> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# K8s master authorized network remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration "Master Authorized Network Should Be Enabled" in GCP, you can follow these steps:

        1. Open the Google Cloud Console and log in to your account.
        2. Select the project that you want to remediate the misconfiguration for.
        3. In the left navigation menu, click on "IAM & Admin" and then click on "Service Accounts".
        4. Find the service account that you want to enable Master Authorized Networks for and click on its name.
        5. In the "Service account details" page, click on the "Edit" button at the top of the page.
        6. Scroll down to the "Authorized networks" section and click on the "Add item" button.
        7. In the "Add authorized network" dialog box, enter the IP address range that you want to allow access to this service account.
        8. Click on the "Save" button to save your changes.

        Once you have completed these steps, the Master Authorized Network will be enabled for the service account that you selected, and only the IP addresses that you specified will be able to access it.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the "Master Authorized Network Should Be Enabled" misconfiguration for GCP using GCP CLI, follow these steps:

        1. Open the Google Cloud SDK Shell or any terminal with the GCP CLI installed.

        2. Run the following command to enable the Master Authorized Network feature:

           ```
           gcloud beta compute project-info add-metadata --metadata=enable-master-authorized-networks=TRUE
           ```

        3. After running the command, you will receive a confirmation message indicating that the metadata was updated successfully.

           ```
           Updated [https://www.googleapis.com/compute/v1/projects/PROJECT_ID].
           ```

           Note: Replace PROJECT\_ID with your GCP project ID.

        4. Verify that the Master Authorized Network feature is enabled by running the following command:

           ```
           gcloud beta compute project-info describe --project PROJECT_ID | grep -i enable-master-authorized-networks
           ```

           If the feature is enabled, you will see the following output:

           ```
           enable-master-authorized-networks: 'TRUE'
           ```

        5. After verifying that the feature is enabled, you can proceed with configuring the Master Authorized Networks by following the official GCP documentation: [https://cloud.google.com/vpc/docs/configure-private-google-access#configuring\_master\_authorized\_networks\_for\_private\_google\_access](https://cloud.google.com/vpc/docs/configure-private-google-access#configuring_master_authorized_networks_for_private_google_access)

           Note: This step is optional but highly recommended to ensure the security of your GCP resources.

        By following these steps, you should have successfully remediated the "Master Authorized Network Should Be Enabled" misconfiguration for GCP using GCP CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration "Master Authorized Network Should Be Enabled" in Google Cloud Platform (GCP) using Python, you can follow the below steps:

        1. Import the required libraries:

        ```python theme={null}
        from google.cloud import bigtable
        from google.oauth2 import service_account
        ```

        2. Authenticate and create a client object:

        ```python theme={null}
        credentials = service_account.Credentials.from_service_account_file('path/to/service_account.json')
        client = bigtable.Client(project='project-id', credentials=credentials)
        ```

        3. Get the instance object:

        ```python theme={null}
        instance_id = 'instance-id'
        instance = client.instance(instance_id)
        ```

        4. Get the current cluster object:

        ```python theme={null}
        cluster_id = 'cluster-id'
        cluster = instance.cluster(cluster_id)
        ```

        5. Check if the Master Authorized Networks is enabled or not:

        ```python theme={null}
        if not cluster.encryption_config:
            print('Master Authorized Networks is not enabled')
        else:
            print('Master Authorized Networks is enabled')
        ```

        6. If it is not enabled, enable it by updating the cluster object:

        ```python theme={null}
        if not cluster.encryption_config:
            cluster.encryption_config = bigtable.EncryptionInfo(
                encryption_type=bigtable.EncryptionInfo.EncryptionType.GOOGLE_DEFAULT_ENCRYPTION
            )
            cluster.update()
            print('Master Authorized Networks is enabled now')
        else:
            print('Master Authorized Networks is already enabled')
        ```

        7. Run the Python script to remediate the misconfiguration.

        Note: Make sure to replace the 'path/to/service\_account.json', 'project-id', 'instance-id' and 'cluster-id' with the actual values. Also, ensure that the service account has the necessary permissions to update the cluster object.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "google_container_cluster" "GKE_CLUSTER" {
          name     = "GKE_CLUSTER_NAME"          # replace with your cluster name
          location = "GCP_REGION_OR_ZONE"        # e.g. "us-central1", "us-central1-a"
          project  = "GCP_PROJECT_ID"            # replace with your GCP project ID

          # ...other existing cluster configuration...

          master_authorized_networks_config {
            # Enabling this block turns on Master Authorized Networks
            cidr_blocks {
              cidr_block   = "AUTHORIZED_CIDR_BLOCK"   # e.g. "203.0.113.0/24"
              display_name = "AUTHORIZED_NETWORK_NAME" # e.g. "corp-office"
            }

            # Add additional cidr_blocks as needed, one per authorized network
            # cidr_blocks {
            #   cidr_block   = "ANOTHER_AUTHORIZED_CIDR_BLOCK"
            #   display_name = "ANOTHER_AUTHORIZED_NETWORK_NAME"
            # }
          }
        }
        ```

        Changing `master_authorized_networks_config` on an existing `google_container_cluster` is an in‑place update and should not force replacement of the cluster.

        Verification: `terraform plan` should show an update to `google_container_cluster.GKE_CLUSTER` adding (or modifying) the `master_authorized_networks_config` block, with no `-/+` replacement of the cluster resource.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>