> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Ensure The GKE Metadata Server Is Enabled

### More Info:

Running the GKE Metadata Server prevents workloads from accessing sensitive instance metadata and facilitates Workload Identity

### Risk Level

Low

### Address

Operational Excellence, Performance Efficiency, Reliability, Security

### Compliance Standards

* CIS GKE

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration "Ensure The GKE Metadata Server Is Enabled" for GCP using GCP console, follow the below steps:

        1. Go to the Google Kubernetes Engine (GKE) cluster in the GCP console.
        2. Click on "Edit" button at the top of the page.
        3. Scroll down to the "Security" section.
        4. Ensure that "Enable metadata concealment" is unchecked.
        5. Click on "Save" button at the bottom of the page.

        By following these steps, you will remediate the misconfiguration "Ensure The GKE Metadata Server Is Enabled" for GCP using GCP console.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration "Ensure The GKE Metadata Server Is Enabled" for GCP using GCP CLI, you can follow the below steps:

        1. Open the Cloud Shell in the GCP Console.

        2. Run the following command to enable the GKE Metadata Server:

        ```
        gcloud container clusters update CLUSTER_NAME --enable-metadata-concealment=false
        ```

        Replace `CLUSTER_NAME` with the name of your GKE cluster.

        3. Verify that the GKE Metadata Server is enabled by running the following command:

        ```
        gcloud container clusters describe CLUSTER_NAME --format="value(masterAuth.clusterCaCertificate)"
        ```

        If the output shows a valid cluster certificate, then the GKE Metadata Server is enabled.

        4. Repeat the above steps for all the GKE clusters in your GCP project.

        By following the above steps, you can successfully remediate the misconfiguration "Ensure The GKE Metadata Server Is Enabled" for GCP using GCP CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration "Ensure The GKE Metadata Server Is Enabled" for GCP using Python, follow these steps:

        1. Install the required Python libraries:

        ```
        pip install google-auth google-auth-oauthlib google-auth-httplib2 google-cloud-container
        ```

        2. Authenticate with GCP:

        ```
        from google.oauth2 import service_account
        from google.cloud import container_v1

        credentials = service_account.Credentials.from_service_account_file('<path-to-service-account-key.json>')
        client = container_v1.ClusterManagerClient(credentials=credentials)
        ```

        3. Get the cluster:

        ```
        project_id = '<your-project-id>'
        zone = '<your-zone>'
        cluster_id = '<your-cluster-id>'

        cluster = client.get_cluster(project_id, zone, cluster_id)
        ```

        4. Check if the GKE Metadata Server is enabled:

        ```
        if cluster.private_cluster_config.enable_private_endpoint:
            print('GKE Metadata Server is already enabled')
        else:
            print('GKE Metadata Server is not enabled')
        ```

        5. Enable the GKE Metadata Server:

        ```
        cluster.private_cluster_config.enable_private_endpoint = True

        update_request = container_v1.types.UpdateClusterRequest(
            project_id=project_id,
            zone=zone,
            cluster_id=cluster_id,
            update=cluster,
        )

        operation = client.update_cluster(update_request)

        print('Waiting for operation to complete...')
        operation.result()

        print('GKE Metadata Server has been enabled')
        ```

        Note: Make sure to replace `<path-to-service-account-key.json>`, `<your-project-id>`, `<your-zone>`, and `<your-cluster-id>` with the appropriate values.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "google_container_cluster" "PRIMARY_CLUSTER" {
          name     = "PRIMARY_CLUSTER_NAME"          # replace with your cluster name
          location = "GCP_REGION_OR_ZONE"            # e.g. "us-central1" or "us-central1-c"
          project  = "GCP_PROJECT_ID"                # replace with your project ID

          # If using the default node pool (not recommended for production), you must
          # set workload_metadata_config there; example shown in a separate node pool
          # resource below for clarity.
          remove_default_node_pool = true
          initial_node_count       = 1

          # Optional but recommended for Workload Identity
          workload_identity_config {
            workload_pool = "GCP_PROJECT_ID.svc.id.goog"  # replace with your project ID
          }

          # ...other cluster settings...
        }

        resource "google_container_node_pool" "PRIMARY_NODE_POOL" {
          name       = "PRIMARY_NODE_POOL_NAME"      # replace with your node pool name
          cluster    = google_container_cluster.PRIMARY_CLUSTER.name
          location   = google_container_cluster.PRIMARY_CLUSTER.location
          project    = google_container_cluster.PRIMARY_CLUSTER.project
          node_count = 3                             # adjust as needed

          node_config {
            machine_type = "e2-medium"

            # This block enables the GKE Metadata Server for workloads on this node pool
            workload_metadata_config {
              mode = "GKE_METADATA"
            }
          }

          # ...other node pool settings...
        }
        ```

        Changing `workload_metadata_config.mode` on an existing node pool forces replacement of that node pool’s VMs (they will be recreated with the new metadata mode), but it does not recreate the cluster itself.

        To verify, `terraform plan` should show an update to each `google_container_node_pool` adding or changing `workload_metadata_config.mode` from `GCE_METADATA` (or unset) to `GKE_METADATA`, with the node instances being replaced.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://cloud.google.com/kubernetes-engine/docs/how-to/protecting-cluster-metadata#concealment](https://cloud.google.com/kubernetes-engine/docs/how-to/protecting-cluster-metadata#concealment)