> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # K8s integrity monitoring shielded nodes enabled remediation ### Triage and Remediation ### Remediation To remediate the misconfiguration "Ensure Integrity Monitoring For Shielded GKE Nodes Is Enabled" for GCP using GCP console, you can follow the below steps: 1. Open the Google Cloud Console and select the project where the GKE cluster is hosted. 2. From the Navigation menu, select Kubernetes Engine and then Clusters. 3. Select the GKE cluster you want to remediate. 4. Click on the Edit button at the top of the page. 5. In the Security section, click on the Shielded Nodes tab. 6. Enable the Integrity Monitoring option by selecting the checkbox. 7. Click on Save to apply the changes. Once the above steps are completed, Integrity Monitoring will be enabled for the Shielded GKE Nodes in your GCP project, and the misconfiguration will be remediated. # To remediate the misconfiguration "Ensure Integrity Monitoring For Shielded GKE Nodes Is Enabled" for GCP using GCP CLI, you can follow these steps: 1. Open the Cloud Shell from the GCP Console. 2. Ensure that you have the necessary permissions to make changes to the GKE cluster. 3. Run the following command to enable integrity monitoring for shielded GKE nodes: ``` gcloud container clusters update [CLUSTER_NAME] --update-shielded-nodes-integrity-monitoring ``` Note: Replace \[CLUSTER\_NAME] with the name of your GKE cluster. 4. Verify that integrity monitoring is enabled for shielded GKE nodes using the following command: ``` gcloud container clusters describe [CLUSTER_NAME] --format="value(shieldedNodes.integrityMonitoringEnabled)" ``` The output should be "true", indicating that integrity monitoring is enabled for shielded GKE nodes. 5. Repeat the above steps for all the GKE clusters in your GCP project. By following these steps, you can remediate the misconfiguration "Ensure Integrity Monitoring For Shielded GKE Nodes Is Enabled" for GCP using GCP CLI. To remediate the misconfiguration "Ensure Integrity Monitoring For Shielded GKE Nodes Is Enabled" in GCP using Python, you can follow the below steps: Step 1: Install the necessary libraries. ``` pip install google-cloud-monitoring google-auth google-auth-oauthlib google-auth-httplib2 ``` Step 2: Set up the authentication credentials for the GCP project. ``` from google.oauth2 import service_account credentials = service_account.Credentials.from_service_account_file('') ``` Step 3: Import the necessary libraries. ``` from google.cloud import monitoring_v3 from google.protobuf import duration_pb2 from google.protobuf import timestamp_pb2 ``` Step 4: Create a client object for the Monitoring API. ``` client = monitoring_v3.MetricServiceClient(credentials=credentials) ``` Step 5: Define the necessary variables. ``` project_id = '' cluster_name = '' ``` Step 6: Define the metric descriptor for the Shielded Instance Integrity Monitoring metric. ``` descriptor = monitoring_v3.types.MetricDescriptor() descriptor.type = 'container.googleapis.com/container/shielded_instance_integrity_status' descriptor.metric_kind = monitoring_v3.enums.MetricDescriptor.MetricKind.GAUGE descriptor.value_type = monitoring_v3.enums.MetricDescriptor.ValueType.BOOL descriptor.description = 'Indicates whether the shielded integrity monitoring is enabled for the node.' descriptor.display_name = 'Shielded Instance Integrity Monitoring Status' descriptor.unit = monitoring_v3.enums.MetricDescriptor.Unit.BOOL ``` Step 7: Create the metric descriptor if it doesn't already exist. ``` project_name = f'projects/{project_id}' descriptor_name = f'{project_name}/metricDescriptors/{descriptor.type}' try: client.create_metric_descriptor(name=project_name, metric_descriptor=descriptor) except AlreadyExists: pass ``` Step 8: Define the time range for the query. ``` now = time.time() seconds = int(now) nanos = int((now - seconds) * 10 ** 9) end_time = timestamp_pb2.Timestamp(seconds=seconds, nanos=nanos) start_time = timestamp_pb2.Timestamp(seconds=seconds - 3600, nanos=nanos) interval = monitoring_v3.types.TimeInterval(start_time=start_time, end_time=end_time) ``` Step 9: Define the query for the Shielded Instance Integrity Monitoring metric. ``` query = f'resource.type="gke_container" resource.labels.cluster_name="{cluster_name}" metric.type="container.googleapis.com/container/shielded_instance_integrity_status"' ``` Step 10: Execute the query and check if the Shielded Instance Integrity Monitoring metric is enabled for all nodes. ``` results = client.list_time_series( name=project_name, filter=query, interval=interval, view=monitoring_v3.enums.ListTimeSeriesRequest.TimeSeriesView.FULL, ) for result in results: if not result.points[0].value.bool_value: print(f'Shielded Instance Integrity Monitoring is not enabled for node {result.resource.labels.instance_id}.') ``` These steps will help you remediate the misconfiguration "Ensure Integrity Monitoring For Shielded GKE Nodes Is Enabled" in GCP using Python. ```hcl theme={null} resource "google_container_cluster" "PRIMARY_CLUSTER" { name = "PRIMARY_CLUSTER_NAME" # replace with your cluster name location = "PRIMARY_CLUSTER_LOCATION" # replace with your region or zone project = "GCP_PROJECT_ID" # replace with your project ID # ...other required cluster arguments... node_config { machine_type = "e2-standard-4" # example; adjust as needed # Enable Shielded GKE Nodes integrity monitoring shielded_instance_config { enable_secure_boot = true # optional but recommended enable_integrity_monitoring = true # this setting fixes the finding } # ...any other node_config settings... } # ...any other cluster settings... } ``` If you manage node pools separately, set it there instead: ```hcl theme={null} resource "google_container_node_pool" "PRIMARY_NODE_POOL" { name = "PRIMARY_NODE_POOL_NAME" # replace with your node pool name cluster = google_container_cluster.PRIMARY_CLUSTER.name location = google_container_cluster.PRIMARY_CLUSTER.location project = "GCP_PROJECT_ID" # replace with your project ID node_config { machine_type = "e2-standard-4" shielded_instance_config { enable_secure_boot = true enable_integrity_monitoring = true } } # ...other node pool settings... } ``` Enabling `shielded_instance_config` (or changing it) on an existing node pool will trigger node recreation/rolling upgrade, which is a disruptive change for workloads running on those nodes. For verification, `terraform plan` should show `enable_integrity_monitoring` changing from `false` (or being added) to `true` in the `shielded_instance_config` block of the affected `node_config`.