Ensure Integrity Monitoring For Shielded GKE Nodes Is Enabled
More Info:
Enable Integrity Monitoring for Shielded GKE Nodes to be notified of inconsistencies during the node boot sequence.Risk Level
HighAddress
Security, Reliability, Operational Excellence, Performance EfficiencyCompliance Standards
CISGKETriage and Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration “Ensure Integrity Monitoring For Shielded GKE Nodes Is Enabled” for GCP using GCP console, you can follow the below steps:
- Open the Google Cloud Console and select the project where the GKE cluster is hosted.
- From the Navigation menu, select Kubernetes Engine and then Clusters.
- Select the GKE cluster you want to remediate.
- Click on the Edit button at the top of the page.
- In the Security section, click on the Shielded Nodes tab.
- Enable the Integrity Monitoring option by selecting the checkbox.
- Click on Save to apply the changes.
Using CLI
Using CLI
To remediate the misconfiguration “Ensure Integrity Monitoring For Shielded GKE Nodes Is Enabled” for GCP using GCP CLI, you can follow these steps:Note: Replace [CLUSTER_NAME] with the name of your GKE cluster.The output should be “true”, indicating that integrity monitoring is enabled for shielded GKE nodes.
- Open the Cloud Shell from the GCP Console.
- Ensure that you have the necessary permissions to make changes to the GKE cluster.
- Run the following command to enable integrity monitoring for shielded GKE nodes:
- Verify that integrity monitoring is enabled for shielded GKE nodes using the following command:
- Repeat the above steps for all the GKE clusters in your GCP project.
Using Python
Using Python
To remediate the misconfiguration “Ensure Integrity Monitoring For Shielded GKE Nodes Is Enabled” in GCP using Python, you can follow the below steps:Step 1: Install the necessary libraries.Step 2: Set up the authentication credentials for the GCP project.Step 3: Import the necessary libraries.Step 4: Create a client object for the Monitoring API.Step 5: Define the necessary variables.Step 6: Define the metric descriptor for the Shielded Instance Integrity Monitoring metric.Step 7: Create the metric descriptor if it doesn’t already exist.Step 8: Define the time range for the query.Step 9: Define the query for the Shielded Instance Integrity Monitoring metric.Step 10: Execute the query and check if the Shielded Instance Integrity Monitoring metric is enabled for all nodes.These steps will help you remediate the misconfiguration “Ensure Integrity Monitoring For Shielded GKE Nodes Is Enabled” in GCP using Python.