP using GCP CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration "Integrity Monitoring Should Be Enabled For Kubernetes Node Pools" for GCP using python, you can follow the below steps:

        1. First, you need to authenticate with the GCP project using the following python code:

        ```python theme={null}
        from google.auth import compute_engine
        from google.cloud import monitoring_v3

        # Authenticate with GCP project
        credentials = compute_engine.Credentials()
        client = monitoring_v3.MetricServiceClient(credentials=credentials)
        project_id = 'your-project-id'
        ```

        2. Then, you need to get the list of Kubernetes node pools in the GCP project using the following python code:

        ```python theme={null}
        # Get the list of Kubernetes node pools
        node_pools = []
        for cluster in client.list_clusters(project_id):
            for pool in client.list_node_pools(project_id, cluster.name):
                node_pools.append(pool)
        ```

        3. Next, you need to check if integrity monitoring is enabled for each Kubernetes node pool using the following python code:

        ```python theme={null}
        # Check if integrity monitoring is enabled for each node pool
        for pool in node_pools:
            if not pool.management.auto_repair.integrity_monitoring:
                # Enable integrity monitoring
                pool.management.auto_repair.integrity_monitoring = True
                client.update_node_pool(project_id, pool.cluster_id, pool.name, pool)
        ```

        4. Finally, you can print a message indicating that the remediation is complete using the following python code:

        ```python theme={null}
        # Print a message indicating that the remediation is complete
        print('Integrity monitoring has been enabled for all Kubernetes node pools.')
        ```

        By following these steps, you can remediate the misconfiguration "Integrity Monitoring Should Be Enabled For Kubernetes Node Pools" for GCP using python.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://cloud.google.com/kubernetes-engine/docs/how-to/shielded-gke-nodes](https://cloud.google.com/kubernetes-engine/docs/how-to/shielded-gke-nodes)