K8s Master Authorized Network Remediation

Triage and Remediation

Remediation

Remediation

Using Console

To remediate the misconfiguration "Master Authorized Network Should Be Enabled" in GCP, you can follow these steps:

Open the Google Cloud Console and log in to your account.
Select the project that you want to remediate the misconfiguration for.
In the left navigation menu, click on "IAM & Admin" and then click on "Service Accounts".
Find the service account that you want to enable Master Authorized Networks for and click on its name.
In the "Service account details" page, click on the "Edit" button at the top of the page.
Scroll down to the "Authorized networks" section and click on the "Add item" button.
In the "Add authorized network" dialog box, enter the IP address range that you want to allow access to this service account.
Click on the "Save" button to save your changes.

Once you have completed these steps, the Master Authorized Network will be enabled for the service account that you selected, and only the IP addresses that you specified will be able to access it.

Using CLI

To remediate the "Master Authorized Network Should Be Enabled" misconfiguration for GCP using GCP CLI, follow these steps:

Open the Google Cloud SDK Shell or any terminal with the GCP CLI installed.

Run the following command to enable the Master Authorized Network feature:

gcloud beta compute project-info add-metadata --metadata=enable-master-authorized-networks=TRUE

After running the command, you will receive a confirmation message indicating that the metadata was updated successfully.
```
Updated [https://www.googleapis.com/compute/v1/projects/PROJECT_ID].
```
Note: Replace PROJECT_ID with your GCP project ID.
Verify that the Master Authorized Network feature is enabled by running the following command:
```
gcloud beta compute project-info describe --project PROJECT_ID | grep -i enable-master-authorized-networks
```
If the feature is enabled, you will see the following output:
```
enable-master-authorized-networks: 'TRUE'
```
After verifying that the feature is enabled, you can proceed with configuring the Master Authorized Networks by following the official GCP documentation: https://cloud.google.com/vpc/docs/configure-private-google-access#configuring_master_authorized_networks_for_private_google_access

Note: This step is optional but highly recommended to ensure the security of your GCP resources.

By following these steps, you should have successfully remediated the "Master Authorized Network Should Be Enabled" misconfiguration for GCP using GCP CLI.

Using Python

To remediate the misconfiguration "Master Authorized Network Should Be Enabled" in Google Cloud Platform (GCP) using Python, you can follow the below steps:

Import the required libraries:

from google.cloud import bigtable
from google.oauth2 import service_account

Authenticate and create a client object:

credentials = service_account.Credentials.from_service_account_file('path/to/service_account.json')
client = bigtable.Client(project='project-id', credentials=credentials)

Get the instance object:

instance_id = 'instance-id'
instance = client.instance(instance_id)

Get the current cluster object:

cluster_id = 'cluster-id'
cluster = instance.cluster(cluster_id)

Check if the Master Authorized Networks is enabled or not:

if not cluster.encryption_config:
    print('Master Authorized Networks is not enabled')
else:
    print('Master Authorized Networks is enabled')

If it is not enabled, enable it by updating the cluster object:

if not cluster.encryption_config:
    cluster.encryption_config = bigtable.EncryptionInfo(
        encryption_type=bigtable.EncryptionInfo.EncryptionType.GOOGLE_DEFAULT_ENCRYPTION
    )
    cluster.update()
    print('Master Authorized Networks is enabled now')
else:
    print('Master Authorized Networks is already enabled')

Run the Python script to remediate the misconfiguration.

Note: Make sure to replace the 'path/to/service_account.json', 'project-id', 'instance-id' and 'cluster-id' with the actual values. Also, ensure that the service account has the necessary permissions to update the cluster object.

Using Terraform

resource "google_container_cluster" "GKE_CLUSTER" {
  name     = "GKE_CLUSTER_NAME"          # replace with your cluster name
  location = "GCP_REGION_OR_ZONE"        # e.g. "us-central1", "us-central1-a"
  project  = "GCP_PROJECT_ID"            # replace with your GCP project ID

  # ...other existing cluster configuration...

  master_authorized_networks_config {
    # Enabling this block turns on Master Authorized Networks
    cidr_blocks {
      cidr_block   = "AUTHORIZED_CIDR_BLOCK"   # e.g. "203.0.113.0/24"
      display_name = "AUTHORIZED_NETWORK_NAME" # e.g. "corp-office"
    }

    # Add additional cidr_blocks as needed, one per authorized network
    # cidr_blocks {
    #   cidr_block   = "ANOTHER_AUTHORIZED_CIDR_BLOCK"
    #   display_name = "ANOTHER_AUTHORIZED_NETWORK_NAME"
    # }
  }
}

Changing master_authorized_networks_config on an existing google_container_cluster is an in‑place update and should not force replacement of the cluster.

Verification: terraform plan should show an update to google_container_cluster.GKE_CLUSTER adding (or modifying) the master_authorized_networks_config block, with no -/+ replacement of the cluster resource.

Triage and Remediation​

Remediation​

Triage and Remediation

Remediation